{ "Event": { "published": true, "date": "2026-02-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-18", "timestamp": 1771459382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a93a6587-c262-4165-ba09-529acc76900d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fc4586-0d1d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771455369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455369, "uuid": "0098bc0a-523b-43d5-8915-14c0b2c309ef", "comment": "Malware payload", "value": "cd38814564714c38424171932d876dc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455369, "uuid": "0531c875-85ae-400e-ba1c-9011d6693ea7", "comment": "Malware payload", "value": "00604d1c5d84bcc2fa438324a42b94b4a59fc87d13bb9a4b3374c8cb0dd9a51a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455369, "uuid": "d18fc35b-fd4d-4497-b361-0bc0c935d6a7", "comment": "Malware payload", "value": "f56d51238f2f8250054b30707cbdbc22b0b39130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455369, "uuid": "36129e04-0083-42ae-a42e-ae982b89af2d", "comment": "Malware payload", "value": "8ec548b76fc5be51920d859231851baa527421383ca00570d79708c571827cae3019521cb0c365ad7c2197f8e4df2997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455369, "uuid": "6c5621cc-3065-45f4-90da-1f66eda88f05", "value": "T155C32A95FD819B12CAC2167BFB9E828C37275368D2EE72039E255F71378B45B0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455369, "uuid": "637c0f30-302f-4ad7-a403-f9c1f8694d1c", "value": "1536:IkL0pcgfXHnWIYLQIQ78To6jYeBDYgyvbSbhZfdhFHaOz0Hp1WYHCt+2a/mdK2d:t6LnhsQIQu1ryb0hZrF8PR7Od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771455369, "uuid": "5719e05c-c375-48f0-9f2e-23eb2eb86b5d", "value": 124732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771455369, "uuid": "78980356-e394-4180-a9dd-a65b33202faa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455369, "uuid": "13b2524b-d645-444a-8f15-ad5414efa58e", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f01331-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771407032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407032, "uuid": "d84e9f3c-1a87-442c-bd4f-4da01ce6fa02", "comment": "Malware payload (VIPKeylogger)", "value": "ff285e02d5508dc0571cf376cdef2582", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407032, "uuid": "d0cfe9eb-394a-4ccd-8b49-cc93bc0312d1", "comment": "Malware payload (VIPKeylogger)", "value": "007bf56490dc2b0873970b6f5589b2036080eb4a62834d81ad110fe7427d312a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407032, "uuid": "32e61a45-3bfd-429a-8d82-c5b83011efd9", "comment": "Malware payload (VIPKeylogger)", "value": "1288f3688c793b28743fc29f1babbaad12a47859", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407032, "uuid": "d1c3ad2b-1a55-4c3f-b667-0bb9953ed6be", "comment": "Malware payload (VIPKeylogger)", "value": "15e7eea883ee7edd4f125d4a78177ee7a39bdb92806aee6b3173da0cf2cf751670f3f50ad7df90a4bef302748db4c41d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407032, "uuid": "1b71aeb2-11dd-4ee8-9a4a-bfb7d52a4e94", "value": "T1DB550121CA45CD20162C826564A65EDB29240E774C54BBA93FAF0B8E1F4F29FC4727FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407032, "uuid": "e1a338a5-a000-4cf8-9d72-d607d1908684", "value": "24576:IQxZjFc7AgVmsUqiazzl1ul2qfCGVe7EpwYjgJuKv4f0NSbS:/jFg/rqvzKYjZfmS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407032, "uuid": "f6291d47-8a4a-4cb5-84eb-9b5313c1b546", "value": 1367553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407032, "uuid": "5f566f5c-e10a-4242-8808-abd1698cc57c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407032, "uuid": "9f0c6d18-94cf-4ee9-aafa-65da624d1bff", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93811ad5-0ca0-11f1-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1771401923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401923, "uuid": "deae1be9-d4af-4fe3-8422-d2d878db4a93", "comment": "Malware payload (PureCrypter)", "value": "1a2400fbdbda33c1c59f47b12deb6a8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401923, "uuid": "91292ccc-ffe8-4f93-8a14-1d720a6aec4f", "comment": "Malware payload (PureCrypter)", "value": "00c01ae386de339870cd17228b7b8494835558c4a324a8b04236158ec5157ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401923, "uuid": "958a379b-fa2f-49c6-bef1-b19fff3bd352", "comment": "Malware payload (PureCrypter)", "value": "67a17ca10017f95edd30718c6aeca973b330c73b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401923, "uuid": "988004ab-e695-43f1-a1c1-37830b74c478", "comment": "Malware payload (PureCrypter)", "value": "78a98ad40843a18dd623781034b5a3af02a184c654fb924257100d1bf551c1d8c9677039912269d26608e9c0d7af9d70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401923, "uuid": "449192df-154a-47d1-9284-005672cf144f", "value": "T152E4BF6B76678D21D2881337D18B484193B5568275B3E70EB58823F229473EEDE0B3E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401923, "uuid": "e6f30ee6-0e77-4c52-958c-319a8b71786a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401923, "uuid": "ee139aed-bb8f-415e-8c4f-2af293b0e94c", "value": "12288:+CYI3c7GvN+LtdqaqL0EymMawHWvYxiuN/ejDY8QdMc4S6:+IhvNsEXL0n/Wb95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401923, "uuid": "49a57e38-4766-42bd-8936-f626249dc5c3", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401923, "uuid": "41337693-2e1c-4681-9372-9d71df8ca503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401923, "uuid": "92847b16-a41a-49e8-a938-23cbb5362ccf", "value": "1a2400fbdbda33c1c59f47b12deb6a8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e49f7f-0cca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771419890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419890, "uuid": "0b97abb3-51ca-4da3-970e-f6dafd563c34", "comment": "Malware payload", "value": "84d0e3ab66e792acc932da18e96bf719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419890, "uuid": "ec70f09e-8543-46c9-bb5e-b6a0f8e46627", "comment": "Malware payload", "value": "0183cd9096d235436e80f94124afb33d9f2235873c2034270db8bae6572d5c88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419890, "uuid": "b9366d8d-b2a7-4e90-8d58-3ddea4419d9a", "comment": "Malware payload", "value": "a22a14495eddca241630d3230c7da7951807ac10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419890, "uuid": "5c551a3c-3fc4-4318-a44b-f660d6a4c070", "comment": "Malware payload", "value": "c984b679c37d6e0d0c1a4f1367d7a44c6a81896d6daea2552181ed08d943b8de691529d001cdac2d181797662576d363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419890, "uuid": "617353ef-17f0-484d-84f6-91d003b30c74", "value": "T1C5659ED6EB0F57FDDD2E9AB1810DEDCB72201AE12AB18EF2D5DC1D70077CAAA5851480", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419890, "uuid": "b8ee20cc-2021-4b19-bbae-961fcdb843da", "value": "0c04363417c8544dfd508c7272e7940b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419890, "uuid": "bf378751-9a2e-4167-a846-5861737a5c72", "value": "24576:p4/f3m8a0qV15CEbp1VLEnf1OPJkjB/WdSdOB7lKijYbiaxIH:pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771419890, "uuid": "13f82dd6-33f8-4d7b-9e3a-f0aac52a463b", "value": 1479328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771419890, "uuid": "4929735a-24b8-42fb-b9d2-1321f64eff59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419890, "uuid": "d9050fca-0bbf-43e1-8bc6-e2bf7aaf275b", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd050b1b-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406771, "uuid": "7437a755-f13e-4ced-acd5-d94c51cbfc39", "comment": "Malware payload", "value": "345c0f4cb9590d29f7f90ca83f00aeae", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406771, "uuid": "c43c70f3-1e96-4e24-b9aa-c4709a436165", "comment": "Malware payload", "value": "019a1c8ee050c2870b7ae69cbc9fe97de90fdf42f7a090c81c07c4168b824b59", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406771, "uuid": "02ebbbdc-213a-4b28-a1fd-d6e86f277060", "comment": "Malware payload", "value": "6dde5f79666039c651df3493a2418330d3411756", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406771, "uuid": "720b9f49-d6d8-4723-9cd2-9fa118ba942d", "comment": "Malware payload", "value": "ea8fe248bfed3c086c3497a79a53546e1e2e6e17bf54574535ae3ee17cfb0a86b23f6b5f5164dc588a3186e739b747cc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406771, "uuid": "8f0dd6bb-cf86-40ee-a34c-c10ea4b55d68", "value": "T1AF829327CE05ABF00D7EA3616897A816DA620315B5357949BD8EC9D93F33254CFC80FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406771, "uuid": "88420e0a-ac6a-4659-9f17-be2250b79868", "value": "384:KfpvB1J4oMRN1ZV8IkGMTkvRYJ5lH7VcyKF4:KfpvBkvsTgRYJ5lH7Vcyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406771, "uuid": "93072038-a8c9-4b0a-93fd-d232bf61fb6e", "value": 18789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406771, "uuid": "e6669866-5e96-4865-8d7c-3ea360abe494", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406771, "uuid": "e251208a-ade2-4d01-933b-096a25975f56", "value": "Absa Proof of payment.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adaaa22-0cf5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771438335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438335, "uuid": "5827f83b-9105-419a-82ee-89c8b03daa50", "comment": "Malware payload", "value": "01fd8c41d674072171da7ca09be92189", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438335, "uuid": "b039fd82-5c24-4409-85ca-dfe197384e13", "comment": "Malware payload", "value": "0211647c67f897604b5007eab62ed98f124b3d1523b99ed1ad8c20ebdb9965af", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438335, "uuid": "31525b07-41bd-4608-9e8e-62fd0cb4e55b", "comment": "Malware payload", "value": "e1917ca0c89da59c5a84a9541b448c307fecb68f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438335, "uuid": "228d2b38-f916-4633-8847-904f35b3779a", "comment": "Malware payload", "value": "1494f04869b53da2696834113cf2f8a651e4104acd0178a31a23a4b0d31db87aa900e626181368495a4dc6f74c127aa2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438335, "uuid": "55ec6c29-6d40-4253-975e-7b68def96639", "value": "T1442833F833F40B97EB2A6675629C8BB610199D2D20C1AD59C4B4CB80FD6ECDECDB9441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438335, "uuid": "a4fa49b0-6f63-49d4-a1fa-ec5a4e85e501", "value": "1572864:n6kbHkku51hwlZZ1IeFQmW1FbizIrYhFKx3974gG3kLbPNFIqJvPCvpPnKdo0Zm4:nLbbuzC/Z1h2iz/87i3WHJvC5nKQYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771438335, "uuid": "d9c473ea-118e-4aa4-bf96-577a06df61ce", "value": 95926324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771438335, "uuid": "b70dbba1-3aef-426b-b22e-5e9954c14963", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438335, "uuid": "6c698bf6-e6db-4cde-99a7-b79315e9688f", "value": "Schedule I OFME.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dc3dac-0cfa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771440508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440508, "uuid": "583924c5-30a6-4e05-b374-8f9318a5898c", "comment": "Malware payload", "value": "dcb3e84da90a570b2279a254deb59780", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440508, "uuid": "30b225bf-1a71-49a5-9d30-b6de6b28a008", "comment": "Malware payload", "value": "02aa89d95e324dc25f418052c22730a207d6cc424df253d07360e348a8d66612", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440508, "uuid": "d1ce45b9-1a29-4531-802a-6c09cc913f86", "comment": "Malware payload", "value": "4dd6458a961bfc0fb586c66871d6caaea0aa49d6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440508, "uuid": "be1feddc-79de-4f0e-93bb-10bb810e56c7", "comment": "Malware payload", "value": "cd24b6bf0c7f0c8d435a161d8fce70ed65a8fbb191dfbabc9bf520a1ab6843dd15abbd605c5a179d3fd2a7d23bf383b1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440508, "uuid": "1c8c74ba-2a84-4a98-a95b-ac05f3861340", "value": "T1542733A1E2110103C89FD63D8E6D07AC183F6D166506D6DEFB3AB7AD0D326B2F0A1E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440508, "uuid": "1a3a80bd-92cf-48c2-8a65-dff6131f4098", "value": "393216:LaLHgjk9j1e3KhnFULF2v66OApoPJg/2cLjbGbzY+Z5mHi3vEz6FQEzR:SHEk9j1ez2v66rpOJ54jyhEz6Dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771440508, "uuid": "fc1a062d-1eab-4aaf-936f-679f4b88b94a", "value": 22040576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771440508, "uuid": "20496733-1baf-401d-9a27-c02fbf4a8276", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440508, "uuid": "b1d57c6a-03bd-4b13-aa24-b2472ca4111e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c0ee4a-0cd5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771424469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424469, "uuid": "78dbf149-800c-4721-9242-53875ffdc7b5", "comment": "Malware payload (Mirai)", "value": "1e197cf9490a41334ccf39c2135c84cd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424469, "uuid": "3053ac3e-4cfd-4e8b-99f9-c22c5f65ec74", "comment": "Malware payload (Mirai)", "value": "031fd8631be408a30071c8f0fa12c4fa6ef059ca0838da8f46c4d6114e5deae8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424469, "uuid": "e3e155c1-0b09-4496-bfec-369b8c2a7c9f", "comment": "Malware payload (Mirai)", "value": "796d146884de038be358c1b6eff3641c80ee6a53", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424469, "uuid": "eeed8b1a-e70a-462c-832e-238055c0e902", "comment": "Malware payload (Mirai)", "value": "0c96c2abc06dc9c4c70af8daf2b88687f2d8468aa282ec080851dadb1fa085d023b032bc390d59fa1101f2f42eeb0374", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424469, "uuid": "3a8b4058-05df-45bc-90d7-868ef2b46459", "value": "T15A4107EE60750381E5CCDA24F5F489D45305EAAC71E82673E9492F76E889D803011BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424469, "uuid": "4c709718-d6ae-495a-83bb-62a714413876", "value": "24:7DdKW1BAuBM/h7b1bElD2wh6fnNo79gKWJ+4GHw:cW1BUckNo79i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771424469, "uuid": "63d88b27-85b4-48fc-8b24-46b211508c12", "value": 1930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771424469, "uuid": "6bd885f9-7a8e-4b11-92a2-071bc6989668", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424469, "uuid": "de923b53-fa14-4c3c-955e-51862d824258", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ca710b-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402192, "uuid": "578629fc-3c97-4152-8ba4-2a6ea26788cb", "comment": "Malware payload (Mirai)", "value": "3d50650a648764501c1e2a60b579c427", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402192, "uuid": "a4bbc8f1-8b8f-4b22-9ae2-f657df29d99f", "comment": "Malware payload (Mirai)", "value": "0391734eb7aa0ea1e978ca1eb0c2f14b7dfed5fed09c3cf372c4513224e88f1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402192, "uuid": "88666a59-8be0-4496-b259-ed0f3a9fd185", "comment": "Malware payload (Mirai)", "value": "0968b6fe173f4417d144ff91b04ec767803d8534", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402192, "uuid": "5b0aff17-38b1-4448-8988-44780bd04d29", "comment": "Malware payload (Mirai)", "value": "b972241e903fb43e44d35a2048b53ee7a2f5013feca453f7c5183d6a6205fe157cb081615fe2a4fffb77cf9b929019bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402192, "uuid": "4f614336-8012-4d0b-be1f-8cbdf03e7582", "value": "T1F5F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402192, "uuid": "0bf796a6-0fdb-43d9-bdd6-2b04c5a3cd08", "value": "1536:3dMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpDEn5p5M/LW:/7vDtrnPTR71gmX7Dy7fMpDxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402192, "uuid": "32170f71-5ba7-42da-8799-b0ac07a05f9f", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402192, "uuid": "4007bbbb-a596-43ed-aa04-2b4d1ad1346d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402192, "uuid": "9d730163-17d8-42d9-b3dc-31915dd5cb04", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb0e0b4-0c91-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771395335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395335, "uuid": "ed466870-8d57-4cc3-b77d-eb1ad1e3b5c8", "comment": "Malware payload", "value": "16200c3fd77635d1f44b9ac76894213b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395335, "uuid": "bfb16019-632e-4803-86a2-267a6884d11e", "comment": "Malware payload", "value": "04dbe833a232e5271f48a9d7c53c48bb68d45c37c1f6bcddca685630d49bf3df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395335, "uuid": "75295789-127e-4dd9-984c-c332852ba0a9", "comment": "Malware payload", "value": "88477e4b18c3350c131d956d63ff3e244a1ad893", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395335, "uuid": "c51bbaa6-51c5-458e-a555-01917624fd39", "comment": "Malware payload", "value": "527b566c3683f745c45c60c0dc9a86cc41680fd88a8d8f2578104062b2ce6de944fb5924a5186adae603b6fe51ccba42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395335, "uuid": "a4bf02e2-e844-4072-a6c6-4986a4290ab9", "value": "T1A604F14AFD904FDBC46FCEB1458F131615FCD99896D3A32F02A89C1CB29D69992D3E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395335, "uuid": "cbec59fe-d6dd-40f2-b9e2-2321b3d40035", "value": "3072:oDTIzc663gmsQ/5ppDrpE1Np3jW5Mpz7e5pzCknS2rE09PIGv+nP++l+5cI:rzR63rvppDrQa5MJRknS2D9Pb+foyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395335, "uuid": "db19d7d2-e8ee-40b3-996f-4c5dd6e0b57a", "value": 180237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395335, "uuid": "6dae9dfe-eaf5-4653-b969-e22f483fc73d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395335, "uuid": "75c8abe8-bfc2-46ff-83d6-a70c3c26455a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c741c7ff-0d05-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771445389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445389, "uuid": "8ba88fe6-6b5c-47a7-810a-b7400b9e7e84", "comment": "Malware payload", "value": "1e1660e3b559b618e3e26d44662964ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445389, "uuid": "72cba26e-e24d-4395-9f82-5042a5aeb0a6", "comment": "Malware payload", "value": "06bf25cfca175d132f6cc079b0bcf93552c1c650572ea1e33db7c4e1bd6b5745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445389, "uuid": "a84dc8e8-77d8-4a9e-a381-2bf1359fd599", "comment": "Malware payload", "value": "caf219c781946952a7ae44c73559041f7c2fe915", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445389, "uuid": "eba78818-4d07-482f-9e83-e58822f8131b", "comment": "Malware payload", "value": "d31dfc44ee6758b6546e286b9e68f5f8c04bec05f4e8a9e79520832304b2682b68169dc9fa7fcc2cef23d27863c06b79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445389, "uuid": "0837a770-0eb2-4aef-854f-1f896917890a", "value": "T14FE32A45FC509F26C6D221BBFB5E428D772A47ACD3EE720399255F20378A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445389, "uuid": "9ac6c75c-680f-4af0-9238-74663ddb279b", "value": "1536:oH/hUYbiCEfgLr1Ewh3ipqf+Asksf+ADKtXT4uZmKhfCOcjPhslAsJ+FDlVfwywp:o5UCiB6icf+4o+A8XTZmg6AAsMHouph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445389, "uuid": "ee93be59-b5b6-43a7-891d-cb8a11627675", "value": 146144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445389, "uuid": "ecd3dc24-c442-400e-994b-9a41d969ac77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445389, "uuid": "71116058-fe9a-4696-8cc0-a5578dd0a826", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21eb9e1f-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433086, "uuid": "675f9ee4-e694-4fc1-afde-4eee54e4c27a", "comment": "Malware payload (Mirai)", "value": "bfeb37e0dc757bffa86e165cde8200e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433086, "uuid": "948093be-965b-4db3-b931-82a026e86440", "comment": "Malware payload (Mirai)", "value": "06cdcf6f8568c67f75e2cf78fc2c52d6f558c329b80ba3cca0a2797fce6deadc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433086, "uuid": "e0a69e17-ec4c-4f6a-952a-53570d2f47f7", "comment": "Malware payload (Mirai)", "value": "a72a6a5b277e30007bc76b02a51493fe18465c8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433086, "uuid": "5553e553-65bb-4d4a-afcd-b88035846f0e", "comment": "Malware payload (Mirai)", "value": "14e4bca782c4d18ce647ee526207258393f2c0a879796dd504cf0ecf8d45dd461fd98a43c13dd25699e573e8f61a4a41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433086, "uuid": "8afacf5a-e131-4c38-a42d-a7504a2b7050", "value": "T17DE3BF97B7475050C8E10BF84BCB5BAC292B21119E6B88F77C2E363A19775CB580B3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433086, "uuid": "4af306d3-664d-4429-bb58-d3c499fd6a7e", "value": "3072:fy8eWABo0777gzgW06WaqaX4vge7NCgXCZvCA+gq:fBeWAu0gf08Wn7RCZvCEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433086, "uuid": "7fe91d78-84e6-4015-91e1-e102c0152338", "value": 157140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433086, "uuid": "0e89b564-9575-46e2-981a-610a837371df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433086, "uuid": "7d2d1958-dc4e-4115-bf36-a17fd72e47b9", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f68f25c-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771445993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445993, "uuid": "30e5b06a-a2f4-4ff4-9020-54475d471fad", "comment": "Malware payload (Mirai)", "value": "af2d67f77cdbf0a2429f7fbc1b8ba71b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445993, "uuid": "3bfa4f0b-a251-4068-a8e0-b87416c89196", "comment": "Malware payload (Mirai)", "value": "06de91cf7c13da8a5920924f307649bc6e5195fe804dda6d324a369e2dfdd018", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445993, "uuid": "7d59884e-3d47-4917-8ba4-85f723cf5671", "comment": "Malware payload (Mirai)", "value": "0695e402b66c1ac9e8e9512864436f7bd3e3a3a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445993, "uuid": "e7ed33f7-5518-45bd-bc97-b0f71d9771b0", "comment": "Malware payload (Mirai)", "value": "75953f7222a69633c1a930d8707c785218b8ace091dfca7e080e8d7fcf64f4c23679b8f7bcb80d73429ab85c35909b99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445993, "uuid": "2c86134c-5467-48f2-bd5d-20dd5c55ffd6", "value": "T1A7D32B41F9405F23C6D512BBFB5E428D372A17A8D2EF720399256F25378796B0E3B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445993, "uuid": "8eebc392-5bab-4753-afa9-23c83342bd09", "value": "3072:omJYZsT7b+fd7Wq84o4e5+nBA1dMi/T5ib:omyybyNP84oB5+BA1dvLob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445993, "uuid": "fa6e953f-249b-401e-8c9d-77e89638ae72", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445993, "uuid": "3c12a5bf-6ad2-40da-b20e-791d8ec93499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445993, "uuid": "fe8452d4-5123-41c7-8f05-1b874df7b270", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc93b4a9-0cd1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771423145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423145, "uuid": "509d433b-bbfc-42ad-bfba-c6b3db9a6f40", "comment": "Malware payload (Mirai)", "value": "de50bbcfb585e5f8c24c328d64695cc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423145, "uuid": "bf832a7c-9bfa-46c1-aed3-4d37a8181a7b", "comment": "Malware payload (Mirai)", "value": "074e3c2812afb7695b269df9c010f7208e50188648e5bf2c0eeb2b7b6ea01c5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423145, "uuid": "c8a6a2eb-5c52-4805-bd59-6030ce67c3fe", "comment": "Malware payload (Mirai)", "value": "44f3fb65bfccad79750f736845300472c0427128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423145, "uuid": "29300355-e479-4a9a-90dc-db8697ccd9a3", "comment": "Malware payload (Mirai)", "value": "2902047432124e205f42fdbd28d0e93d92758125b5e84093fa25fac1c985b03bfe5c77f523ff1f20f53d650275d12f93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423145, "uuid": "6977b03d-deb0-4787-a6e2-84dbb454c7a6", "value": "T15D834A51BD918A12C6D112BBFF6E428D372613E8E2DB7207CD295F54378B92B0E7B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423145, "uuid": "1fbb8072-f295-4e07-ae61-7eee5e900967", "value": "1536:zbjF6HQZ8oSIq9Yz1j3c8QLCvnhoBZBwgpnwPC515Mwnv0pnOh6TkOaq166yuvtG:zbjF6HG8z9i1JGBfsC5sSv0pnVmstMyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423145, "uuid": "16f6fa5a-6900-4abd-bd31-b4f59235d011", "value": 87824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423145, "uuid": "e2fefa6a-3fce-4f57-8baa-d4e282302e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423145, "uuid": "acadfbb1-d357-4111-9d55-1b4d8db3e0c8", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6b427f-0ccb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771420191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420191, "uuid": "901abff1-87d7-41dd-af49-ebb278b6e0b3", "comment": "Malware payload (Mirai)", "value": "61a1d392bb5faaacff70bbfac58192e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420191, "uuid": "e1af4737-6a26-4f2c-ba80-7fe2aeb1f9b8", "comment": "Malware payload (Mirai)", "value": "07aaca5fee5bc2b347ab6d4ea1852aa68fbf4697cae52ae0b5bc12a864cfbb4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420191, "uuid": "35cec21d-e04d-4405-85cb-bbf885701d92", "comment": "Malware payload (Mirai)", "value": "2b548b95f0d7f302bd4e3abead22c2a2a4c6be20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420191, "uuid": "aa65bccb-0727-4674-9a7b-901d7346b24b", "comment": "Malware payload (Mirai)", "value": "a2a591c69712494da71d28cffa84fdfbff964788ea9f16e9cdb41acc6a27ade6be503f436810ddc9114fe572d1f9d210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420191, "uuid": "bbf5375c-5ca9-4fdf-95f1-a1802ede0bab", "value": "T11C833A51BC818A52C6D112BBFF5E428C372663E8E2EB7207DD285F55378B92B0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420191, "uuid": "b2c53d53-1043-41d3-8a93-2f44249a961b", "value": "1536:CyI2J+My+CZ7yRwF1qjUNJoNGBwgpj61PcB5kSdYZr6rtgXyT1OVhvscop66yEWG:CyIAyH7uFjxNKyg57Qr6rtNYoVyEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771420191, "uuid": "44a936ea-b5fb-472f-8106-28cc883373af", "value": 84776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771420191, "uuid": "6695b9a0-5540-4a4d-b873-333c35dc53ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420191, "uuid": "46200a89-8b81-4f35-a1f2-6afda1b45de3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb3bed2-0cce-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771421620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421620, "uuid": "741cb8e6-62da-45e5-abd4-97a74897f261", "comment": "Malware payload (Mirai)", "value": "a14da6a7d1d44b61eff709a73b09d428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421620, "uuid": "b4464dd1-9bc4-4ea8-afa7-c399b2e8bfc9", "comment": "Malware payload (Mirai)", "value": "08140c4dffdf26a3b55badd628c1a17761bdc310627da60afe68ebcc880f6683", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421620, "uuid": "b1a22a16-5df1-4a1b-854e-ed15b1c9031d", "comment": "Malware payload (Mirai)", "value": "d219e1a48cb4f8d7d2306d927e2e18612a6f558a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421620, "uuid": "5c7465cd-e5d1-4c3b-8b2f-61a5bda50238", "comment": "Malware payload (Mirai)", "value": "3157dbae3d488b7e10a9d6b1eff802b6a91f5c8b8f13477a6fb89dd58318cfc406b8d9ab53148f2bd341aeb122d8cac3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421620, "uuid": "ec2dfa46-d387-4261-9353-d4913a3b5dcb", "value": "T129B31A46B9919F12C4D621FAFE9F458933136FF8D7EA3102C8206F54378699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421620, "uuid": "1768baa1-4903-4a97-99c7-6b131fa4cec3", "value": "3072:lBkvhQKG/6Y8K4gxqCaRFEYZbdWltmwcBrEbxyEDWa:IvhQ6K4OqCabEYZbdWrmylJWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771421620, "uuid": "57f4d683-7d2b-4484-afe4-29e701d8375a", "value": 110664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771421620, "uuid": "48d59f91-fd06-4cee-9cdc-568af72b0cbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421620, "uuid": "1efd76f9-5e3a-408f-ae54-6c7c431a62cc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69880208-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771407006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407006, "uuid": "6d36d92c-cf22-4e26-bb4f-5281bb383bff", "comment": "Malware payload (Formbook)", "value": "a577f25139db37567cf68c8c194a975f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407006, "uuid": "2b9aab9d-4e39-4b8a-8223-7b02cf4fca6e", "comment": "Malware payload (Formbook)", "value": "08cd43a806108e96a9f7d7eaebdc3fd28e8bf772e5718463929f241795a99db3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407006, "uuid": "dd773249-a9a2-4e6e-9e62-fa93c58f529c", "comment": "Malware payload (Formbook)", "value": "050f93a85bd97fca8c39a3be7039ca45c3895680", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407006, "uuid": "572be78e-8be0-4ba9-94ce-1b7e72fffe5c", "comment": "Malware payload (Formbook)", "value": "fe5888d27e62f680af697fc8231c2a16aad07e4c9efc4d8d7e7459e8effa36dd748a0a878c078efaaa5a5b16595e153f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407006, "uuid": "b1c89e70-bb41-4262-b3c8-1a85e4801858", "value": "T194652361EC599E9917A4A209A0DF5E5178B01B838E1C70123FCC64DE6F4FA8F51750EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407006, "uuid": "3363cb57-ef6d-442d-b3ed-2108be5915aa", "value": "24576:EsUk+6Jh+P8VKEEevTkErD6/PO1GpnE0r3xsPQjUdgYK8tAKDdYIdNbbZIkjQe:ek+c9ce/iO+3xCNFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407006, "uuid": "6851f8e1-a69a-4446-ac74-4bb261972d77", "value": 1507165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407006, "uuid": "ac85bf39-b20c-4ce8-9ed7-4656520dcafd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407006, "uuid": "c8d388de-3321-424b-919b-7a3b62fa0165", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc77dbc-0c95-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771397296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771397296, "uuid": "a4d88b0b-ad5a-409b-9f57-37bb57d5befc", "comment": "Malware payload (Mirai)", "value": "56e47c048f029179d49c26c0641cc6b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771397296, "uuid": "0b811227-68ee-4ff4-a941-484548b284c4", "comment": "Malware payload (Mirai)", "value": "09f9f17a3e1047ca52a1e497bc3088da72976f81258d3cbdb35cc6ba32cc0aad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771397296, "uuid": "293c9a09-27d3-48ce-ad3f-aab2ebc9821a", "comment": "Malware payload (Mirai)", "value": "71852eabaf9dbbd733905f148f9de243f191e39d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771397296, "uuid": "fcedbf8e-1335-4d56-8e2d-96f33862f59c", "comment": "Malware payload (Mirai)", "value": "7c662fd18ed5ddba974fe771bc939dd45289c298a55ac77457b912c63988c498ade1f1786be196bbefaf0fda02bc897f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771397296, "uuid": "89909427-8ca6-43dc-83ec-12c74000d472", "value": "T1F5F30946B8819F55D5D216BAFF0E128E33231B7CE3DE73129D245B307B8A86B0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771397296, "uuid": "f2f2f545-1ee1-4ac7-8473-1d93836df4a2", "value": "3072:rNXkt38yPZgNUaTN0UfY+amcLaJ6mxhcNPnYisJCxUlKo:rNI30xiUfjamWaJVc5xSCxcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771397296, "uuid": "a9016128-ac7c-4d3d-964f-aecf61985363", "value": 160060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771397296, "uuid": "90c3959f-ee4b-437c-bf3f-908551c9ee1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771397296, "uuid": "211c1fc0-a872-414e-bba8-08bf4c40a686", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470a24e6-0caa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406090, "uuid": "f63f35f4-669e-4590-8907-ccdc0d524ce6", "comment": "Malware payload", "value": "ad3af01f5b92c5f789a05c245992f052", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406090, "uuid": "0dec285e-a2d7-470f-ab09-9831a9c47fe8", "comment": "Malware payload", "value": "0ab8c295c929dca7dedb2e8e351251d5917319277ecd06e2103fdeec45f27377", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406090, "uuid": "749bdb6a-9446-4697-9f97-925ea06d99e4", "comment": "Malware payload", "value": "fed3e79deffa4828b2cc9d554a6db4f3a90222d2", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406090, "uuid": "d7325ff9-2228-433b-b11d-07a627499021", "comment": "Malware payload", "value": "5fefaa80a10d34baa25e0da227fcd9ed37edb6674263e513ff82322e2a03da252627d947b3e07a7a5442487ef66fda1f", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406090, "uuid": "14b29de0-2af1-4e87-9603-63057d8dabab", "value": "T18141902D06BEF84886D9E303D695F7136D472CAFC268B41B2AB68CAD96029C145CE5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406090, "uuid": "cdfe6913-1860-4216-b91d-469a66c8da65", "value": "48:XMom95HGfAeBHs9joKZcCvcCaAncCD0BYcCDYFGmpcCW59rcCmFGm3cCmZ4i0UFG:X5IHuACHs9joaBaQgBC+GuW59l0GwC4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406090, "uuid": "805bfa04-cccd-4998-ac63-638f86cd0519", "value": 2226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406090, "uuid": "c495a8ba-7ca1-4027-a92c-4c276984a630", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406090, "uuid": "0b303dea-9b41-460a-a270-f9515ed19d48", "value": "0ab8c295c929dca7dedb2e8e351251d5917319277ecd06e2103fdeec45f27377.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f038f62f-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441163, "uuid": "12570860-679c-410f-b7aa-81b658ff04f6", "comment": "Malware payload (Mirai)", "value": "0a278c9c4ceb0d6c193e4b3d359e8675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441163, "uuid": "fd8754a5-3b33-4fe7-a417-e8c7f112e2fb", "comment": "Malware payload (Mirai)", "value": "0b341a47cc620d68327b831ae6e2c276a37ef618a1f237146e3b2c251d329112", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441163, "uuid": "e9ea3063-1395-449b-b42f-57a11b352e52", "comment": "Malware payload (Mirai)", "value": "6293ca4e2fcd527c3542a2c7dc558d13117846f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441163, "uuid": "e2e9f71c-c4ae-45de-bd5c-fae96ae9ff1c", "comment": "Malware payload (Mirai)", "value": "f40017784df58b0ed443831d1a6fc02864fd1deca1adcedaf2ea30c1d2ea94e4914be3b928aed75d126b83fdccc5b4cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441163, "uuid": "853318e2-3e25-4f1c-b551-297a0522f2be", "value": "T132A5334C024F13CBCD3526A5051DB19AA21DA1F579321EBE03A9DE8ED53EB8C335A379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441163, "uuid": "c564cd39-50ae-45e8-817c-2e08d3f7ac9d", "value": "49152:wHglXUmrj4aY2Lc+q6CYfeIC8LV1GbEnfwxB6z58BBZ:wAFUmrjLY2Lnq6J1LV1yEk6GBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441163, "uuid": "7b5973f2-d50d-4a35-a4e2-8e61a5932706", "value": 2172316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441163, "uuid": "95359f70-f71c-4d1f-aa27-d52c376b959d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441163, "uuid": "73906d1c-6666-4e53-86ef-be02cadda4a5", "value": "ttmswapd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614438e0-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771406993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406993, "uuid": "ac7a8e05-ef00-42df-a980-3970209bf2a2", "comment": "Malware payload (AgentTesla)", "value": "c94cc41545dce9f9ea3ec43a25185464", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406993, "uuid": "d798be67-0518-4edf-bbc6-4d8d0a142dc1", "comment": "Malware payload (AgentTesla)", "value": "0b4471dc043865dbd7ff1da316fa3c6f771fbe0b2488aa47ae63cdd5b68d8750", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406993, "uuid": "3c516289-492c-4c09-9eb5-c1e32dbd5ba4", "comment": "Malware payload (AgentTesla)", "value": "dc5d452e280081e2b03a1b25338840f1378bf7d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406993, "uuid": "59324c1b-e959-4a21-8a6b-9d9ea3c7fc99", "comment": "Malware payload (AgentTesla)", "value": "eedf2c67b7c8a87b697f7512bf91401ac76e9cdf19c7d3a828b5ebcf1815dd909b272f895178c0b7071510f22113d5f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406993, "uuid": "9552515e-e58b-4631-971f-8d1c9af895f6", "value": "T1322523A0FD285EB1065C8359204E5E0845A287DB8C25BB593FACB4DC0F9EBAF60355DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406993, "uuid": "0bb13902-5a98-40ec-95a7-c9177ecd36d5", "value": "24576:LbUUDxsezNAuv7AZOduC07Z34qRNzRO0Ixymu1Q:Bs31IuCmozHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406993, "uuid": "81c9df01-acfc-43fb-9890-63c6d03fa147", "value": 1050633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406993, "uuid": "dc76ee5e-832f-406b-9bb1-279217838c64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406993, "uuid": "225e5ff5-64c8-4ce6-a021-be18ce3a4890", "value": "ENChRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5537d1d4-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771406543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406543, "uuid": "ac089751-3c1d-45e8-83ab-789bfef8f762", "comment": "Malware payload (Formbook)", "value": "d42349c892f20d79b71315641cb618b9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406543, "uuid": "f4c72575-9634-45b9-a0e7-6284ba32e13f", "comment": "Malware payload (Formbook)", "value": "0bfc0975675d67c0ba8f206435340bbb3af907b74b2b4938469f6b91511cbafc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406543, "uuid": "f61168d1-8133-4199-9ded-96fdd45fe3fd", "comment": "Malware payload (Formbook)", "value": "9624ed4208d626e16b9d380f873dd0e9131a0358", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406543, "uuid": "d2a3f99f-7839-4807-87dd-5750a9c77e84", "comment": "Malware payload (Formbook)", "value": "6721b2432526d8ed724d4c6fc3c367e6028d33395d20326538c827d6e557312fd10fe92d84601801ef6dfb8ede08dc7e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406543, "uuid": "ff0e89af-9dd3-43f1-a660-642d679f39c3", "value": "T12545F5E2530B0546F6810E5D557402E69C504E7773932CACBE5E87FFAAEEB0CDB21286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406543, "uuid": "be83ca0a-50c4-41ce-863b-dba9259f1d13", "value": "384:hilTFyqmANgExa0tU3Qgcqj0ac8iKBU5tSy2qvMVIpH0NX5yBY89Ku4lp:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406543, "uuid": "9a661733-c841-40a3-8863-43be1f8e44dd", "value": 1196610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406543, "uuid": "5943fb44-4dba-4e7c-aa02-18ac86f456ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406543, "uuid": "411d2058-1003-489e-94c3-8f5a7f6b3504", "value": "OC QRO-1674.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f46ab22-0caa-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771406238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406238, "uuid": "89070f04-237a-4b33-87ae-d432ce5083d4", "comment": "Malware payload (Vidar)", "value": "7bddc8c45b68375ffaa7c676ff54ce77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406238, "uuid": "8e8399ed-15f8-4d6c-98b9-c60670801df7", "comment": "Malware payload (Vidar)", "value": "0c2a26f60397fe93017cb3c4ff858617e7fabf75a9a5f3ef6824e32ce4d8ceee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406238, "uuid": "a680c276-9f04-4ccf-9603-ef63ea8393c9", "comment": "Malware payload (Vidar)", "value": "502c923d80858147cc467c798fda939e7dd45a5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406238, "uuid": "217ce29b-2a3b-4dcc-afc5-f0cac97b9f2d", "comment": "Malware payload (Vidar)", "value": "6f3c3278f0a471a9c80ede10893be73f775085489c021a692e7fc84078e859166342ab34540ca677fe93d27cb66ae99d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406238, "uuid": "adfb4fdf-77d9-4543-aa1b-5eafa8d36dc9", "value": "T1CD064B12F89969E6DABEF13494A152103631386543323FD35A9CE57B4E77BC82B3E708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406238, "uuid": "20e54176-577d-42be-a1ee-b59ece9827ed", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406238, "uuid": "7c9ba35a-b5d3-49d8-96ce-a62bffa64730", "value": "49152:ci8A3jjcQqIO0H4QYlOJIz9mVviKHegHCxdRJl6nQLAr7hX4htNNDdFswNfhQMKi:RT3joj2e2VIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406238, "uuid": "e27ca552-5c2c-48b7-b198-8110fcb8b2d1", "value": 3699200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406238, "uuid": "b88861ba-5fe7-4737-9bc0-d42ccc765c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406238, "uuid": "04c51c7a-da84-4b08-bf8a-ef5953a9f752", "value": "0c2a26f60397fe93017cb3c4ff858617e7fabf75a9a5f3ef6824e32ce4d8ceee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ede08c6-0cf8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439496, "uuid": "3ef4db85-d2eb-4f9b-b539-dbed292a8729", "comment": "Malware payload (Mirai)", "value": "77012a9e7b08333d0064e98c191518c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439496, "uuid": "31aa91ce-b77e-4aaf-b6cc-8894725b4e8f", "comment": "Malware payload (Mirai)", "value": "0c4f1081e01db76c0906a952a756b4ccf9531d7cd95168b83eb4049dbb6b3ba3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439496, "uuid": "794d5dcb-75ad-4a45-9e41-499b4a7baf49", "comment": "Malware payload (Mirai)", "value": "e62772c774fb20ccc50de7099aac3ad0d0c97341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439496, "uuid": "b611a9a2-7551-4c39-90ab-a5323c1f24bc", "comment": "Malware payload (Mirai)", "value": "8b18923a7dd9c82c102735ea324ee1881e2a461f09eefee1f154051cbcf7ca76dc0e89b0004de0c2569e0945a6939c6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439496, "uuid": "c8179fdc-748c-4b7c-ab6e-a26e3adf120f", "value": "T15F837DC5EAC3C8F5ED2209351272BB275AB2D03E2268EA83C3A5D975EC125C0F557B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439496, "uuid": "d6bb8a0b-71bb-49e1-a2c3-56bf47a1b41a", "value": "1536:RWOLMM5Md27oLQyLijia3tAjw19KHVdxYQ5rBn:PLxMdOGLAigti+9IYQ9Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439496, "uuid": "a5f20be8-623f-4a5a-8008-f35f4109119c", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439496, "uuid": "363142b3-e598-4606-90aa-0da79c84eb6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439496, "uuid": "475e365e-89a3-47a6-8a96-c05e14c1d234", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9547e5da-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771423401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423401, "uuid": "a6db2d2e-1242-49aa-a4d0-e63db7d65a62", "comment": "Malware payload (QuasarRAT)", "value": "feaaf63829fb0c12d3eabf13b3c51ebb", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423401, "uuid": "3fa8c6d5-1b86-46e2-8d5e-edf1d675d2ef", "comment": "Malware payload (QuasarRAT)", "value": "0c941d7724568bfda9c9cd6fb0988536448921a66878d89f05843d43786eb9b9", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423401, "uuid": "c40526fe-5929-49bd-a6b4-2652cc29d0d8", "comment": "Malware payload (QuasarRAT)", "value": "4b49e45f12018bae929b0c66588e332462826cbf", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423401, "uuid": "c86cdcaf-999c-4f10-9ec1-4b685379b076", "comment": "Malware payload (QuasarRAT)", "value": "be482a9d3566914d953d3a6deec0ff937b0abc7629f004859d9c25b5508843ab54e0e631bc09e2f68ade7f813cdd27a0", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423401, "uuid": "e5d80b4f-6248-4176-a970-567effff4848", "value": "T15DE5491437F85E26E26BD3B3D5F1501363F0E86AF363EB1B6181677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423401, "uuid": "ffeeaed2-9b83-432a-9824-01b0effc46e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423401, "uuid": "f2a7b8ec-644b-442e-b1fd-dbcc2f6e76aa", "value": "49152:avnI22SsaNYfdPBldt698dBcjH30f1JzLoGdh2KTHHB72eh2NT:avI22SsaNYfdPBldt6+dBcjH30/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423401, "uuid": "151c8edb-2d9e-44d8-a675-88757a13cd2f", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423401, "uuid": "06ffd5f5-5265-4775-8082-9e516c498007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423401, "uuid": "3551cd3e-dedb-4850-af3d-78bfb4a74a17", "value": "0c941d7724568bfda9c9cd6fb0988536448921a66878d89f05843d43786eb9b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c84d70-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402215, "uuid": "22a285e5-1736-4911-a3de-9c3cc6d337b7", "comment": "Malware payload (Mirai)", "value": "f531243a3e500283c11d08fd0e35ba8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402215, "uuid": "d0806c9f-4a86-482d-8259-f12e35597ea1", "comment": "Malware payload (Mirai)", "value": "0ca32f4de6c7ffff7908e5f2d68408738bb1e1b9d2e65175fa269e3abe414a45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402215, "uuid": "d6650328-6d00-4ff7-8bb4-dc3388cece0f", "comment": "Malware payload (Mirai)", "value": "1c30bd4c5f446597f759f043225c49f947e7e7de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402215, "uuid": "9cc48939-c484-46e7-9cff-8b8bc3c3e8b3", "comment": "Malware payload (Mirai)", "value": "50f4341f4e86055b79c691491ef5eb846c746234aa7fb485898c400773afb6c42bb228d7e7626f5967ec6ebb0171bb24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402215, "uuid": "3aa8fc99-d3c5-428b-9094-9c9c575384ec", "value": "T15A333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402215, "uuid": "e7c4f3fa-787d-4e73-a29d-55e30b5c3f59", "value": "768:lw5A3X1eCZWUJ2SNpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98oN+s:lwkt3NpOzwLMU431ANA0BLBCMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402215, "uuid": "f0333413-d93b-4f50-94a3-c4d0b5862057", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402215, "uuid": "b7374ec8-8d4b-4dfa-956d-37d12f8fe81f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402215, "uuid": "3a903125-ee82-4e12-b8d5-1b2a8508b408", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c89734-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771423393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423393, "uuid": "3c910fdd-c15d-4eb8-b2df-5a2588fc2359", "comment": "Malware payload (AsyncRAT)", "value": "aefaa71a5430aa9e41c227315f3db977", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423393, "uuid": "930ac3dd-7397-4782-96f9-c7981b8eb3f6", "comment": "Malware payload (AsyncRAT)", "value": "0ca4bc3c6b18e0565b056cb644750860a7b26b4a172837155aaca1d45934d9e5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423393, "uuid": "87ce8538-b651-4f09-ade8-8b90c44924e8", "comment": "Malware payload (AsyncRAT)", "value": "53504f876f9275331d9063cf0d11c80d1f9ec90f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423393, "uuid": "36fb3bca-e1e6-49b0-a7a9-07156e665f44", "comment": "Malware payload (AsyncRAT)", "value": "c377ced7e0b9ed9c7568efc1e3891b3045bcdabae39eb6258f4a4dc3be9ef7f4cc2203b57599752276cc2f4c4938460e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423393, "uuid": "e42af7e6-5193-474a-870a-6b7778596b82", "value": "T131F4BE2613E86AA8F5BF9B3C5779441447F1F816C736DB2E7E59809C1832F82DA52323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423393, "uuid": "d0f6863b-ef33-43a0-a182-034b2e34687e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423393, "uuid": "ff160051-6728-4b5f-a9b2-65231459f74c", "value": "12288:ZFoHzjsmOpdnleO5RrGpv/ffL6cEwT8UTBU4Zmfn2daB/Dc:ZFo3st1d5R43L6c/rDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423393, "uuid": "44345c76-ab27-42c6-ad54-e7a9b2cfca97", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423393, "uuid": "c51d0002-729a-4489-ba87-0e1783534f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423393, "uuid": "1980275f-19bd-41c6-8e36-0b4d42ad4bce", "value": "0ca4bc3c6b18e0565b056cb644750860a7b26b4a172837155aaca1d45934d9e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5449b9-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402290, "uuid": "c8cce9e2-ebcf-49a4-b601-8314c7c967b3", "comment": "Malware payload (Mirai)", "value": "f7bb9b66f3fc0775a83e6779317961f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402290, "uuid": "05baeb1f-4522-4e8c-91a8-cac1abdc83eb", "comment": "Malware payload (Mirai)", "value": "0d22eb0b9e583df18d6a349da9a9dfee60b5a74ccab3270b149994bd35e646c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402290, "uuid": "21a52d79-93f6-46d0-b1aa-ce59fadefae9", "comment": "Malware payload (Mirai)", "value": "18d5346666f0e4691a47660d79fa9cab601e22bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402290, "uuid": "b7fa6d4e-07e2-4de1-92be-a6d7e94d5dbc", "comment": "Malware payload (Mirai)", "value": "0b87f4ff8fdaca5f3f6a18bd1f26b9e92299e783e06410831bbd6d7afef6ca395fdf72105604f1fbc81173d0b5a4025c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402290, "uuid": "f5607eef-0988-4e07-8343-ac510d66fd85", "value": "T1418329C1BA8BC4F6D80748304067F33FCB32E5394066D75DEF6A9E26DA376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402290, "uuid": "23204a6b-2dee-4de0-a90d-fc15e5326e53", "value": "1536:xp8qEknpXLVUkvFtW4yoWpawsK2I3cK6WyDElI9T:hEkp7VUSFt6IXKb3X6/7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402290, "uuid": "f073dcac-ae94-4261-8fb1-01b921d612b7", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402290, "uuid": "8b2f5d06-e31f-460c-a207-31b82b22706f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402290, "uuid": "11dafb0f-b1d9-4b02-a792-75f646bb2776", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328df9c7-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771445998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445998, "uuid": "afe6f2cd-1c85-4da5-bef4-e8eab52e75af", "comment": "Malware payload (Mirai)", "value": "4f7a7e357a07ce9216f51e6f3e17d264", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445998, "uuid": "858143d6-8845-42b4-ae26-821099b4b9d5", "comment": "Malware payload (Mirai)", "value": "0d8a088f97ba3f095ef8f5d53f6d614846e97dd8caae3145c96e43b387192e08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445998, "uuid": "9dde22fc-3f38-4177-9b85-efa99c32786d", "comment": "Malware payload (Mirai)", "value": "57fb9c7898f3c3cf8025ebad425b78c74aea0b4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445998, "uuid": "d24f937e-5d20-4e1a-be17-1c2c76dc737a", "comment": "Malware payload (Mirai)", "value": "f726147885abf888220a16c64ef5275a96a5060a24946c84de71109a5d4b05f3d99e183d6b54276bcc70ff8e56b86f4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445998, "uuid": "59663779-a162-40b9-a987-bcb9ed573b4e", "value": "T146042B46EA404B13C0D627BAFADF42453323AB5497EB73059528AFB43F8679E4F13605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445998, "uuid": "f50b6669-7b5a-42e4-bd4d-f3c66e45f95b", "value": "3072:cZ3j2JNrdwZsctacyL8l5y1TAehLLxE3RDrRoNM/RSj0LYJuy:cVjordwPtacyL8l5yxLLxE3JiNM/RSjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445998, "uuid": "4c704d88-ec06-4d7f-b71a-d6016dadc0af", "value": 188102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445998, "uuid": "d0082a75-5f76-4509-9bee-79da34530407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445998, "uuid": "2b512128-1716-4580-9bc3-1cd083c7bb84", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d02b79-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771406562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406562, "uuid": "4e954eb5-8b8d-4c38-ba7c-45a59c277e3c", "comment": "Malware payload (AgentTesla)", "value": "ce11aeb087a295dd83882baf52767fae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406562, "uuid": "a63bfa52-7414-4d24-9a0a-790e996cf42c", "comment": "Malware payload (AgentTesla)", "value": "0dca74862181dccfaf9eb1703b2730cf2e05572a2e5c75c4123380a059e957c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406562, "uuid": "cc5d402f-5c9f-4efe-9f57-b1f208759a14", "comment": "Malware payload (AgentTesla)", "value": "683b63e41f12319e7a3b470fbf73c1fa3fed027c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406562, "uuid": "ef7dd856-e069-4028-9a6b-0b8e6e11e712", "comment": "Malware payload (AgentTesla)", "value": "d1233c577642b4c7a1a15f6726d50037a44cdd9e68b482e759bf69e266ed088738268e8b914c9c004ab37d9d80aa5dff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406562, "uuid": "d903e5e1-3241-4093-a884-56e86be96ba9", "value": "T13033A5CA37D1B0FC0A6638B7391F61B6B2AE9E40608CD016DA578D787C6372DDC76924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406562, "uuid": "80428fc9-b032-4298-8d46-6d0f54472a96", "value": "1536:3ydpilyiqcqo4yxTusrToX9DdXftpZnKc5HohlabIMW7:CqyaqotcsQ52jSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406562, "uuid": "9a222078-ec0c-4728-bde3-3842efa135fd", "value": 51382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406562, "uuid": "58581e44-bf05-4b0c-b5ce-097df13c2d90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406562, "uuid": "66acae05-59ef-471d-a221-5ee7287e79dc", "value": "ce11aeb087a295dd83882baf52767fae.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349f4475-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402193, "uuid": "e3f0e089-6763-458f-a258-ac2fb265f118", "comment": "Malware payload (Mirai)", "value": "06a1a36277ea24568cc884c951fa25b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402193, "uuid": "bce942b6-ccbb-41b3-a4f5-e53ddab4e5dc", "comment": "Malware payload (Mirai)", "value": "0ec741d6983591966f97a23ccd937c22cd6060b8066b42e5c253b8a1ada491e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402193, "uuid": "4c86c73a-5c6f-47ee-822b-687de4d4e9b8", "comment": "Malware payload (Mirai)", "value": "12cf81e81c44aa5dfdbf7a28dd1e6dede7cdf74f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402193, "uuid": "ce3b3660-872a-4247-b84c-23de2e48f448", "comment": "Malware payload (Mirai)", "value": "f874ff23bfa5c3e8dc9a8402e99525585c29f8469626f82b8fceb316157ccaeadcc34d66bfc55367fe61a81881be27de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402193, "uuid": "046acdd7-e1ee-441a-bcfd-fdac0481fbe5", "value": "T16C13F1165450E6BDC14187B8FC211C8456C86EFCE79D72BB3B8608C8B2E9F9F576448B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402193, "uuid": "766e36bf-0532-4a42-b2fd-a68c95493d13", "value": "768:o/OD/X/aerkOycTDZyXBLZ5HpMvzsfrmNqRm1ffI6KEB2GHsxtNbR4A9q3UELfF:6OjSGkO0RwzemMRyPK6RHKrR+Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402193, "uuid": "2aa0f4dd-605c-4e6c-9ced-233c2bdf49ed", "value": 43752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402193, "uuid": "eeb6e486-137c-4011-8f44-33790f4aa2a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402193, "uuid": "d87d7c7c-5c33-43e9-ae09-77115917dd32", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7cf91c-0c91-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771395338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395338, "uuid": "ab98c304-76f8-467a-b72c-d0c18ea53b76", "comment": "Malware payload", "value": "ed712c1c3f5d33117e791f98ec1ae553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395338, "uuid": "0768e886-c112-4329-8f2c-200b8be5533c", "comment": "Malware payload", "value": "0f15691e07584466eb93e481af1aa6f1c1da30c8f6e0aea1f84b7e519c06dba8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395338, "uuid": "750a20e2-2328-4257-a111-656a81252a56", "comment": "Malware payload", "value": "83cbb9276b8254ce1c3303befad5e1b8e5c6df2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395338, "uuid": "bfb905df-209d-499d-bcba-34c5f2f111de", "comment": "Malware payload", "value": "4ca9aab18b3760e29f6c1bf69240e7b89a55dbe46ac3d7b4339fbb90ad4fea3ff560f0b08d1301e1eb3a591146388a29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395338, "uuid": "6e69ef56-1ae4-4ce4-adb6-3daa2ce1645d", "value": "T14E04F100FB580473E0C25EB44E3B1772973D499204B5E62C6A06FB6A1D63A37978BBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395338, "uuid": "6aef2a38-9ddb-4c43-935a-8dd5ff9d49cc", "value": "3072:ozdurayQy5HEcMf3oW3ybv6YJLPK6AeIGfGvXZojCv0enfwl71iXEiyP8wpml:ozdurafekcMwW3ybv6aAQ+pGY0eno5UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395338, "uuid": "e929a36b-b1c7-4277-be00-a05fa245ecf9", "value": 186166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395338, "uuid": "f0455d18-0b39-4361-8838-8a11480f06a0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395338, "uuid": "f7c2d40c-7b87-4cc8-9c3e-caef957a10ec", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d684715-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441212, "uuid": "1506675a-c444-41ac-9606-89408b9c893e", "comment": "Malware payload (Mirai)", "value": "bdd3578f3a80776d465bebe19ff141b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441212, "uuid": "7497d774-8ee3-47d8-b8e6-f046d71757e9", "comment": "Malware payload (Mirai)", "value": "0f4d5b020aa5bf686f1cfa11bbb7e68deccabbaf9a5ea1dd1f5ea5fce30c4173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441212, "uuid": "3e897246-aefc-40c1-95eb-ebf87f5a22ee", "comment": "Malware payload (Mirai)", "value": "0020542232e76b1e4b7eab02f8f24b41d0a94e05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441212, "uuid": "a1264e56-c693-42ec-a9ed-eeea2c0c3ebe", "comment": "Malware payload (Mirai)", "value": "a0c1a930a64ec66a3f7fb46cf9c0138828cf5f9750f9b935cd9f065fc2172aebe08dd0018acb74543189d73659ad8d0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441212, "uuid": "64cd3ba5-fa5f-4a4b-b532-05a7d9d04a63", "value": "T182142A83B905DEF7F40EE77204D30721B232FB654A531A72B21B7979AA3A2C47426F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441212, "uuid": "a9c9306a-8170-4e1d-bd50-bca2f66610fd", "value": "6144:x7Leyf+HpUKfVIvPDL8cQDNyWmm6CQp6F832/mlHyBA:x7qVpcYvmm6CQp6F832/mlHyBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441212, "uuid": "afabe15b-3d1e-4144-8ffc-d3963c21bec3", "value": 201833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441212, "uuid": "4cdc9e25-7661-4981-a50c-478229ced578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441212, "uuid": "d3249349-f768-44b6-8b8d-d5f674a47fad", "value": "mynode.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd0d9f2-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402212, "uuid": "bcb5c567-7448-4290-a309-d4700565dac1", "comment": "Malware payload (Mirai)", "value": "3376a94c2bf552c391ec5c3f61f828ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402212, "uuid": "cfdf7098-66c8-4807-b899-bc8b02c77f6b", "comment": "Malware payload (Mirai)", "value": "0f5ad08e9c2b029898dc2106c9b84e7bede41df4f1d7b63e1dd78755170ece27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402212, "uuid": "de4f74d3-731c-4df3-a213-087630f2d2ab", "comment": "Malware payload (Mirai)", "value": "2fdb09a40b59305924bb7d9f6cc8a8ca84013a1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402212, "uuid": "dc400223-08c2-410c-97c3-cafba7c48a2d", "comment": "Malware payload (Mirai)", "value": "1036764498e78a21470775f1611b5a2783fa76ce22e28bf9e1661c046a735cdadd2b1183be734134f3a0b6fdf7731013", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402212, "uuid": "73cdf982-cc12-48b9-a14f-a855e442ee13", "value": "T180B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402212, "uuid": "30bab34b-6ac7-45f7-bcbe-346701177d04", "value": "1536:57jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxk:1zPqF41OUBljSIxecUtCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402212, "uuid": "d9da3a3b-27df-4af1-a4f3-61a909dd2ff6", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402212, "uuid": "afcf7b99-339b-4427-81d0-67dfc8eda94f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402212, "uuid": "c050949d-7e6f-4c70-aa93-51b26093889b", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dd2cff-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771406571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406571, "uuid": "c912da20-79fd-467f-9bb6-42ebf54497e6", "comment": "Malware payload (Formbook)", "value": "ff32494d77f77e45b17bef9b9bab1e99", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406571, "uuid": "47122922-563c-41fe-9eab-c1add1907418", "comment": "Malware payload (Formbook)", "value": "0f7596a80c16e022ffdbf5c044d3c8d216aaddcccaebc7319aa1af554a4c9556", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406571, "uuid": "30580183-e1e1-4a08-bd7f-43fc0f75c5fd", "comment": "Malware payload (Formbook)", "value": "cbaf335ce632faf15ac38d146dab190151d0af1d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406571, "uuid": "7dd0f6e0-5425-4b80-9db4-2fc09576f347", "comment": "Malware payload (Formbook)", "value": "fef1ac4c674db084a8e21406b9405d5fb263302c58e5c6be3117b87f768dbb048be3fce78846f45bc1372f7037aacf49", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406571, "uuid": "3367b729-5c27-49db-8b80-4262fd73d6ba", "value": "T10B35124C7C6481A5054E61486563CED5FF32F1AEBECAC52AD44F6AF22E2D50C732AC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406571, "uuid": "d8f48e06-943a-48c5-a202-c4cb5bcf0f40", "value": "12:+V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0V0y:heuo6zYLbzAeTlQhYy7aBiwJpc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406571, "uuid": "be3a7018-3154-4148-8a9d-5633d62ed121", "value": 1083074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406571, "uuid": "f07ce9eb-571b-42e3-ae34-6e70d571b69f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406571, "uuid": "50ff3b4e-eac6-4964-8681-c574fbe35283", "value": "Recibo de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7915d424-0cce-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771421635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421635, "uuid": "26cff7ab-46c8-461d-bed2-3f320f55774e", "comment": "Malware payload (Mirai)", "value": "084be7657aae27cc6c40e3ad3e8b35c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421635, "uuid": "f50e6424-3dcd-450a-8099-584aacd9dda0", "comment": "Malware payload (Mirai)", "value": "0ff29a840946c413333e498da27af1542df446867dce1601a9b7854a81b730fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421635, "uuid": "7f0194d2-34b7-4fe1-9e34-aaa067dde8e2", "comment": "Malware payload (Mirai)", "value": "6d9e853168cae9b734e02100e2abf6f65fd6040b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421635, "uuid": "7e3de892-b400-42a0-94ba-eebe8da91158", "comment": "Malware payload (Mirai)", "value": "1e5487c706b1f13efe51b9e2614f583cace6e27d9f015034d850fe76ad818a6f1e7694eeba0ec6eeb5f0317e221dec08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421635, "uuid": "32c663f7-49ad-40f2-a40a-d4172c3850be", "value": "T101134AC1A643C1F2EC5212F5147B67628F76E4365A7DFA92EBA92531FC03B10960B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421635, "uuid": "15882f2d-b846-44e0-a7b6-0deb4f520480", "value": "768:QQaiSup66OkEgy5oD5YQuj4JYUTeU4wQOngspVI/4bOGd7nX:QQaiSuptOkEX6D5YQ/JYUeUDtgspDbOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771421635, "uuid": "f42332a9-1c91-4bc4-b88a-25bf89db0336", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771421635, "uuid": "4a454d35-24ab-45ff-9655-8c789a5905d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421635, "uuid": "607273ff-7db3-43fc-b53b-29d515be572c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f0ef08-0cf8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439483, "uuid": "99d7ce04-8b1c-47a7-b74a-3e98f1e6dfa1", "comment": "Malware payload (Mirai)", "value": "8d84b47d9593c97b4736e27b48899a05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439483, "uuid": "51e3922d-8af8-439c-a246-583575d07715", "comment": "Malware payload (Mirai)", "value": "10510d1fd3ff4e050340fa0d620f7ef0b3b232203a0edd5afac7a1aa55d244d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439483, "uuid": "814f2d9a-b9ee-4730-99e9-41392c5db4c2", "comment": "Malware payload (Mirai)", "value": "6df40ef8942f6b64349615a96490bf34255a3eaa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439483, "uuid": "accbdb19-574a-483b-8943-61b0a6846b04", "comment": "Malware payload (Mirai)", "value": "56130982738067a32a1c756dbda3281920b709edf1d9203e843477235f985d41f47ed0f13949b168511b958f8c94dab6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439483, "uuid": "caeb8511-9e0c-4112-ab4d-98cc22209775", "value": "T1F451D9CE12C587B15E6E4967B365E48A7C9DD4992087DF36CEE834E3044DD08205D7FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439483, "uuid": "c7439f17-1ad2-4485-8448-2fca4f5c4869", "value": "48:isFfsy9sjrsqoYs05sYJsbTbLshvsIlLsthJsydsW1svrsfbsK7W:io9KpnrAYvL6Fba8tW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439483, "uuid": "c31b8ce3-7dcc-42a0-857a-2adefe5bdb90", "value": 3164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439483, "uuid": "b84a9d34-ba73-4a74-8bbf-3ac991c4fdb2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439483, "uuid": "84e4dd73-a443-4b63-ba0c-5bb6a9881a6f", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c65ac1e-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423386, "uuid": "638644c9-419e-493b-a9ae-e9ee60c47dce", "comment": "Malware payload (DarkTortilla)", "value": "5d15a79360caef2c0569206c996c2471", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423386, "uuid": "bcbb19bd-78e2-4121-a9f7-7c5f685a5e28", "comment": "Malware payload (DarkTortilla)", "value": "108946b80b1c34558113dfefab2cd25e8826ef2070355e4bf8af4b77d1d1769c", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423386, "uuid": "e3c2d1f7-9c1d-42e1-b913-f148ee6391dc", "comment": "Malware payload (DarkTortilla)", "value": "aa028b85702a3d10f41f4a20027c7dae93f72ad1", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423386, "uuid": "f9fe3303-ca49-4cd6-8c9b-318b965bf930", "comment": "Malware payload (DarkTortilla)", "value": "0eb0b3fe14e638af9c5e5690f3353717cb90e6305d952b3d2e3a7c83a4987910501b0232aecff3bf3b5013852dd213f7", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423386, "uuid": "341919fc-c1a0-4229-98e1-f4423d5766d2", "value": "T18045019A17C45AB0E4FE8F78A6B8045947F4F61F8621E76F2D4802FDDA10B8596133B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423386, "uuid": "77d33906-d2ac-4089-9de4-c0c608b09333", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423386, "uuid": "c9dbe40f-b2a4-42a1-89b5-21bfd5fa1b2e", "value": "24576:ihGPL0gEcyEBEuec4UuBjCnRveYepqMKDmfC4KOSSn206hYK+:ih07WTuec4UuERveYkqM3fC41p2xYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423386, "uuid": "c8b1ac62-d6aa-4e0b-81f7-59fbea22f10f", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423386, "uuid": "bdef1bae-0ae3-4fd5-963b-79272287cd9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423386, "uuid": "9404f673-7afb-496d-855f-ee2e14ffb853", "value": "108946b80b1c34558113dfefab2cd25e8826ef2070355e4bf8af4b77d1d1769c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037e0d93-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441195, "uuid": "7df32b1c-10b9-415a-9967-d5a9fed11b85", "comment": "Malware payload (Mirai)", "value": "506d6bf11dedc5922c91c18a9e281d5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441195, "uuid": "ab272da5-1c1e-4a31-b365-a90dda7e06b0", "comment": "Malware payload (Mirai)", "value": "10d01c6f44d76e5d3cfac5a2690040ad4a6e848032b854c483bb0ffe360ff039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441195, "uuid": "6d397908-2873-47a3-aea2-702a3c7aedb1", "comment": "Malware payload (Mirai)", "value": "46de53e410f1ae21756c72331a8d9e6fd4067837", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441195, "uuid": "14577c9a-f88f-47a4-9b53-87a7382a9c23", "comment": "Malware payload (Mirai)", "value": "12471892bc30b143b5a5d0b608163cfb8a5f62342cd55dc09ef9f3ec97fa74cdc6f8334a7d36a82313f0bc815d52d7c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441195, "uuid": "5451e220-c9a4-44f2-aa12-4edac638e62b", "value": "T18EF33913A9665F97C596AFF522F38A750753E8151F030F6AB62AE9F80603DCCF809364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441195, "uuid": "9fca4bd6-4154-425a-ab15-005ec986974b", "value": "3072:nvbNwfhL2BJvGLTJYVVhW3yTSd+OmGCp+Sqm+QJQe6FR+2j4lHfBk:nvbNuL2BJvYKs3rdFqhqm+QJQe6FR+2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441195, "uuid": "eb59df53-a49f-4531-b0f2-4ad27c3fc43a", "value": 161981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441195, "uuid": "487d494a-8a45-45ee-8162-c40b44912dc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441195, "uuid": "8c298090-2eee-4635-bb6b-1a2245cb0f82", "value": "mynode.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61a0bd6-0c66-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771377151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377151, "uuid": "83dcb22b-0459-49c2-acaf-02afdcd0c2cb", "comment": "Malware payload (Mirai)", "value": "06fba75ed23c81ad939337e4a2188681", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377151, "uuid": "bc5d6181-5aac-4bee-b894-f2c335aa355c", "comment": "Malware payload (Mirai)", "value": "11e32e5a2808a58fc87ce1b8d5ad0794960f6698544666bcfe7b4a553488db8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377151, "uuid": "298f9cfd-bac0-4020-ad3e-ae12d633d3a7", "comment": "Malware payload (Mirai)", "value": "10322fc717d3b7b828380f54a8f49612826898d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377151, "uuid": "70d028d4-8964-474c-a04b-4b1f14980270", "comment": "Malware payload (Mirai)", "value": "67ba97b24b7cd50857b92c1b787f940a96fd4c035d1fd3025db9ddcec854fdcc3f6d4a96eb00673881c1de523ba2f20e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377151, "uuid": "c6b754a8-9208-404b-89e4-4d550bfbdffd", "value": "T1FE157B9CF786E0F1F26340F0025EEBF64534A12A5013FAF6EE45266774727A16F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377151, "uuid": "893e4490-aabd-4f0e-a43f-6047280bb447", "value": "12288:eJaV9TaGQhp2h81cwIxO7CLaD4168jrnqIvXXmqGPyI/tW1WJ4Lu:qaV9uphp2hmII7fU4KrnNmzY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771377151, "uuid": "e896069d-104b-4688-9ff0-eeb1dca19f97", "value": 878808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771377151, "uuid": "354467f6-e0a8-4bf2-a3c1-f6e8527c529b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377151, "uuid": "ad8e3062-2088-4ba9-9d64-cb44e46f114d", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17da62a-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441165, "uuid": "d1907784-2a3e-45d0-8fec-f1ed5b4f56dc", "comment": "Malware payload", "value": "a6ad2bd2e8ce4589c7855356f22f7a6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441165, "uuid": "9b1e1ee4-0ed8-485d-ae40-ce81c4e15476", "comment": "Malware payload", "value": "1234978ed17b64813372138d8ae5fb0c02515a342b7cc4a91d8e4072f3b4033f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441165, "uuid": "aeee3b0e-71ee-4713-9b51-73f897a357a1", "comment": "Malware payload", "value": "2bc18c99de845e785b2421408e3ce3c66fd6f30f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441165, "uuid": "193ddbdc-7896-49d0-854e-076b5c8b6964", "comment": "Malware payload", "value": "2595d8fe7bfefc658102eb62ce86105bfe3bb4846b3b338b4fd5a3982fe9fbb56ea9b1f3855c1e73ac5ea9ed18334a1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441165, "uuid": "00110999-f861-4242-a7ac-6452dd74a7f2", "value": "T1D8B53397455CF921B62C0C38C3C992CA7E196CD3D14B1861B920219F5EF2BDB3B791AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441165, "uuid": "f2fc0eba-55ac-449b-905e-47bcc58cfa5d", "value": "49152:BYu4FteYqzDCmq+L7t+TDG67RsT3sqIiS9y2/GUvNSrm:LmUYqzVqIOGWijIiMz//vNSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441165, "uuid": "52abaf71-9f41-45d9-b541-5093ab300592", "value": 2444332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441165, "uuid": "1e84936d-a5e7-45b0-b464-882a9d70f63d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441165, "uuid": "1fc6b0e2-a8d0-4fbd-9d93-1a4075f1bd36", "value": "ethd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1716a26f-0c69-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771378092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378092, "uuid": "2d5f46b7-159d-4c29-b79b-c3119f1323a2", "comment": "Malware payload (Mirai)", "value": "707ebe651540c87136b42cb46e207f7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378092, "uuid": "f7a4a313-1b04-4dda-b2f2-73f40a9b695c", "comment": "Malware payload (Mirai)", "value": "125b37d011e34fff665e57b0fe13257c38033fbc5223718977c7dc2026e1aa66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378092, "uuid": "9e9f9b67-52ff-4701-9a95-0565018af038", "comment": "Malware payload (Mirai)", "value": "7e89ef406676cbea3092c817ef221505dc6f67a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378092, "uuid": "dbdef930-ae63-4bfe-a3dc-ad23f119f72b", "comment": "Malware payload (Mirai)", "value": "d644d922ff774f3258635db0db4066ca6d30af034b48f58b705a524b186ac00ca5d9445faddf84cb322f8911ac008966", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771378092, "uuid": "bbf7afe1-eae4-4879-babf-c053241d4451", "value": "T1B7C31BCABC858F10D5D666BAFE0E518D33134B78E3FA7103CE149B29278A85B0B3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771378092, "uuid": "479e49ab-3bab-4b7c-b723-0194042a46d7", "value": "3072:SLwhf4av5BKOSE3LffxSW/CHkLcMO6ltALxKMU5hrqmZg2sL5pn4:SKpKoDxSW/CEfO8A1KMU5Fq+g1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771378092, "uuid": "30e554c7-0933-4258-bcd9-75d87d0d5b34", "value": 120356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771378092, "uuid": "285b7d8b-7a5b-4882-bd21-3be38778e618", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771378092, "uuid": "63398fef-56a8-42bf-abb1-58af81892400", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376952bf-0cf9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439994, "uuid": "42dc1d25-1c14-494c-8a9e-86f135231cd8", "comment": "Malware payload (Mirai)", "value": "90fbaf5379a110769dc49f767aef53da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439994, "uuid": "7516d13d-da01-472c-9b87-79ae033a10de", "comment": "Malware payload (Mirai)", "value": "12d494c92b9bbabdb1c5f5d5b5f3bc5bc33f5d9440c66fc4253a30d062479342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439994, "uuid": "837c7976-1d38-43fb-b082-1f875195f546", "comment": "Malware payload (Mirai)", "value": "9236624c069e624cdae0fa78ef6708c9787c1b1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439994, "uuid": "95efd43b-4ded-46ab-8976-f583dd692452", "comment": "Malware payload (Mirai)", "value": "33a79e09237a030024db8aa0920db117ed5a049dd311b0108b7b6eb02381c3ed724dff6484537ca57029341276530db9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439994, "uuid": "3501f015-d58f-4325-b4c8-815b56a66906", "value": "T18BD32A06730C0A47D2632EB03A3F67D197AF9AC121E4F640355FAB8A95B1E335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439994, "uuid": "aff5bd23-a140-429e-b308-ec3876a72816", "value": "1536:troGHNTUZNHlIBUiCxfytmtewMDNna/w4o7lbEJvAhh3rp+JuQfqAg87G3p:3mWUiCxttqCwZ7lLhrIa3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439994, "uuid": "b27330b3-0c83-4063-9fd0-c026d7956b43", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439994, "uuid": "49155d16-903f-466b-9dc1-1715896961f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439994, "uuid": "65a0a430-31e6-4de8-8dc6-d9559aa7513e", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c3bbf1-0d1d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771455364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455364, "uuid": "eca07075-98e3-4dab-9adf-31bdf1a8d1db", "comment": "Malware payload", "value": "ab6d2b906228f827d257b597e982121c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455364, "uuid": "792ad3dd-2709-4b2a-b071-c71a68be0443", "comment": "Malware payload", "value": "12da31c9a1a131121873eb1178be390df4eb284908a99494427362e3e4a4f466", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455364, "uuid": "96d0a5e3-d10f-4bfa-97a8-8ff8cb0514db", "comment": "Malware payload", "value": "7dd88314a8925bb312fa99b6432f176c2df79919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455364, "uuid": "93045d04-f602-4302-97bd-96cb2b4a3ae8", "comment": "Malware payload", "value": "3d42802694545d6cd9bcc30eb74fe6c1e025bb730a5c57016340937b064667ed765fd753e848cdbb362ecfaa76dcdc34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455364, "uuid": "cc7c6e59-2226-456a-b21f-415ba46413b1", "value": "T1BAC33996ED818B11D5C116BAFF1E528E3323177CE3DE72279E245B34278A56B0E3E406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455364, "uuid": "3fc01951-4024-4145-9993-10e2b51cd6a7", "value": "3072:jduV+iOo/34MuQcp0iaKYnjklYvvVY+XvktZU:8yov4MHcpbaNnolgVY+XvgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771455364, "uuid": "763c2711-6b2d-489c-936d-4593eca530a8", "value": 128740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771455364, "uuid": "00d45d10-edb5-4fee-b080-fa749b0f91b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455364, "uuid": "0026d4b6-2249-41a6-a4e7-a557ab7e01c2", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8faee927-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771407070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407070, "uuid": "82321f28-e420-4685-bec2-ffed1d409583", "comment": "Malware payload (VIPKeylogger)", "value": "93d88af9487916b874ed3186c9a8a31d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407070, "uuid": "ac288e08-bc54-47ba-bfd0-dec0885d888e", "comment": "Malware payload (VIPKeylogger)", "value": "143dc395c381185bab3f4d6dcb3ea06d4c5f35569b994ee5e7176ac2a1510316", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407070, "uuid": "069342db-784a-4652-93d2-3127434a1431", "comment": "Malware payload (VIPKeylogger)", "value": "b3127dc27f090dcfba47f6aa2f4a5135020ceb6e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407070, "uuid": "b67eddec-26a1-4c46-8314-28390323582b", "comment": "Malware payload (VIPKeylogger)", "value": "e7e1263b7433f91554b019cdebff8245ab7a43de4fc6e5d36cf59b10f2154b7177342d38b52c5cf771aad36ae0d97cf5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407070, "uuid": "5fec620b-9e18-4107-918d-15b0b33c1ab7", "value": "T196451290D92ADEA00A1C5061246A1DC769800EA74C88BB297F8F9F8C1F1F61FD5767FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407070, "uuid": "d65689e2-2ed6-4874-aad4-ad8d578c11f7", "value": "24576:F14rznXJ3u3u2nNfbU70KneaHsdrkcGmU9gvNsJZ:F1i9ethbDGmCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407070, "uuid": "ce4d6973-54ef-4fac-a9a3-eecd7d16a860", "value": 1194125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407070, "uuid": "7cb36043-b62d-47c9-a378-6b0abe55ffba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407070, "uuid": "80210c83-88e4-4842-a951-e5367435acd5", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9917be48-0c91-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771395490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395490, "uuid": "72e8fa15-51f6-4bc9-94fc-5f2a01903adb", "comment": "Malware payload (Gafgyt)", "value": "52efc389c39d72eab682beaae4af4e1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395490, "uuid": "d81cb216-e3a0-4204-93f1-ce2085a6b002", "comment": "Malware payload (Gafgyt)", "value": "15808f736ea34c4fac25c3712b4c115293abac3e289ed90bf24befeb58e5f02c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395490, "uuid": "6cbe4525-893a-4abe-bbf4-e51ae8a81406", "comment": "Malware payload (Gafgyt)", "value": "4e2ac22442110c02b228da6636f6a0577ddfd932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395490, "uuid": "9c8e777f-b1af-4001-84e4-e30bc6902921", "comment": "Malware payload (Gafgyt)", "value": "2aa5b4d02f55db3293d0754e895316dd63185a53e8ff01c620abc80e34ee4a219844ec55e4bf952ca03d8970cc8371b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395490, "uuid": "21bcd6c8-d5eb-462c-9564-1f2728b84314", "value": "T177C301C6EED290F1C14344331873E36BAB31EE161018DB5BFB857B21AD953A6906F399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395490, "uuid": "eb92e445-871d-4d44-ab3d-68bb27996f84", "value": "3072:qa3z5a9yc6DWmycBHKjRJx0CEypaHdEOo1UtGCw9oSgI:qqm10ZdcFLHA9EOo1UU9oSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395490, "uuid": "80b6c063-14f4-4f7e-9a8c-e823978b78de", "value": 127073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395490, "uuid": "28c10f4a-8650-44e5-8b81-1ceb351b09d1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395490, "uuid": "3b9edfb5-1857-4050-8500-95a1ba42e392", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c38b28-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402199, "uuid": "189f952d-8f89-41e9-8f6d-5ac8e1eed69e", "comment": "Malware payload (Mirai)", "value": "e635f8c92437e5f49f98d30bbf9e4804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402199, "uuid": "b2213ea7-3349-451a-83b6-e07e0e6e045f", "comment": "Malware payload (Mirai)", "value": "15a319398aa799bd1c7076cc7dcd88de29875fcd1ecd12292bd6ffec85040f90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402199, "uuid": "ddc6f5aa-fecb-434b-9e88-1d52b5a013d9", "comment": "Malware payload (Mirai)", "value": "cb10da41046e97d2f84cbad54f99854c8eb571bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402199, "uuid": "ac02747e-376a-4030-8f31-20615de282fc", "comment": "Malware payload (Mirai)", "value": "ff8db74cad1f40174f34986674b6162ef96123509d33e4386dadbb27b36eb32ae77be5f6da0715d430d503cc65ed4d2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402199, "uuid": "c7fd2320-6ceb-45f5-978e-4a4bd97168e6", "value": "T1B8C39E87FB8B14A0C8120AF013C71F9D6F57A211CE5FE8E3AC1D663B5A7A4DB1916781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402199, "uuid": "77ea07e9-8091-4032-90f0-56a8e2d29ba4", "value": "1536:QE8Gu3x/eI1WPG/SeeeWlrzB2TKf+vlm+MlD/axxMY0xP/Jgw3E+/LWh:Qn31e4WPGpeeWlXBco+c+MkxxMYkg6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402199, "uuid": "d624b68f-371d-4542-91c8-ec1867d4b616", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402199, "uuid": "09f067d9-4381-4064-8276-3e1e81b8360f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402199, "uuid": "8e73d28d-1de9-4751-894e-db437419e799", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651def1d-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771406999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406999, "uuid": "13547c89-051a-4272-8549-2add8955ffb2", "comment": "Malware payload (QuasarRAT)", "value": "d74c9c50660a7d928ae5dcf667661f31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406999, "uuid": "4e87be27-5260-4756-a2fb-17e0016dcf4b", "comment": "Malware payload (QuasarRAT)", "value": "16b394d76cf5663a9370672de28ef6016233c3d4415492a731834ef01f1386fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406999, "uuid": "4da75e3e-1fe3-43f2-b199-08e2799ebaa3", "comment": "Malware payload (QuasarRAT)", "value": "36419af928e132f29e932b2a22c3a145558d8bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406999, "uuid": "98e87b20-cfd0-4046-ab81-362ba3f851e4", "comment": "Malware payload (QuasarRAT)", "value": "98204cc2610f00565423fb366bc13df6247194a9826ef4053b7fb1374c6403994602cbc621353de77fa025ed2eeba339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406999, "uuid": "9089a4f2-0de1-4f84-8bd5-ee883220d51e", "value": "T19E46232B3DC39914CB1D47B580798DC277F0A68B3B01C72E7ADE17BC5E0154AAB23A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406999, "uuid": "38169799-de45-405e-9f0e-0d7b78f249fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406999, "uuid": "16535d21-d917-4272-9732-05353520100c", "value": "49152:amLzswao2kFAn/2Gnw6nxwXqiMOrENcitrFkPvhGR7thSoWYfy8jg78uoX5aQq3S:57Q/2a9Or4cW+PvkNDHmHQq32yeDGWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406999, "uuid": "2cb5a65a-1fd1-47b8-bec6-99c478b1642f", "value": 5625856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406999, "uuid": "b9597888-9364-41d0-bc35-286d9a6da2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406999, "uuid": "acfcb7e3-ed4d-4f58-a394-cff68621d6a2", "value": "POWERPOINT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9a3264-0cf6-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771438820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438820, "uuid": "623c67ee-dd1a-405c-8beb-4369227de081", "comment": "Malware payload (QuasarRAT)", "value": "7c43f1ca8ea4541abb4ac5454bf73e48", "object_relation": "md5", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438820, "uuid": "e3bea561-b344-4d70-b519-703f0b404404", "comment": "Malware payload (QuasarRAT)", "value": "17cef7d32507058e108b9fa76c2ec94dafd788677b88595e86dd99c6a6d13fea", "object_relation": "sha256", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438820, "uuid": "7f6a1f15-b127-4194-af6b-0edd846ed846", "comment": "Malware payload (QuasarRAT)", "value": "538c2e8baa21eee5cf1d0cc6404ea7a94f6e1466", "object_relation": "sha1", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438820, "uuid": "811e70a8-729d-4b6b-b6c6-165f360c8061", "comment": "Malware payload (QuasarRAT)", "value": "c3fb84ec2b9d8d40ca197c75edac1af0106ad33d0041ea8eaf1dc77c43789ef2edc001f6ad811d8a406b214c38475e14", "object_relation": "sha3-384", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438820, "uuid": "3e8291b0-a9eb-4881-8bb0-411a67e6fe9d", "value": "T172748D2373A8D93FD1FE173AE43246154BB1D4477A22E39B6A5855F92D133828D823B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438820, "uuid": "aa050134-3c30-499a-bb48-85e9aad3acff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438820, "uuid": "7a94f371-87d8-44ed-9295-6bd175d0c992", "value": "6144:9LNHXf500MgL4wm3Yt2nBcbsagGXLt6MYehJDSIOQ6+S:Bd50GLm3o22gSLt/Yeh/OQ6+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771438820, "uuid": "dc0419cd-c3c7-4992-b82e-6a44674d66c3", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771438820, "uuid": "9a187371-738d-421c-9081-d34cac03613d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438820, "uuid": "5724cf2a-a4d8-4485-847a-915ba74a2548", "value": "17cef7d32507058e108b9fa76c2ec94dafd788677b88595e86dd99c6a6d13fea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3d581c-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402203, "uuid": "7280268e-de21-4811-ade7-971150e3d6a0", "comment": "Malware payload (Mirai)", "value": "c987c2d1f0b45a699cbe60f51cc7fcb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402203, "uuid": "0599e3eb-792e-45d9-a8c0-87ca7f43055b", "comment": "Malware payload (Mirai)", "value": "18480cf8433713cf3fb8ea3d7ff5e08e5905cd7aea04a5b179d10e23fe7d795c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402203, "uuid": "d6e35a6a-ceda-4e6c-9f1b-10bda197b431", "comment": "Malware payload (Mirai)", "value": "0b7661fc8316ba28c79503b3ea256bffe8e6bc50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402203, "uuid": "409d1ed6-e80f-4978-a575-10f5434d6e6a", "comment": "Malware payload (Mirai)", "value": "658a6d16d29c4496e9d3245156220c9105f602e89961579ceba4ed129c18f6dbfe4509a80503cb3c7eb7d396c7e80b72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402203, "uuid": "17383e10-d38d-47fc-9c08-45f99bbd1edd", "value": "T13563F10E1B66CEC095253D71AE514F8BE7119FBCA4BD5A7F2913CA90B71241AC87E0C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402203, "uuid": "e27e6b7c-7c56-4fb0-af7b-ee5379b83522", "value": "1536:4wZdyPA7s+xBuADksY2M+PUAKL1mNeXwBiQU8Tk6oXEP:4yMWDksY2zMXL/wBiKHvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402203, "uuid": "a77be327-9c0d-4370-955e-c7a07d8179d4", "value": 66904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402203, "uuid": "fd4775a5-1476-43d6-a2cd-46e276f7ae4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402203, "uuid": "0044078f-9793-4ecc-96d4-3ccd2a1ee0a3", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a63bfc-0cf8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439504, "uuid": "3f082c38-0777-4570-8b7d-23659e851b23", "comment": "Malware payload (Mirai)", "value": "45da2d9d02bbac6d93ea66a30e7c9e72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439504, "uuid": "cc91a03b-4052-44d8-95c0-4efe09c75c2e", "comment": "Malware payload (Mirai)", "value": "184843ea3cad5cf87acb754efed441e4db6583cb94e1d33c496f290362a44573", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439504, "uuid": "fd60ade2-bd7f-4c3b-ad1f-2f274af7bb29", "comment": "Malware payload (Mirai)", "value": "5ce46cead12f567ca41d394a38cbe170482ba7bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439504, "uuid": "de53a07c-5e95-4f36-8c2c-d8ad825268ae", "comment": "Malware payload (Mirai)", "value": "29e550016f21c2f340e1bff833014581f5c3837fd37c9aa746edbf3971e5528b59468b9795a7db826a5e5f0e94adf74e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439504, "uuid": "b506e868-f2f3-4728-bbe6-a348c55c2716", "value": "T1C1A32946F8814A21C5D512BEFA1E318E331357BCE2DE73129E14AF3173865AB0E7B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439504, "uuid": "32710ee3-9cd4-43ff-9bcc-d6c3c6619ae5", "value": "1536:wAnTSlO67kf5J7ZLBpqppsGBgAQxKSI3k7iaRr1OXDDdRiNpqx/FYv7Xh5GYW0q:illbppsLgS2k7iaRxpqx/FYThUL0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439504, "uuid": "6fd098e7-6585-4f13-870e-09785e18e94e", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439504, "uuid": "a0c63822-8f48-4898-9607-a664f2b42019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439504, "uuid": "3f6f6efb-182e-4f6a-9e1a-4b4345a1db91", "value": "rizzx.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fb206a-0c6d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771379949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771379949, "uuid": "ea712567-1e03-40f2-9d07-7d673fee9743", "comment": "Malware payload (Mirai)", "value": "5312ef03df1b88f5eaef031b6e4684c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771379949, "uuid": "9ca9b599-2902-4d33-8fdd-a18b9380b72d", "comment": "Malware payload (Mirai)", "value": "184fd0dab236dcb4889b5824ef2577577a34be3057e7d113c1eed7ef515b1e4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771379949, "uuid": "9b472277-7ed5-446a-8490-4c9d04ec60fd", "comment": "Malware payload (Mirai)", "value": "2e38f615c237870629f8c17e531369465da38a85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771379949, "uuid": "f3453d24-fd7f-4171-8a45-cafa8790a085", "comment": "Malware payload (Mirai)", "value": "df2c8a42aad8838fba8c46292e15f96bf272fe2657b6a1258b2610dc9d9f7880930181aa081d4e3fd09039f689213198", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771379949, "uuid": "01f344fb-6b82-4167-8e4a-91506f3df5b6", "value": "T1F3730A826A43DEF3E85710F502B7EB365A32FD3A083AC5C6E774FCA15A515C0A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771379949, "uuid": "00c5ab04-295a-4b27-a6f7-137e7b55ee61", "value": "1536:Rcz8Mfl3USRL+r97S3Tl9ffUr9sFC1qs3vLJ7LZaA14B6Kk3u8Lxg:RcICl3USMsTl9HUrS6qs3TJ7LYK4fQLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771379949, "uuid": "20163ddd-78cf-4bbe-a5a6-6ae49299f2d9", "value": 75592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771379949, "uuid": "46f4cebf-d806-49d7-b8d2-8d5ea3f5478b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771379949, "uuid": "3b803934-1c45-472c-8361-741bcd53b7cd", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef39127f-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441590, "uuid": "134e8208-7763-4cab-9bb8-5722377b7862", "comment": "Malware payload", "value": "1ccd167d7d6a5955a67ecebad314cd2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441590, "uuid": "40a19f91-4f12-4629-bf83-c1a6d22d2354", "comment": "Malware payload", "value": "1897f70cb9533a28b9d926afdb07dcbfd35eed95838df5c3178763a0b185dce8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441590, "uuid": "099b3d59-22c1-4b3b-8c76-b88e70c3cde5", "comment": "Malware payload", "value": "d7af9b41bae335900d4206acfa2d05f10a61959c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441590, "uuid": "2e3dd218-b520-4a3d-9dea-94aa7df483a6", "comment": "Malware payload", "value": "023b9fbc7c2c6f712bd0f1850542d4a1fce2a212fd86698b1fcdbc76dc740acb7599d1e72cde3bc3b3effa08bf16c2da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441590, "uuid": "c78410b6-572c-4e92-9df5-def8837083a1", "value": "T189E44B436B618FA5F376C53206F34766AAEE129623F2C491D36ED5107A6035C282FFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441590, "uuid": "8f819a0d-91ed-496e-ba32-043f3aae5ed6", "value": "12288:2wKQh1ogWvjkUJpyKLP4gAqmMUmz7GtMcqb/d:20h1LWLPj48cmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441590, "uuid": "d6d79917-0077-407f-ab2e-d4fa3a5dd95f", "value": 679660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441590, "uuid": "3f77d514-74e4-4502-bc2b-1bdd0b7f64b4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441590, "uuid": "f0fe8d10-6586-40fa-93db-9884890bf73b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83331b8c-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771407050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407050, "uuid": "c66a7d19-9f58-46b5-8d24-8cee974f277f", "comment": "Malware payload (VIPKeylogger)", "value": "98552ae9602d0ee66bf1aa6b0b4cfc27", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407050, "uuid": "d308b875-ec2b-4a6b-b850-57b8a9e1fe27", "comment": "Malware payload (VIPKeylogger)", "value": "191aa7026dae4694836406fc000a5b1707dc108ae44b3c011f6d3538e4abd0cc", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407050, "uuid": "e6f192f5-9c00-4265-af9f-ebe69f0e57f7", "comment": "Malware payload (VIPKeylogger)", "value": "b6d2fcca794cf6723bcf17735fc4708006f62ffd", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407050, "uuid": "e08ff2d1-c7b9-4dcc-8ecd-a2899610b9b5", "comment": "Malware payload (VIPKeylogger)", "value": "eb95fa5b96b9d2999b3ebe3f42f098fe69c72958572f1d02aec850459d18e742ff10591600c7736cbaaef0634f9d3006", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407050, "uuid": "c9469180-ed38-41d7-aede-e1fab3ca619e", "value": "T1F5450110D9518D610A2C816924AA4EDA6A408DB34C8837397F9F4F9E4F5F60FD139BFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407050, "uuid": "f44f9a2f-282c-4bfa-8e98-43cf759ecd56", "value": "24576:3e7SF37sLLdHIobHVC/LNug83639ZqMvr5fOlnYpP:3e2WFLqNZqw2lne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407050, "uuid": "05f838b0-e120-4b19-875c-6802927ffddf", "value": 1196021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407050, "uuid": "99bfc7ed-4b26-4487-8e84-4cb8efdd9bdd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407050, "uuid": "2e2566d2-6952-4b8e-b786-35f00b236555", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9362b9-0caa-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771406231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406231, "uuid": "745bfb0d-cd40-4375-8619-eca440771982", "comment": "Malware payload (Vidar)", "value": "2fa69c2d76720377b489cdd67c858e7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406231, "uuid": "443e8f74-f2d6-4d6d-9d68-e4999ef5932d", "comment": "Malware payload (Vidar)", "value": "19b97d431c05d68db12526e3337b4ee42cfb769cdffcdfad4a98bef54aa9ac06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406231, "uuid": "e39946da-b9e4-41f8-922f-bef6225020cd", "comment": "Malware payload (Vidar)", "value": "4e7f9cd94989e08337d2702a955c153dd15f0de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406231, "uuid": "f99602ef-d1b1-48f7-b9bc-abc76f6ea81f", "comment": "Malware payload (Vidar)", "value": "3e922e97dbb14151982053e73459d70ec599b3e05ab83433bd086a89db13b44a8c653f53a636e39520ed91054efd9d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406231, "uuid": "35b9265b-8a5e-4516-9e99-2177a5296787", "value": "T199063913B89E58A5D67EE03890A05352B6717CE943307BD32B95A67E0E72BC42F3E714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406231, "uuid": "0455856f-aed4-4862-8f3c-9d0185da51bb", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406231, "uuid": "b9e63ab7-8a6c-46d2-8570-a1d1daca8e7f", "value": "49152:t4tWv9q3aJK6Ha5Ct+bzn82L9CaBUb+uPKHtptK1W:Vq3ag6HUY2L9lBUbbYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406231, "uuid": "e3454c20-5a2a-4649-8de2-63ae9a83953e", "value": 3948032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406231, "uuid": "4e546415-2be0-4afa-9b07-fdb3a471879d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406231, "uuid": "4e76f409-bb0f-468c-a345-8a9d80e01599", "value": "19b97d431c05d68db12526e3337b4ee42cfb769cdffcdfad4a98bef54aa9ac06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a64463c-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771446012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446012, "uuid": "fe72907b-a41e-421a-a4f1-aea5dc953dd0", "comment": "Malware payload (Mirai)", "value": "7b4f7f55a796a3745b4424d449d0c387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446012, "uuid": "0628e9a4-78fd-49ff-8e44-216eb70fb585", "comment": "Malware payload (Mirai)", "value": "19c94c2a249536b98ba993637cb8ba27e8cf51ab847a252f6ba620e61c2f9081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446012, "uuid": "7e1369b5-3000-4dca-860e-6e82966a3462", "comment": "Malware payload (Mirai)", "value": "394f7097c9da5d393208e85694d08b944bd5dbc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446012, "uuid": "c9f4f81c-8133-4d8f-b05d-634e4994322e", "comment": "Malware payload (Mirai)", "value": "f511ba3c2cdb9277e70d5ef252830698e02b69f383e855c89f2143149808c6c527cdb28ed52670daea26165cb176db22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446012, "uuid": "15cefff4-2b8a-4680-aff3-d66936d95ba4", "value": "T169C36B73C8256FA8D664D5B4B0708F789B53A91182875FBE59B7C2B58043D8CFA093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446012, "uuid": "2530cbf0-16db-4a09-9764-e98873247ae7", "value": "1536:GKB/FzuKKZP0N0wAxxCchOK9PJmWhgq6sU2YW1OvcyynsSj:Gadzuq0pxxthh9+q6oYWwvcpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771446012, "uuid": "2d6a8ec9-e45a-4f23-ae67-d4dcc3d1f710", "value": 121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771446012, "uuid": "8c112cf5-6940-4668-b343-709ae3e9d0fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446012, "uuid": "4886ce4b-fa69-4805-8081-203fa09ec47b", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ec7b66-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771423375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423375, "uuid": "80effba6-4699-486b-95a8-938eeec860a2", "comment": "Malware payload (RemcosRAT)", "value": "3c9eabe479d9776468418b2749cc7328", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423375, "uuid": "19d500f0-cfce-4f64-99cb-0d8d4ab95f3d", "comment": "Malware payload (RemcosRAT)", "value": "19d457ea6b26ff39e03a7652aaef9e0e963064bad85bbfb0c230a1b127b02e6b", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423375, "uuid": "a3c5d258-ebd0-4a62-80b9-c65db8143286", "comment": "Malware payload (RemcosRAT)", "value": "d04f3e4b97ddc393d052b65ac43171d03b1f03b3", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423375, "uuid": "20e88eee-9d1b-4971-b9ea-a04454f86ed3", "comment": "Malware payload (RemcosRAT)", "value": "c998ce322a2e2059432ac27f0f07a0aad17d35aa2c40a5964c1e0df7a200dcfa0bfd728f3ab1dd9fb8361ebfa1232172", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423375, "uuid": "ff198313-d44e-420f-8bbb-9438abbb9a73", "value": "T1C6A4AE02BAD2C072D57161344D2AEB35DABDBD202835997B73E61D5BFD30180A73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423375, "uuid": "d8760ed7-0fe7-48c3-93b2-8b21540accdc", "value": "5d354883fe6f15fcf48045037a99fb7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423375, "uuid": "4caac455-9de3-4d84-aecf-14e0a1f8176e", "value": "12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSGn9:uiLJbpI7I2WhQqZ7G9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423375, "uuid": "4323f25c-3d3e-4a37-9345-e70d19f602cf", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423375, "uuid": "bb8eb9dd-f0a4-4f2f-9ac9-ad233cb30ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423375, "uuid": "5296a41e-a2ae-4fda-b063-4db551d2ea37", "value": "19d457ea6b26ff39e03a7652aaef9e0e963064bad85bbfb0c230a1b127b02e6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a031b4-0cf8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771439487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439487, "uuid": "ad96700f-222a-433d-9f0b-bf2250a93ca1", "comment": "Malware payload", "value": "e2eeea3b98de0416472c6e3d51796a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439487, "uuid": "d28514af-6193-4aac-aacf-71a852d4500f", "comment": "Malware payload", "value": "1a1aba39cfd33998c329cfa0fbc7a842684a9c72154c9edbb31a31f19f00172f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439487, "uuid": "de0f8750-00d8-49d4-9b59-02f3875f2bb7", "comment": "Malware payload", "value": "b31e6662ecf417b44710ee8256b5f91eb8bb2fcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439487, "uuid": "32a6d460-21b0-4493-9e5e-9717f513b86a", "comment": "Malware payload", "value": "d677926c18c65c97f4ce495854e91afabe611db3352f44ed7ce6fb98afa2dfaecd9164b101a8d5ee44e018ab9568d98e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439487, "uuid": "2836b87e-f1a3-41be-aeea-6dec8ff78c13", "value": "T144E32A85FC519F26C6D225BBFB5E428D372A1768D3EE720389255F20378B85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439487, "uuid": "c6d12df6-cc3e-4b91-9c0c-fcb529652ecb", "value": "1536:CDbweAvfefCwXiQPeWa8D+c9vfpFA0M7zwADwuyTTxjFcfNOhFl7s8n9Zl5Bwywh:CDbrOfKtkctfX4vwA1yxjCY9sWPHxIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439487, "uuid": "9b7848b0-b433-4301-8783-b8771e14bf17", "value": 146112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439487, "uuid": "9d24f300-d369-491e-a72b-ba41887e0ce8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439487, "uuid": "656307eb-3f4e-47b5-a354-7346b119309b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06a1f65-0ce2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771430399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430399, "uuid": "2499bbf8-eb71-486c-834c-7fdb6a5aa130", "comment": "Malware payload", "value": "f38f1da49505910e14adce541051109a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430399, "uuid": "0611823c-021f-4abe-a6f5-2d2242069768", "comment": "Malware payload", "value": "1aa26af6db8f8bbbb7715c8a3b9ed5d96960f3288908254d345db5299799dcc4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430399, "uuid": "d9d53748-ba4b-4f8e-ac1f-a2ae04b767e8", "comment": "Malware payload", "value": "6b60f0129633734500649d6b031c288bd7a6b742", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430399, "uuid": "b780e002-9daa-4fb5-a0a9-42afa2a5b894", "comment": "Malware payload", "value": "40c74d08cfd770b359524af5b32b792abc736cb5d0bc45534b42cb65a3aa4eabbad20d58f644140319367ed7dcc187c3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430399, "uuid": "12c39339-b4b4-4305-8420-6bc3e31b65a0", "value": "T13F18334BBDC3D422DD399DFF41BF2B6692394E061922041BCA277184CDF1FE512AA6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430399, "uuid": "3b365e0c-55ed-448f-80fe-5cc04454a459", "value": "1572864:XjuwYC8Fu5oqVwSoCVUhNpf7h6HhsTEJZh9AuaZY1+5xgL/WpCemM:XKwYioqCSoCEpf8HWTk39AK06NM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771430399, "uuid": "98142e78-ff36-4199-894f-5bc3bcd5389e", "value": 86298327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771430399, "uuid": "1948e83a-65e4-4d81-b4fb-f3359462fc43", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430399, "uuid": "8908581e-c644-4c1f-98ce-7a56f6c8d07c", "value": "delta.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440b7801-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402219, "uuid": "4a2b3ffb-e060-4ff0-9f79-b08dd68207af", "comment": "Malware payload (Mirai)", "value": "ee9232866eba74bc79ad5aaf69ca2d24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402219, "uuid": "f0740865-544f-4c2e-98fb-7d4ddef2161a", "comment": "Malware payload (Mirai)", "value": "1aec34765b535a48ddfd9c70d94f025d8fd5375dcbfed4558549759ecfafb383", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402219, "uuid": "7fdb5504-76a0-4ad9-add2-bdced53a8adb", "comment": "Malware payload (Mirai)", "value": "c8ff2c563116132f80489657b84f326ec3076f1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402219, "uuid": "cca8f66c-17ee-416b-9b28-1dc5b39c34d7", "comment": "Malware payload (Mirai)", "value": "150eeb16d5afc6c56c9641a79400be4d44c7792c8b1cb860fcd5ce3bca4b12b0a8cada345cb76742769a1d49dc68717a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402219, "uuid": "91912cb6-8777-4f0e-aaf2-4d20cbfe2a4c", "value": "T1FC03F1669ABD661CE1FF7276108F83064D5E043E2195B7EFAEC4402A9B3933986706C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402219, "uuid": "9efa9237-a347-4175-8c15-ec3e813bb0ec", "value": "768:673yMqxY3PxullRufuvhc6M2btA8L+As9tfYpZ5VNcImr9E6HOh++cHjr5Ehnbck:WCM73PAlXufUcv22S+zNIZ5VNcIyS68B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402219, "uuid": "1d0f1886-1501-430f-ba1e-d1974aa257fb", "value": 40560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402219, "uuid": "ff64f4e2-0c74-411a-89dd-5f72ac8d906c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402219, "uuid": "6ae26d12-5575-4a5a-8caa-e97c1d0d973c", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01231c24-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441191, "uuid": "2389508d-abf0-4b62-ae40-3326e700b875", "comment": "Malware payload (Mirai)", "value": "9467ad58e08f8bf56406b2665b25b75b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441191, "uuid": "808cd142-56ab-4ddd-8b97-abea08b670b5", "comment": "Malware payload (Mirai)", "value": "1b4c44b377265880d34da8c48cc25f8774d54447b5f791d2bdde8000712127b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441191, "uuid": "e4f56836-354a-45a9-9f93-9b1cfdc12980", "comment": "Malware payload (Mirai)", "value": "35f69481fa178b70ea8502535d0c6560b383235c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441191, "uuid": "34f2cb77-1dc8-451c-810b-55eb206a3d83", "comment": "Malware payload (Mirai)", "value": "847380babf0b5b88e37e6331e9ad79cf9a6027ed87d485426ea19b3178e60de71f407fd7e8543ece022d2fc1b7f3b6ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441191, "uuid": "858f997f-4e28-4b47-b975-3db3f7503e79", "value": "T13B9608C1E991D24AD63C6D31EFDAEFE8E26B3E315D88594AD9C8F33E19B214480F5460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441191, "uuid": "8bfc8bff-832a-4fcf-91c0-c55988d05a86", "value": "49152:FzRmYx1cSWvkzeFsHpQDumyZDSmCzWqYMXMhG74033E+ROg83OTqdGcPXCv9iWBi:BRmYx1cSWOeFCyCwzY57SJ6RgjEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441191, "uuid": "96cef329-beed-44f6-b1a3-5b94709ffc19", "value": 8716436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441191, "uuid": "54936b45-d5ea-4673-9679-33ba1f623c5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441191, "uuid": "da0f13a3-1b16-4bc1-9bc3-b4273ba5b08d", "value": "vredisd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abbf555-0cf8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439516, "uuid": "64840a27-b3d0-4eb3-ae62-92213048a8bd", "comment": "Malware payload (Mirai)", "value": "85b67e85111793e2910495d6c644f4f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439516, "uuid": "946bc537-0370-460f-b04b-07fe73ad6b26", "comment": "Malware payload (Mirai)", "value": "1b81d7e895362395535a2d5ea24c32749bdf9c8e6013307beb1cce0150fc224f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439516, "uuid": "b0753eaf-2256-4699-9b56-b4b7738f8cac", "comment": "Malware payload (Mirai)", "value": "c6b1aacb5ff6bc29e12e18b355725bd12029a8d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439516, "uuid": "af23f48c-8091-4ddb-a5bc-47a52a9fd0ad", "comment": "Malware payload (Mirai)", "value": "75b9e149101cad25b76ebcfeabcc7bba911022af086f0c173629baa49de0ff42b4f1572e6937a1121f79c949e26e1d49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439516, "uuid": "438f6ae1-22e9-4b5f-9878-36414db4c0a7", "value": "T1B2736CC4EA83D4F6EC130A350037BB379AB3E13E2169DB83D3A9A525DC125C2DA1635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439516, "uuid": "ed6b93e3-3ed3-4e9e-8116-e990a305d1eb", "value": "1536:0bMP6X3uwvGMSo+RIBlng2N5Xekch3K68cSw7:0bMC3ZGVo+R0lvN4kM397", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439516, "uuid": "218634fa-6d79-4f5f-868c-c8cdc64d82c3", "value": 79412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439516, "uuid": "c6f5d8aa-c4d3-4950-a693-0c8c9d020860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439516, "uuid": "3a9d690d-72f6-4edb-8fbf-4e325e74f914", "value": "rizzx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f400b2b4-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441169, "uuid": "5411421a-288d-45dc-94fc-009a49749203", "comment": "Malware payload (Mirai)", "value": "2a4a620ef2fcdf381d84ef0b865b3564", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441169, "uuid": "e9f8ba2e-161c-4f69-b790-78b4793157b4", "comment": "Malware payload (Mirai)", "value": "1c49eb20295f48bddd5784ce89097d3c16af60117387df6cf11f716024f9cfe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441169, "uuid": "ed85540d-e30d-46c4-abbb-a944954c9f5b", "comment": "Malware payload (Mirai)", "value": "9ca2c19ff6ec759e015329a11cfc6ee033f0dcef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441169, "uuid": "82fcc6a9-19e1-41ec-8579-23507b151f11", "comment": "Malware payload (Mirai)", "value": "f569328a2a9c7b16a80052193113a905f9ceea2ed7a92f325603200b35f3241fb49b315661e95cff966fc5295c4a2cfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441169, "uuid": "70860880-a129-425e-9dd8-9eecda85edc4", "value": "T1EEA5330CCEE24A18A344563EF27129D119CFDF49AE27DA5DB29EF520512AC932B7D073", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441169, "uuid": "929c4508-f8e9-42b3-8064-513a03553fe4", "value": "49152:wZSjmugGyyjcKcN5KjxzeGrJRLUeygelPhpU4kI07:wZSjpj0KAGrzWhp4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441169, "uuid": "93620f09-0f06-4d1e-8925-9358e5ea1fe1", "value": 2090384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441169, "uuid": "908ffc82-a5d1-43ef-b70b-4d461debee4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441169, "uuid": "d5544677-ed74-4f42-b344-5c35934fac2e", "value": "devfreqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f172f0-0d04-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771444825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444825, "uuid": "aebace28-456f-4b38-abee-95a2d76e795c", "comment": "Malware payload", "value": "cbe4f8024fd89f218462f6db7befec43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444825, "uuid": "ccc5fc6c-5d75-40bc-92ea-4c06b6f8cb6b", "comment": "Malware payload", "value": "1d3f88152b06518447e4fb2128f52f79597174ee1156a5162e3bb539a68343aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444825, "uuid": "c31509b0-ec5d-44f2-8b82-2bc0db048f72", "comment": "Malware payload", "value": "9c061adc4d6d84e8f4b02e3e00608f4cee0261c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444825, "uuid": "df408bfd-c662-4ba1-b8e5-cc5daee4905e", "comment": "Malware payload", "value": "59ad7d9a5edaf1983f601fe851b955e0109d496bf44df68f07beceef9c136e3ac206e8277729cca59179ae008f479dfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444825, "uuid": "c6078a9e-fdab-48bb-98ca-25f38c51d805", "value": "T1A3C4238FE021DBCA8424B94E2A4C94F6F3D1EF9776163097E8AB6CF5D5D20CE21615C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444825, "uuid": "e9764072-69be-4b65-b7d3-6ab8aaa4a63c", "value": "12288:YvIF8fwnwykKUsk/86PrgBRJ1cI8KyPIXSH:jFGxoS/FrclyPOSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771444825, "uuid": "9d035425-e962-40e4-b12f-eeefaeab384e", "value": 552167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771444825, "uuid": "4d8706d7-945a-4984-9546-a963a3f360f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444825, "uuid": "c783ce66-b476-42ba-9cd4-05f2bf149ac8", "value": "bizy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72971a52-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771407022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407022, "uuid": "2beaf009-e72f-40c2-af8e-0ae11f00ea4e", "comment": "Malware payload (Formbook)", "value": "7989e222ac1ff4a70bd29b211b3427b0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407022, "uuid": "43543cb2-2032-4be2-915c-57c2bda50e4f", "comment": "Malware payload (Formbook)", "value": "1dd5b33f1ddc0d3ff4d19f7856c22fb30763d5135cdd72271aa71e48069c8e99", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407022, "uuid": "7e8db908-da4e-42ea-881e-016f1cffb4d9", "comment": "Malware payload (Formbook)", "value": "dc7b8dd5c3211db50f14bd412c6ffa3d5f8a3d58", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407022, "uuid": "3f7999a9-9ebc-429f-9fc7-e01a74eaa0d7", "comment": "Malware payload (Formbook)", "value": "7781113e844a9b68ebec651fa6ea9b85f4711a9413919db226e7536a09bc7b7ef6e5dcd06d263f54e91af78b9b043e10", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407022, "uuid": "6e22bab1-607a-4abd-b7a5-de683e9c3cb8", "value": "T1D0652330CD289C69464C22AAA4EA6F486A508F479C1D70493FDC91CD4F1F28F167F6EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407022, "uuid": "30fe687b-84a3-457f-bc78-c81f58935bb2", "value": "24576:Xtc/gaDiCZXfEoWwDdq/rDDNzBar7Ee54DsFFsJKY0h2/n2yzvMnL5YEb:XtZaDHuYq/rdgrwEvFpTh2/1L2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407022, "uuid": "ada448b1-9b55-481c-b508-fc5d2fe4e691", "value": 1488457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407022, "uuid": "098af467-c787-429f-b698-831cf7788a65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407022, "uuid": "bedb31d2-2e7b-4255-b981-e8053cbac73a", "value": "johnn.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a709c92-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423356, "uuid": "1da32157-54df-4e16-b178-479c3d363a06", "comment": "Malware payload (DarkTortilla)", "value": "6da46e7c1866a2db97b4fdff2426482b", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423356, "uuid": "bdc0fb82-0158-4a85-acf2-9ae4193b4dfd", "comment": "Malware payload (DarkTortilla)", "value": "1f79a98949928ca05b5819ebdd5059dc499c84b842894cec926eeebc3486ff78", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423356, "uuid": "e4c73b2e-5440-437e-83a6-f9e20db420c1", "comment": "Malware payload (DarkTortilla)", "value": "b2578ec8d58ebd5dbcd2ee588e29292431cc49dc", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423356, "uuid": "816349a5-0704-4f54-a620-6548d38cb4bf", "comment": "Malware payload (DarkTortilla)", "value": "43ea1b67095a6f431d221d318b9eab6dc52d64cc412c53af2411d1509732c4e233b5505e754fff044dee4383694b65dc", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423356, "uuid": "3bfa3d9d-c5a8-4c84-a8bf-d80be52b5c4a", "value": "T1A3C429F53AE9122DE5BFAB384CB10A2C4BFBEC57C631D65E2C4330995C21F499815B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423356, "uuid": "83183662-d70d-4745-b055-666f5e8eb85a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423356, "uuid": "61704c82-6908-4ee8-9e13-ac6fbee04659", "value": "6144:SoHze2GhbiXL3695us+8+BkufPSvV/1RRJStdLhmRh9NqBIja1Dyj6inlmKyiQ:SeeZoL367f+BPfPG/1RR4d0eIjkE6oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423356, "uuid": "2cf747f3-8d73-4447-b775-9a629bff49c9", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423356, "uuid": "6a526cd2-c13c-4066-b493-4b1544a52a47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423356, "uuid": "c3fa6041-3a4d-479a-8c79-e8c964b4e5da", "value": "1f79a98949928ca05b5819ebdd5059dc499c84b842894cec926eeebc3486ff78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5537e1b-0c66-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771377149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377149, "uuid": "c4ab90d5-7af6-4983-998d-46446a443eb2", "comment": "Malware payload (Mirai)", "value": "4e22d14768251b30d9bcfab7fc94b1a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377149, "uuid": "d17960a1-b30a-462b-9d41-9a5b6e7f0e23", "comment": "Malware payload (Mirai)", "value": "1fad4d651d64d2101e1505feedd6893b1637ae776d8b28ad01ec9119002c6331", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377149, "uuid": "b8c9a3f7-67e9-461e-9cb0-c6a3fd7a52cd", "comment": "Malware payload (Mirai)", "value": "aee337bcdcb2fd463e5f7ea1c8ff0fa6d23d6f94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377149, "uuid": "2890589d-d1bd-4e7c-85a6-4dc447b5fcc7", "comment": "Malware payload (Mirai)", "value": "4c27e15791235ccd7a1f3e86326542c4ed255471187bd847919f347c98515ec82173b5fb1c04a7071811a90ad8fc9b6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377149, "uuid": "75f75449-d98d-46d2-bfd2-70b23640cc4d", "value": "T1A6A31A02B70D0F43D1632DF02B7B1BE1979AFDA119B4E580A51EFAC69271DF22142ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377149, "uuid": "5a029c09-ec47-40e2-bfc7-5dc967d498bc", "value": "1536:Jjubg5A0SgXIaYOz0HWwSuhldvg2ZvlYb+oNEhomA/4piQ8fPPGBJVdyVpE0PW:JjA4XIvrdv9fpWZ4piBfuwPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771377149, "uuid": "f6b0a800-900c-49a9-b0e8-441f65952228", "value": 103572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771377149, "uuid": "f21aa549-bfd8-44bc-863c-8a9beabf5b13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377149, "uuid": "6582e25a-1c3c-4a12-b1a2-7dcc99a213d1", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388817a5-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402200, "uuid": "05940b77-711d-48db-9afe-6acb669e9586", "comment": "Malware payload (Mirai)", "value": "115a06fddff3e9707deaf5896d63b9ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402200, "uuid": "765f65cb-b763-43c2-b053-3a9c2bfd1a6c", "comment": "Malware payload (Mirai)", "value": "1fc381e68e378a00b766422addaa4fcdca5135bb3c578fb8989d330e9a41c910", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402200, "uuid": "62b37211-0819-479f-ad4c-0b2bf090ded2", "comment": "Malware payload (Mirai)", "value": "d62581259b9d0e603431574289e6d1c2e999fd73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402200, "uuid": "dc28faa7-b98b-4856-82de-8ddafd7d3f47", "comment": "Malware payload (Mirai)", "value": "b14abf9bdcb562e3d4064ec83bf8abc94050f5c979e51cebad33f3bb99e4cd3ca24b74f60bc7ec1bdb7b4f57e8bc2d46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402200, "uuid": "71a2c1d5-f575-45a0-aa46-50e6f83c895f", "value": "T19F23F123456AF8F1D02869BF804DD584D4AEB59013940F7A80FCB5FADDF2A943E20967", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402200, "uuid": "f73efc70-38b5-4f5c-8257-fbaa0de97772", "value": "768:SInEVflzTpXUiyd0voPa/tawgkPqTbj7gx57UDQoZkJsoSdU14G:js/JlRvoPa/tP2jgz7aqJ7X/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402200, "uuid": "8ba4ca83-2160-4cf3-b1fc-8c3743c3140c", "value": 47768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402200, "uuid": "13296495-ca52-48fb-91bf-72cc8132085c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402200, "uuid": "7cf2913c-45cd-4a9c-b7fc-b3d12352c081", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094b415d-0ca5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771403839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403839, "uuid": "0dd84f76-9186-4754-b74c-7eebcea68591", "comment": "Malware payload (Formbook)", "value": "3f739558eee99b88a98f6e31b62ecbbc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403839, "uuid": "920dae61-2a82-4eba-9385-203b198327f0", "comment": "Malware payload (Formbook)", "value": "203a1ca16ca11bb42746bf76c3ed84b35d3f840b4b6f8c3b023f994818830318", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403839, "uuid": "2ad6ba9c-321e-4a2e-b084-f6bff609531a", "comment": "Malware payload (Formbook)", "value": "d629a3f501555e81a230783f027eb8d2cb4cb575", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403839, "uuid": "bb8c6dff-8ab3-454d-90fd-47e1e4b722a7", "comment": "Malware payload (Formbook)", "value": "1ac7368135ad6ab7872ff34976d3252443abff887c120be59f2e01272d392e60104e0d5a311f9f7ef16cf61c4a639ae6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771403839, "uuid": "895acd7a-e278-44fb-ad84-e71e2ba3af08", "value": "T1A345CF0273C1D066FFAB92334B5AF6115BBC79260123A62F13981D79BE705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771403839, "uuid": "c5a7f656-241e-46b2-abcd-8b4c50720e08", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771403839, "uuid": "c47fdb6c-f2d3-42e7-b718-889f2388c101", "value": "24576:35EmXFtKaL4/oFe5T9yyXYfP1ijXdaIXY2UXDczWH45KXE4BK1FHMy:3PVt/LZeJbInQRaItUzcj0U4BK1FH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771403839, "uuid": "e109ea9e-24a4-4293-b05b-fa58f1289e26", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771403839, "uuid": "b703fea7-1de7-4140-a2c2-bc6c85bf7b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771403839, "uuid": "3da11e09-6c12-4f2f-bee8-dc9540f89a8f", "value": "DHL 702-2172026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31de22f1-0ce3-11f1-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1771430535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430535, "uuid": "4dbd47b8-95f2-4334-8f85-bc0d870dbd60", "comment": "Malware payload (GenesisStealer)", "value": "468abd3ab0352aba2af75cd9170d4415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430535, "uuid": "68fc44d2-401d-4c46-b802-5d64d2f01be5", "comment": "Malware payload (GenesisStealer)", "value": "204b8a498705e97af6b7f050646bc3e9bb8609dc1cf8f57b5f7433e12b2e2319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430535, "uuid": "a06cad77-78cb-4f2e-a993-c4198bc42991", "comment": "Malware payload (GenesisStealer)", "value": "d4eb153f930606e3f6cb59761d18649c2c719ed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430535, "uuid": "4877bbcc-893c-4754-9094-08e2e57118f2", "comment": "Malware payload (GenesisStealer)", "value": "54a149e45ab6ae6820174617a90cd93ad6f2be641295f86ca98b57f8c75c9c8cb560a84e4338a1875549bf8009fb2352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430535, "uuid": "fb985e42-b5a8-42c2-865f-b5ec5deacb22", "value": "T1E7183330BF86F81EC89DB27D5E7E126418DE24C608A477EF157BCD8E95ECA246324097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430535, "uuid": "f7062175-0b0b-4b8f-b194-384a0ae7f18b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430535, "uuid": "a26a71db-d205-4702-95c5-30a462c4e16e", "value": "1572864:KX+BWMFDe45kSzkLt/dbzLqNx6hDRzAcdT2LR7BHITe7o9z8bx/SSb9Nb9o7iO2p:KOBFle45LqXzlhDRzAET2LRV7o9U6SbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771430535, "uuid": "f99fab85-c66a-4c3f-9cab-ede0d198bcb6", "value": 88005058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771430535, "uuid": "dbc0a983-cc21-4fa5-a4ba-38442afef2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430535, "uuid": "21f127a6-60dd-4f4c-8b95-41ac93bbb369", "value": "HomuHime Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a620314-0cd3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771423705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423705, "uuid": "498432b9-5b3a-476b-a56a-004260862931", "comment": "Malware payload (AgentTesla)", "value": "9cf1009f89ce5b83c3d1fea24efb0998", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423705, "uuid": "d46a191f-ed90-4309-ad4f-a59c1d783527", "comment": "Malware payload (AgentTesla)", "value": "209465b7bfaa77564efff20fc03d6f602eeefc3bd4bde74dbc8bb0f809783117", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423705, "uuid": "b1c5ac4c-7b12-4eab-a342-d03db5c311cd", "comment": "Malware payload (AgentTesla)", "value": "46b60183b1b568446e73ea1b24b29100624543f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423705, "uuid": "807ee52d-3e75-49ec-bf39-172585947d49", "comment": "Malware payload (AgentTesla)", "value": "9bd657f10f51cbe6353177f29b43256197169c355e6f148a35e5610195485fc97a28876bc4470e0eafbdfd86d86ed62e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423705, "uuid": "8a521012-0a71-430f-a88c-4e370f32bc43", "value": "T1AE94E516E710B4A5F89349B02D78A256792D3D3A3640EC1BB78E9F1A3671983B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423705, "uuid": "26ef7b65-988d-48d5-8136-05c19c34b4a7", "value": "263f4e1ae1684e71c335999e2545c226", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423705, "uuid": "6134a7a4-fd2d-4ba6-9d9b-214fa3d86c91", "value": "12288:+lwLX7wbGQR5XfwIN5Eeiafj7SACMy6cgXfgU:Aw+GQRVr7Xf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423705, "uuid": "c4c3fb2d-451f-4240-8cff-7b6714fe47ba", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423705, "uuid": "2eea0ae8-b13d-463a-bca6-3caf49139212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423705, "uuid": "97d0e957-daa7-487f-9970-f335472083bf", "value": "AVISO DE PAGO 684563584-MXN-6636832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6358dfe2-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441356, "uuid": "50791bf5-7158-4632-b5e3-4fa32255b2b1", "comment": "Malware payload (Mirai)", "value": "7dff9fa5555b875ee3675f21fa3a23cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441356, "uuid": "8bb7429b-97a0-4c4e-9d24-2d7c49115b07", "comment": "Malware payload (Mirai)", "value": "20f631471affa36f0f2c0d79a35262ca5f0845ccdd248e9ea34be9c49c64c70f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441356, "uuid": "c1ab98da-d7ef-436a-b7fa-04be16fe19c4", "comment": "Malware payload (Mirai)", "value": "5a1889d03fd8d8e447c40d25726c3ee6249ad86c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441356, "uuid": "1540060e-3451-4d9a-84fe-d1a85e34ced5", "comment": "Malware payload (Mirai)", "value": "a9273a6970050a72d25e174f1af0d1dbb824869866c5223f51306a953a63c426c9faa5e913cd6a9a2e050098c419aa85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441356, "uuid": "0108fb8a-eba7-4d3b-a8a3-124f26378b22", "value": "T10B866C45FC0D78A2D6C879356BA252947339BC094F82C7273614B77DBAF63688F63260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441356, "uuid": "d8f9248f-456e-40a4-b4d8-16043e094f1b", "value": "49152:PSp4CMI2pDkWyGAmsBvH0YSjjsrvw+oeb+Xb+/4bRKQUt4SzbFavfovDmwoACp0q:PU4CMIGkWyjmspH0Yt4bRjUtno7/HE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441356, "uuid": "c637d4e8-79c3-4979-a193-98817fb321dc", "value": 7995540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441356, "uuid": "8ad1ce32-446b-4844-802b-8a6e3e359c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441356, "uuid": "66ed47e9-3296-403b-8f1e-fdec95274ae7", "value": "ip6addrd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34344160-0cf9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439988, "uuid": "e28fc38b-a88d-4002-8c34-69f60b4bf939", "comment": "Malware payload (Mirai)", "value": "2ed139407ba8e5891c8d683c6ddb21fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439988, "uuid": "cc0c4513-9abd-4562-adea-0973e001b7c6", "comment": "Malware payload (Mirai)", "value": "21ffd5fe4739d404b69f9dbe8c20b0f2c47193a2a7017cf556c233f933a9460a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439988, "uuid": "00288e61-bcfe-4b0d-ba4a-1f1b4bab2e83", "comment": "Malware payload (Mirai)", "value": "d93711f3371b4802cb27e79d7b1876ec5c2e3be2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439988, "uuid": "ef3e4ad6-3454-4a9c-b0f8-e30112b934de", "comment": "Malware payload (Mirai)", "value": "93a2c9dd13e62ec7ead0d0d9628b2060daa9d1ef94d4dccca7918f15132775a869289bb393168543186e5c914f714810", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439988, "uuid": "0764391c-24bd-4b3c-8525-f7f35efa24ec", "value": "T130D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439988, "uuid": "0d2a5df2-26ff-448f-ae75-9b2f333665c7", "value": "1536:UFKdzElm18uZJNb4AdFa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYTa:UFKp50yU8e947Lb71izSftBdRalKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439988, "uuid": "b9116758-7ba3-425e-b373-72e525d57ba6", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439988, "uuid": "1cb2c9e1-a545-41d5-bef8-2211d3fad416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439988, "uuid": "dcb181aa-ae91-4c4a-8715-2490bb4c7e4e", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedda950-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439442, "uuid": "a73dc477-a785-4006-ab50-34830850e354", "comment": "Malware payload (Mirai)", "value": "a28e9981d989bb56b97285008b9b45ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439442, "uuid": "86b0d48c-41e3-4676-8ede-b7c294223c41", "comment": "Malware payload (Mirai)", "value": "2234c5ad4f38df0ddb71f87a3789a2cf861f4f2bd7db843c1bd1ef591a810b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439442, "uuid": "12691a4f-0ba5-48f4-a72b-707540344d54", "comment": "Malware payload (Mirai)", "value": "e9ecbe88055e9f9a9c5c069f97d7c562d0059971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439442, "uuid": "c2932ac4-7975-4dd5-8e07-07282638eca8", "comment": "Malware payload (Mirai)", "value": "b316aa43023ab885c996a8125071b98b336b4a6dcf098df4f4d80170c9380169602e9553d484848a6008d25e3637eb5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439442, "uuid": "40854ffd-f663-4683-acda-d73606d3937e", "value": "T1BD03F161C4593E13FFDFE32D7B92A1C033E2A12B27577E1317895F824606C8A6421BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439442, "uuid": "f01f67eb-97ec-4a88-95fc-1e68afeb6063", "value": "768:MzvKZBZGZzAWyFTTVwhOJMJIeacJqfOam6pVeGb72ivgZsBXD4uVcqgw09u:Mz/dAWQYOUqmgVeUlKsBXD4u+qgw09u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439442, "uuid": "6ca2adc8-4d71-4de8-9d00-1a39fb150d30", "value": 40124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439442, "uuid": "98b5b697-9563-417e-b8d6-6e57dc800090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439442, "uuid": "c6f1bfbb-9c95-4b64-9999-0a183e06ee40", "value": "rizzx.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabfb0f1-0d01-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771443757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771443757, "uuid": "e98e638d-b3ce-4d88-b900-e241017caf13", "comment": "Malware payload (Mirai)", "value": "7ab9edfb0622fb85a1c9c8b3dec34df0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771443757, "uuid": "4737542c-fbd1-4b4d-8387-6b13a5505cb5", "comment": "Malware payload (Mirai)", "value": "224d427f05c9a4a3d58cab14236ca2e71d3b3759751c47672ba0bfd723cfc74c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771443757, "uuid": "24afd863-df47-462c-b261-f2534d914924", "comment": "Malware payload (Mirai)", "value": "1e945a779a409daf832eb0db978616a701de0769", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771443757, "uuid": "fd04f059-e0b3-4bb0-a268-710658e90a8a", "comment": "Malware payload (Mirai)", "value": "ec888560c36d79715a538c03b8172d1a2cea8259ec0a6bd1144895b594a96be3ef241a6f43720c30800e5c1313dae6fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771443757, "uuid": "5ce8f603-cf06-40d3-b1cf-5eacbe7e73ba", "value": "T1E9C3C91E6E21CFBEF65A827407F78E31965877D61AE1C685E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771443757, "uuid": "6dcf99c6-5874-4b61-9c94-2f8656d8def0", "value": "1536:tw4lPfv7d7Y/YLYdAo1OhNWHv7t9i8pPDoM1ISWlKnKevNeTh6F:7lPfDdMLdAoKoHv7tppPDoMCsnSh6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771443757, "uuid": "57904e65-9fd3-48a3-bbf1-8827baf76723", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771443757, "uuid": "d76f5722-20ae-4c37-9d5a-e5b16d2273ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771443757, "uuid": "684d5c03-0cf3-4762-8ab0-7d9f1851829a", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1bb6ec-0c9f-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1771401375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401375, "uuid": "4b88795c-bfcc-4bfa-8d90-4134b6e72061", "comment": "Malware payload (CoinMiner)", "value": "5e315e153f778c75229d0c9149adf2ca", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401375, "uuid": "92f6fb45-5445-456c-8289-41630303ed6d", "comment": "Malware payload (CoinMiner)", "value": "228d2aa4f5ba5bd3f7a56bbaf6b02520a00e57cca5458f99bc57b034b32819f5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401375, "uuid": "8987b84c-2ad9-41ca-9dd8-0aa96dd6e88f", "comment": "Malware payload (CoinMiner)", "value": "7c6976834377ecd946392f5adfa3db53d60fb0a8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401375, "uuid": "ca3a198a-a489-41da-8446-8d982f12dce6", "comment": "Malware payload (CoinMiner)", "value": "32fc6c094e441f5fed8fc2ccecb821af1667f9af46ee3f7410586796e0018d447f6589e69340496b41cd7c9756a4d8b1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401375, "uuid": "3751c905-50ef-4823-9f80-2bf7396efb8c", "value": "T16C331B36A59360FCC19BC474876BB5276D32BB9502343F7B1798ED311E60E2D26AD710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401375, "uuid": "932ec5ba-329a-4acb-a9cf-cd5e598fc43f", "value": "768:MIHlRwJ4vtvaSyedC8pkxpYgrSghD73OoUEr+4n:M2laJ4vh1LQ8expxB7OOr+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401375, "uuid": "05bc1646-ba43-47d2-bd98-b99c119381ef", "value": 54464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401375, "uuid": "70edada1-3587-4a70-96d6-b16a0ddcf040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401375, "uuid": "844572f0-1d58-4d0e-b8b9-8abdc2407dad", "value": "x6.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82988f36-0cce-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771421651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421651, "uuid": "d1450dae-79f1-41dd-9155-28c7eb4a0b9b", "comment": "Malware payload (Mirai)", "value": "a051ee63d3ce11053dcf074bc00a1b5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421651, "uuid": "875ebf47-7959-4382-9a8c-0232a3f33d19", "comment": "Malware payload (Mirai)", "value": "23052e606ffbdb6e02560f90348a42887bdad79861484930a4925d08fcf48ed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421651, "uuid": "e0aebbc5-5d4a-4155-a1f1-bb0cbb4bc9c7", "comment": "Malware payload (Mirai)", "value": "4665c7789b9eb78aefee38efd91751013886f688", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421651, "uuid": "577c324c-2e2f-4548-a902-e77d573c66a7", "comment": "Malware payload (Mirai)", "value": "d5e0979db6c9cdd136783335445ad9b0d13563b464844c508fbff25beb50e3d274268f20c9050f71a0cbe78ac683fb42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421651, "uuid": "168735ab-8626-4ec2-909c-a964ae371682", "value": "T1C3D312B38A39B3EAF461E4A0F75C338D500162D9C948A661774964661B5838F0B6F39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421651, "uuid": "8b56bb5c-7081-46e6-a463-f67ed2a87dbb", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xY:2IIKXhZtL7jOTyIG87e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771421651, "uuid": "5469f78a-3679-4785-a070-f4d756b588bb", "value": 131860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771421651, "uuid": "ba72b700-ceff-48e3-b245-aa364eaef34e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421651, "uuid": "bb0484f1-122d-4bf8-9c19-8993b3212045", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0968d419-0cb4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771410281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410281, "uuid": "438dd327-84d3-4d74-a712-ddd21fe9bf18", "comment": "Malware payload", "value": "7caaebb5da075b1537148828ac12b24a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410281, "uuid": "bbd03bb7-34b8-4b6c-b607-5b2a225801b4", "comment": "Malware payload", "value": "2476c11db262a21a2483d0ad0cbe1765f5575853ca1bafc871d742b46cca7e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410281, "uuid": "5f9392bd-c0c4-4036-bc63-54e214c280a0", "comment": "Malware payload", "value": "bacacec607a20005783b7c9348d67266a72d7bd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410281, "uuid": "0c9af61b-8bef-43f0-9c96-d88b5cd77453", "comment": "Malware payload", "value": "ff456ece1e3f52f5ce2d4d371246be7d728e35beffe9746965f586ef2d33ce9d7b0b06374b5b5946ece7edb6a3eac1ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410281, "uuid": "d9364c90-ddbd-47a0-8dc2-7c2dc3358237", "value": "T19F335B063BD597A4ED6A0A35A83347105B32FC6BAC92D70F1BC576AF9D733108412B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410281, "uuid": "b86b9ce1-7e18-43ba-bfcf-2de3607f3a30", "value": "1536:SkTfvOMlDhbC7byA6erqkSZZZ3gmfpbR:rf2MhhbCh6eRUZbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771410281, "uuid": "1e11d418-30f3-4ac3-9739-edb3d1ae8c3f", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771410281, "uuid": "f94a5072-1c5c-408a-9066-f33ccf16a621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410281, "uuid": "4d006c68-4321-46b6-be70-852151acab3a", "value": "2476c11db262a21a2483d0ad0cbe1765f5575853ca1bafc871d742b46cca7e27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaa5465-0cd1-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771422933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422933, "uuid": "f8e80aa0-ffa6-40bc-aeef-9c5054e219a3", "comment": "Malware payload (Formbook)", "value": "fe1d245b567db899b3025236d56ce244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422933, "uuid": "47a0308d-70a4-457e-858d-0e525f913cbc", "comment": "Malware payload (Formbook)", "value": "25230a687002161160427e213dcdd2a17ae50d9b3ba9679916e238b55b61a6d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422933, "uuid": "85a36f3d-9779-4368-b4c2-3e626dee8ac0", "comment": "Malware payload (Formbook)", "value": "1779ead37606da75db388e6559e9f3f14818e041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422933, "uuid": "1cc2ab87-acf7-4dcd-96c4-42ad87c22e2c", "comment": "Malware payload (Formbook)", "value": "9e5dae8a47de7257342a986a2fa4f0e5f598087aacde45868d2f9a0b3967e399f488f19f3d6a71b1e908861d0ce72ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771422933, "uuid": "c1d85c4a-b0e2-4378-a8d6-a7bf687a9316", "value": "T1D125226C2715DE03D4952BB90C30D135137E5EDCA052DB569FE2BCEBB83A3E4288079A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771422933, "uuid": "74c1d12b-936a-403d-a7f4-9989244d3710", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771422933, "uuid": "fab2583e-e2fb-4df6-a025-8e4841060e76", "value": "24576:DGa7BLGRZ9vQifXdDd2nL2korUwUa/WE:b7B6RHQ2p0xEVUa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771422933, "uuid": "6e6fcffd-2798-4311-a91c-9eba178a7ae9", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771422933, "uuid": "5c79a831-705c-43e3-ad09-703af6435926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771422933, "uuid": "b9052396-71dd-4791-952f-1a7e817a2b2b", "value": "payment regarding sheipment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79171f64-0cb5-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771410898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410898, "uuid": "73799d7c-0b1e-44b5-9dec-dcf0cc1ec125", "comment": "Malware payload (VIPKeylogger)", "value": "6f0172d657bc65accb3e1e90a8aad245", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410898, "uuid": "c1a1816e-db36-43a2-b862-95e275b1bcf7", "comment": "Malware payload (VIPKeylogger)", "value": "25865e1ebc1996c6f5f2c28b81e49bd2bc832a7f9be403c93ae433eaa467ee16", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410898, "uuid": "c84cd986-40fd-4b8f-9423-ff64b43c484b", "comment": "Malware payload (VIPKeylogger)", "value": "61269b6d5db44fbbacb63f43aec60809c784ee49", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410898, "uuid": "f73094c8-0f6a-4c95-ba75-0af2748c8f5d", "comment": "Malware payload (VIPKeylogger)", "value": "fccd67400d64912498722136a71dcec9c5bb1532cee1e85bf8fb33fe4e68d5135b8258f6273a9632703ab6ac324ded34", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410898, "uuid": "208d1003-5af1-4019-b0d4-b40292dddfad", "value": "T1CB413C9555D408DF41711FD4C5D999921C593360D121112F0EB50BBBE5D5B3B328E12A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410898, "uuid": "7c25d328-1fb3-4e41-bc3b-d2b828cf055f", "value": "48:X8STSDZqeKtgBAFjlcFAb8nNtSrJunkhFSxyvcb8m7o3nPLR:fTSVq1+AFjxoi8xyvctG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771410898, "uuid": "5c31eb8f-ffe7-49f4-8832-7e739ce9b28a", "value": 2160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771410898, "uuid": "7911d46e-ba22-4b9a-aafb-a5f23b170cab", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410898, "uuid": "8767e9ce-e13e-48be-b65b-549c609d0b1b", "value": "Stampa Ordini a Fornitore 2201 Ordine 14695000.Gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedae955-0cc7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771418746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418746, "uuid": "343161a8-0379-4a8c-ad2a-ba1751eb9b6c", "comment": "Malware payload", "value": "375d5643bdc899eeceb3cb5929913464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418746, "uuid": "795dfe3e-a005-40c7-9008-7bfc643b85ae", "comment": "Malware payload", "value": "25904daf561ce65a1d3874f994201b4caa88d4c0fcda715334147025cd78efe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418746, "uuid": "8dcbd0b4-f4d4-4d7d-8553-fe64339ede2f", "comment": "Malware payload", "value": "4500db943c894d45af819c821a6b1b67ac361e62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418746, "uuid": "2b058750-9bce-4e19-961e-f493b7c7b342", "comment": "Malware payload", "value": "b1467bcdb0d6cbd55267fda26d3a114b4e2bbc0b449dddd05d5988df8f045fa27bad508ac1bd05dcd279bbfc5df7f2ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418746, "uuid": "38a28abe-39a3-43dc-bd85-c3aeb39b7e32", "value": "T173D37C5B77A425F9E0B78278C9610A46F772B83617209B4F03A443766F332919D3FB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418746, "uuid": "b9b6048c-040b-4281-859c-795ecf84ba22", "value": "656778eaa7286796720a7dab74c47276", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418746, "uuid": "7805c62b-66f7-4a7e-a061-5a9484465084", "value": "3072:wjaOjehQSVqne6IIqiHgYQ9vXyqxvbPJdj:pOjehQuGOWgYQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771418746, "uuid": "a1e317f1-c4ed-4cb9-8a56-120313ecacc8", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771418746, "uuid": "14814777-0aff-4910-8d2c-494f666a708c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418746, "uuid": "50ae4de3-8a61-438a-a588-5402991de906", "value": "25904daf561ce65a1d3874f994201b4caa88d4c0fcda715334147025cd78efe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6068e25-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439428, "uuid": "fec326ad-b788-479c-82c3-a1cf5b617301", "comment": "Malware payload (Mirai)", "value": "a16a970fafe58f8c5e42c6929fa2820e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439428, "uuid": "02ecb04e-5528-42e6-a147-3a077a9fbbba", "comment": "Malware payload (Mirai)", "value": "2619a10770b6735120ff951145cbbfdc349a1c93557fdf997a56c72f05bff4b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439428, "uuid": "549e35fb-616d-4955-ac4b-e957faa57c99", "comment": "Malware payload (Mirai)", "value": "ee2acd31d057f03ed3d04e5fdcb14e5e8b1d03cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439428, "uuid": "a902a397-c2a4-4ebf-9bc9-f0897a66da8c", "comment": "Malware payload (Mirai)", "value": "b96e9492c383fd7a9545006ff524148bf8ca2ba9e02f4f06fbe946b8c2192ee78b7bc15c5b5b7fade596dbb8a60734b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439428, "uuid": "97d0fb4b-529a-48c4-a88e-b0eb1ecf392a", "value": "T12113E1DDB17070F2CDFD747FB4A6C3A119807382E6FDAF986B224491A656D96A0CD830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439428, "uuid": "de6793a3-e713-4cfd-b50a-53c114050d56", "value": "768:Kx4mYFFkS3n06sFREWfY1Zc/Yw6eHLCbrOByCIWu0/q9HM6TwUWbkIiOCU2iVjWV:KxhYHkS33c//6eHLGzZ0y9s6F1ZO2iVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439428, "uuid": "0d4bffb6-384c-45ab-9c45-3ab2ef3f7603", "value": 44524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439428, "uuid": "8d510f52-de45-466e-9a5f-17f12baf40ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439428, "uuid": "81020984-e785-4b20-9808-12d985905b5f", "value": "rizzx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a74a64-0c9e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771401177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401177, "uuid": "cc8d00cf-0659-4d50-b159-4b3231ee5c62", "comment": "Malware payload", "value": "219084deec1723638853016e5f928106", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401177, "uuid": "73f35c96-0259-41df-904d-17ac0a59cbd4", "comment": "Malware payload", "value": "2723d3a34c974c8ed69d900f41242595439a3a67e90b7fae04d36469df61a1ca", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401177, "uuid": "eab89e9f-4fbf-4272-bf76-4063d0dfb1fb", "comment": "Malware payload", "value": "27dfd13076e13bb4d234fcdbab7228911ce0682e", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401177, "uuid": "797b1f26-4209-44a7-a1b8-7e18ed1742c3", "comment": "Malware payload", "value": "d8870b3bc4ebef7ae7edff61e617ee9e29a8412812eca349f9c021db288725cf5c8247ed0d88ba4c9b4e6202f8c55a20", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401177, "uuid": "23ecde55-fd45-49c7-a098-805b2296dacd", "value": "T1D7C41224B381DA6FF0671A7649D62156529CFC226F83CB8FB101733F9E73B90B226651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401177, "uuid": "92bdea4b-a579-4a98-b679-9d0e1a199812", "value": "12288:b9Z1MTDjb64PtsiOmdUw4SjKaGbc2W3fUNXzBjc:b9cni4PfOmp4CK9c2Cf4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401177, "uuid": "d267225a-e090-4b84-8005-b4e1cef6281c", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401177, "uuid": "a0ce923d-74fe-4291-9172-658467240187", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401177, "uuid": "28006b09-0584-4154-9f4d-11d57b1b4ee5", "value": "Transfer_Advise_021726.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d7ed10-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441363, "uuid": "61d3cf95-e694-4c54-8b05-a757a1f1fa34", "comment": "Malware payload (Mirai)", "value": "65918c4a7a827b3a000c12eaced23cc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441363, "uuid": "34a46e96-3ef4-4a41-8e7d-da8e5bd21f54", "comment": "Malware payload (Mirai)", "value": "2796a4106e4670f5daa8c3400fbe595e98ee9148a5a882107af553c0db24a230", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441363, "uuid": "a96a6186-a1c1-4cb8-b5d4-0f3d68bc0488", "comment": "Malware payload (Mirai)", "value": "cb0dbf8badc47546e1db12543f68b623ed802f5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441363, "uuid": "eb82aeba-6d59-4b9b-b1c0-bb078080aa2d", "comment": "Malware payload (Mirai)", "value": "b0251740d985b5e81e929b4bafdcaf5bb3136cb61f2d0bf932ed78810c9be8bd969ac37cd2aaa0e5450016dd1553ceba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441363, "uuid": "a801ee95-41ae-462a-97cc-6bbb09264b74", "value": "T19286095BB8924942C5E83A77B8BD80C432631EB98B8756576D05FE3C3EBE1D90E34364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441363, "uuid": "c05b3846-933e-4f8d-8e21-ba2805612af1", "value": "49152:FqkID+8/dBPnIWgg0pYeKOLnbi/hs5FAgyrih9MSSgT7cM9Idrxmq3xG5EM:EkaVBPIWgphgD4z9IdEq36EM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441363, "uuid": "fbda0727-0e5c-4089-adfe-185e433bd432", "value": 7995540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441363, "uuid": "3e9afb2b-96d2-45c6-b368-f212d2c0d7f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441363, "uuid": "2411f43f-e9bb-43a1-abfd-ae0b55d2f394", "value": "kswapd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26df698f-0cfa-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771440395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440395, "uuid": "4d4dd0f3-16af-4f98-8eaf-dabb7d7f949e", "comment": "Malware payload (AgentTesla)", "value": "3b2b581730cd31274e02416337c7843e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440395, "uuid": "15ec62b5-2c00-4bc6-9e62-1f53b59ff68d", "comment": "Malware payload (AgentTesla)", "value": "27f5ef50f73cd8551aaa10097b6cfb5014205b89003c47ef5985d35397b9ba87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440395, "uuid": "d3e4069b-d84d-477b-9757-dd123f1c414b", "comment": "Malware payload (AgentTesla)", "value": "d4518e2672ef664a87db18ebe78b7a0efbee4616", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440395, "uuid": "fcfe0c2f-5fb0-4cfb-a114-7937332da7d2", "comment": "Malware payload (AgentTesla)", "value": "dd4c681e5da27989da598043cbb90c749a0afe3b92538de7336e76573d68a99a9f359b0b5dad4e1bca4cba5125361866", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440395, "uuid": "71cdcb8e-b318-4289-a4cb-5fb2886f88e9", "value": "T121252331FA06AD640BACA01915BBD90C697A0B6B4D1D33567FDC40AD1FAEA9F04763CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440395, "uuid": "8df2db17-1d98-4b79-9263-49d44c882102", "value": "24576:v3bs/l2oRPvXKUNmc+1RSiHzUhj4pCKgNI1RzRF5fvERU0:vbEZPIDTupXdIL9yU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771440395, "uuid": "a5812d25-7a69-422b-ba18-197e30adc068", "value": 1033061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771440395, "uuid": "6d417687-377a-4e14-8ed2-5f66b9471ab9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440395, "uuid": "2a1a8b83-fb11-4b5d-93a6-7c3b91f05147", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ad3aaa-0c62-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771375410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771375410, "uuid": "d7b5f2ba-5eda-4474-9df5-76fc09b18dd5", "comment": "Malware payload", "value": "51c0a8b540942cb38395b7c02c61d185", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771375410, "uuid": "6f1dc398-a5a1-42bc-adaf-65f75e89ddec", "comment": "Malware payload", "value": "28012ee3c06a25a8209ca3eb5fb35166d45488b279e43bf8e2b507f515bc9fc0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771375410, "uuid": "05aa8dc6-9ab1-4fa4-a5f0-e4a9ff37819b", "comment": "Malware payload", "value": "d5c8b43647a19d53631847ae14bc76258e540baa", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771375410, "uuid": "425ba241-6414-46f4-a744-883f69802924", "comment": "Malware payload", "value": "93c66fa1a33ccd1ec5ec5d2e4134433e0638edaaa166269f064210269ebd42d1868003b7cec492b8b794e44785957705", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771375410, "uuid": "e7060bc3-600d-4e95-b78a-8f0fd6b79495", "value": "T18D764B07ECA505E9C1AAD2358A779122BB717C495B3123D33B90F7282F76BD06EB6350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771375410, "uuid": "6e29bb6e-2fec-4a56-8bcd-04d33a63d5a5", "value": "98304:T2tzY+NvvbsKCCN40GuVEqI7jU2ZRK9cislE:ToNvvAKCN0GUA7VK9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771375410, "uuid": "c39037fd-cb5b-4057-bc93-2b91c84f8902", "value": 7465984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771375410, "uuid": "cb056c1d-2c06-40da-b7ee-483b33c3f522", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771375410, "uuid": "abbc1546-2e8d-460a-a5ac-0bd3aa4e8a0c", "value": "SecuriteInfo.com.Heur.23825.10101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0c9972-0c85-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771390257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771390257, "uuid": "7c741333-7b0a-4934-85ce-87b9aed3b653", "comment": "Malware payload", "value": "49fdf70c7dc03289836b96a9539e84f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771390257, "uuid": "adab8bf6-5f7d-48aa-b418-a67c1f0524a4", "comment": "Malware payload", "value": "28b0d22ab17de726967a08c4d1896e61b0a2127f1454f11fa12a87af7ef9c791", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771390257, "uuid": "720e1fdb-beb0-4e22-a6a7-33546d600c35", "comment": "Malware payload", "value": "400582b808adb9edec6c53d035bbdd38ec2f4a49", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771390257, "uuid": "ebc79553-3600-4488-98ae-21df684e9453", "comment": "Malware payload", "value": "baef2a6e9d86489540880bf18513b6dba1a4a4ce8aa5600bfa2e0691f7d943cd487eebe7a66dee6274b4f39d7756a8dd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771390257, "uuid": "41bd7009-d167-43a9-bf70-bc88390ef62e", "value": "T1FAA63363A85AE47BEA15D77BF2D44296823438A3D66333E6FC4F035F985A36CC346844", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771390257, "uuid": "9f31f6ad-1bdd-4d4d-880b-f46c333cfda0", "value": "1b1200024dfa62b9387b913b3684ccc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771390257, "uuid": "d47bb2bb-d3a9-409c-9e0c-94c406b5cd34", "value": "196608:44z1BLaQN01lSZuS3cXBGYE9DQYhCSvT2NvV0TVarGMzsaa:lzyQulIuyOaD8NrGMAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771390257, "uuid": "378f1589-ffd6-4b25-9a77-e45cc774278d", "value": 10058768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771390257, "uuid": "f128bc78-984c-40e8-8af1-47645b17fd52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771390257, "uuid": "979a5f04-8297-4def-bfd6-1e32ed8eda05", "value": "plugin_protected.asi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d6a112-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771423348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423348, "uuid": "8f11a8c3-dd3d-4ef7-b2a8-fb831167ff0a", "comment": "Malware payload (QuasarRAT)", "value": "90b897e82c4700a731a4d60a9962b1c2", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423348, "uuid": "1672414b-6402-43df-bbb7-6094b95fba15", "comment": "Malware payload (QuasarRAT)", "value": "291c98d0481c0e20999891079740ff00a07aa21cf67f126b88beb6810c0aa999", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423348, "uuid": "ffc51a4f-c09f-479d-92f7-7a3d68d05ab4", "comment": "Malware payload (QuasarRAT)", "value": "de84492a8e7f2439e64ceaba59e95cb02acc8c13", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423348, "uuid": "8c3be344-12ec-4d47-8834-3e00253fdd16", "comment": "Malware payload (QuasarRAT)", "value": "305b7fa2ec17bc4a51f6bd455b03b34347f18d548af3cb2b1f2cd3258e9d82ddc2cad2596a78ee0c93f652cd253a8df6", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423348, "uuid": "c2553bf4-533c-4a7c-8cab-619fc76eb47c", "value": "T1B5F4BE1513FC6AA8F6FE9B3C5779101047F2F816C722DB2EBD5A809D5821F82DA52327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423348, "uuid": "ff9445fe-1cea-4e1f-a799-53ae9b049253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423348, "uuid": "f10c1133-163c-4174-a5a6-ee21bb6057a5", "value": "12288:H9Xb4q1FOwtCD0j8zMiHmE4a6f+18g+MZsTi9/6i1ZrInvW/tkUhJZprohLLB56r:H+u8+C5rHZ49fWZsmp6iLkvD82xFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423348, "uuid": "442bfa44-cc7c-441e-9b41-7b26135b47eb", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423348, "uuid": "f198e961-aef7-4b28-9903-d75c2602cce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423348, "uuid": "205bb980-7c87-48cd-b225-0b9aaf2a2230", "value": "291c98d0481c0e20999891079740ff00a07aa21cf67f126b88beb6810c0aa999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2e9ca7-0cc6-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1771418393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418393, "uuid": "a7943b90-4059-4477-a989-524f001d168e", "comment": "Malware payload (ValleyRAT)", "value": "6315faaecbf15b5c492846f19e40f2ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418393, "uuid": "b0c80a09-c1e7-4963-a8b7-1851759be362", "comment": "Malware payload (ValleyRAT)", "value": "2aa4685361b0ef1ff241e0e9b94d21527d61530d56a59649555064c5b7decc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418393, "uuid": "65b223b4-9af9-41ca-9f36-184f12ada169", "comment": "Malware payload (ValleyRAT)", "value": "3cb178c671afcff480a94c91cac45b4dcea81cae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418393, "uuid": "304386a6-ffec-40ee-be39-11dae4264601", "comment": "Malware payload (ValleyRAT)", "value": "2a48ea8ae16ec7dff6c96a14818970badeefcc82306de60ef4334d8760a31722119b8813fb43324c2744412e2ab9761c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418393, "uuid": "75b3561d-d541-4f67-bc1c-0a40970970ca", "value": "T1FC0833A4306AC925D4BAA476BD82E7887DDC48C4C10EDF3AD757FD3C09502E2B17B91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418393, "uuid": "505c3278-48fc-460b-808d-07be1c3c39d3", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418393, "uuid": "801c35cf-16f8-4eba-a2e7-d7c3c0b99340", "value": "1572864:nY6z+xEJOzsP3KrcJN4mo/KBV9ggLwiUQxdvtPWVOCmW3HjRqYI:nYKSwOm3ecYmoCWdiUQxdF8X3kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771418393, "uuid": "eb95ac9f-af08-4f93-b43c-9299f25b8cf5", "value": 78570191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771418393, "uuid": "54dd75ed-7557-4ed9-aadf-95479e8b82e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418393, "uuid": "9224d3cc-0894-4fc1-aa2b-3492e50cb3f0", "value": "2aa4685361b0ef1ff241e0e9b94d21527d61530d56a59649555064c5b7decc80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d2d22b-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439452, "uuid": "30b63df5-75e7-48d8-98b9-3442ce924692", "comment": "Malware payload (Mirai)", "value": "057d19cf74a22fb79b53f10e73fa636b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439452, "uuid": "3e191062-c62b-4b1a-9f97-86e6f53490c3", "comment": "Malware payload (Mirai)", "value": "2b561039bbdda69aef953b1456b536075837d0c9faa184b434ea1f18b382300a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439452, "uuid": "93e607f2-f43c-48ae-884f-747c62a89bf1", "comment": "Malware payload (Mirai)", "value": "8294df9d06fbecae0856da8efa328af853035888", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439452, "uuid": "9c0293e0-2a60-48d9-aef1-3f138a5f68f3", "comment": "Malware payload (Mirai)", "value": "f89f2f0cbda30d3a017de90beae91a8b4ec21ec01abd86878c618ca954d9ebbfbaca1c69a5c18bfbd83c2b8dec2b196a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439452, "uuid": "f8c1d657-dd08-47cc-8b6a-f3a853ac4615", "value": "T106934B45FD819A12C6D5137BF72E228E372663A8E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439452, "uuid": "f9342286-edfb-4725-a753-e0d83d025b77", "value": "1536:ZOJ4bRG1h3MF8qyMgcb84PlLs/cuOXffdPDamvxq:ZOJ4b2h8eIs4PJs/OPrxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439452, "uuid": "0057d86d-74e0-4c67-a4b4-9f0dfa2bd88f", "value": 92244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439452, "uuid": "0d5a94df-fa45-427a-b4da-a6854a66b356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439452, "uuid": "f38ba713-689b-4e55-a1dc-6f1b11e4da40", "value": "rizzx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef300840-0cc5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771417968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771417968, "uuid": "d55eb73a-3da0-4194-b0c5-b8ab1799b6d3", "comment": "Malware payload", "value": "edde58c71003ff88b4febc0a91f2980e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771417968, "uuid": "b09173fb-dd17-4e7d-b1a5-b8b2ebf710ec", "comment": "Malware payload", "value": "2b66fbd1a5b5ef11919b1d979cbfaa8e1b203085ad1934ca11960106a8e94f84", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771417968, "uuid": "f434ff89-567e-44f4-ab77-70baa35712eb", "comment": "Malware payload", "value": "f014678f1381804325d8691115819e99d3f4de23", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771417968, "uuid": "241c500c-2c16-42a8-971b-65211f136f2d", "comment": "Malware payload", "value": "ccc557b5d84c2b2c79e08a51723a917cabecf85fb3dab228e59245bedfddfe9617bb01f1bd37770cdddb79804c6d968c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771417968, "uuid": "459344cc-a9f0-4f18-b4df-5927647302e3", "value": "T1F0E4C897F1208AC7F44FDA7F14904210AEF0E4704607F2561B6E885A6FEB9C89F653E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771417968, "uuid": "7b7f134f-9dca-422e-a9f3-72d8688b84a5", "value": "6144:S1eMX5Uh/W94gpr2TgPjhMoMub/hWJBemIS+leXBGJ4OU/UIOl/1Pp3x1Zzz:ShLhSbmd1/1lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771417968, "uuid": "84b7d1a7-1915-4f60-a2d4-703d2727d1b0", "value": 702380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771417968, "uuid": "787f7bcb-1130-4945-96fc-fd772136dba3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771417968, "uuid": "bb2b1438-87cf-47ae-94c4-2d697a0b11fa", "value": "Lifesteal_Net_Dupe-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43bc834-0cdb-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1771427426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771427426, "uuid": "771a4317-289a-4a8b-b41e-f22da0aff1e0", "comment": "Malware payload (GuLoader)", "value": "3238874df93198525df1c1a03cc4b75e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771427426, "uuid": "0ad8e5e8-7d8a-4c78-9493-96906909d885", "comment": "Malware payload (GuLoader)", "value": "2babb5268496a4b5231d8d58e3f84ebe220ab2ddea277ec9910bdbdffb572f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771427426, "uuid": "9c2202cc-f7bd-4b9c-bac0-65a319bb55cb", "comment": "Malware payload (GuLoader)", "value": "498b7141a37239f11edcb5f477a5c62f2dc167b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771427426, "uuid": "d0d2a6aa-2568-426f-8138-7413e8b5fc90", "comment": "Malware payload (GuLoader)", "value": "b22da4d3d924c037477b39ffd4fc9d329e0763d4031ba1e0d155a56f1631bb344283155c63da15a632cf89f37d3f64e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771427426, "uuid": "5a24ecb8-1a8d-427f-98cc-46b90fc263f3", "value": "T1394412A5B270D4F3D2735BF09E731A779BB9EF14129146833B45BB2E7C37A408A4A502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771427426, "uuid": "0594cdac-e917-4720-8bb9-c1a613986998", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771427426, "uuid": "93b823dd-e481-4481-918c-7cc94e9d88d2", "value": "6144:kcBvWb0Pv8SNUzKRdCb1J49OYTczmB/doLcPCkT:tO0PESSK6xJQJTnxifkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771427426, "uuid": "1e6f627e-7e31-42f0-a5ea-abf5317a7a69", "value": 275575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771427426, "uuid": "4a935cc6-829d-4aab-afdd-2c6ae3ab263a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771427426, "uuid": "06992eed-98e1-43c5-af36-cc9b6d03e88a", "value": "Payment receipt 2.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abe319a-0c9d-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771400486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400486, "uuid": "2d3b5f48-4cb0-44cd-956e-1072de5b7b6d", "comment": "Malware payload (QuasarRAT)", "value": "b971f1f8dc4f8f326a3c1c973834626f", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400486, "uuid": "fcc29531-4788-4788-a451-737340678522", "comment": "Malware payload (QuasarRAT)", "value": "2c03efcf8673a901a4d51f24e3d4f4ed698f9b4782b53a8c254dd1a1a00a2604", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400486, "uuid": "65c0875c-7d75-4445-9fae-7d571bdb0bbb", "comment": "Malware payload (QuasarRAT)", "value": "920b1da0d958f92196df9db907fccac5f5e702c3", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400486, "uuid": "4ca8467c-b542-44c4-90a9-09dc0226f81d", "comment": "Malware payload (QuasarRAT)", "value": "248c83c1137f3ddfc543acd5386fbb6761e1c22d8f733f481b0afe2f854f7dde9bb114d5289b633d98df13c272a738ab", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400486, "uuid": "b8718b63-dab6-4861-b296-adc74cfed285", "value": "T1014623393D821415CA680BFE8026D9C537F1E68B6706C36D7BED01ACDD53B4B9B2B624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400486, "uuid": "93a85312-0b86-4543-a0ca-c296eea354f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400486, "uuid": "32e13f46-1b2b-4257-a360-107434724711", "value": "49152:7LzswaoVnztqNusJtW8785c/t4itGkV7vhB109Q6K0Xz7gk7YoN5Z9A2AY3WkIP5:xRwNuAWm3GMvD+dHLRd9AdY3WkYSyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771400486, "uuid": "d38237c6-782a-4f6a-a4d1-68235e2050fa", "value": 5626880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771400486, "uuid": "e058e568-15b1-4adc-a7bb-218bd885f083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400486, "uuid": "f0c70645-3dca-4f5c-835e-238d2b022b0d", "value": "2c03efcf8673a901a4d51f24e3d4f4ed698f9b4782b53a8c254dd1a1a00a2604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6455f9f0-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771406568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406568, "uuid": "0a422ce8-955d-46b4-89d0-879a669c1105", "comment": "Malware payload (AgentTesla)", "value": "23c731e40ea74253b2946a4649d323cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406568, "uuid": "aaef6fd8-e546-48cb-854c-78d200dc459c", "comment": "Malware payload (AgentTesla)", "value": "2e23dece0c0e8483b8e65861cb89560a91e3e5736e5df0f247e504a3494fecee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406568, "uuid": "235174ff-1152-42b2-99e0-004c212d8a38", "comment": "Malware payload (AgentTesla)", "value": "42c1c0e2ac55e3106f43fd1c052c6e9f69192a2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406568, "uuid": "845ffd6d-7164-4cd6-916a-dfbc0dfa9a08", "comment": "Malware payload (AgentTesla)", "value": "b1a4f1865fbfeaa218d5da6446354d52ffe58c22b7b34ec180a6dccd54a078507bc18fd47bcb551dcd40ce8053f2cdb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406568, "uuid": "36a3987a-732d-4a0b-90df-ab7836b69ddd", "value": "T18B45121894C21558EB2254AB0D75F7DF7F8B0143D1BF07CADEA86BF2605319D5E26D10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406568, "uuid": "f505ad02-f5a1-4502-8dd2-a95d6be63242", "value": "48:nFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFG:Vd+2Me/nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406568, "uuid": "da0f0c52-f4ed-4ae0-81d3-412976da60ca", "value": 1174509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406568, "uuid": "d346c7c7-890f-41a1-85a0-f79c1c488151", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406568, "uuid": "f0c8c843-558f-458f-8ab1-83c974afa2bc", "value": "Orden de Compra - OC 040215 pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034c2b98-0cf8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439477, "uuid": "7832412a-5289-4fe1-b033-6e28dfc9f9c5", "comment": "Malware payload (Mirai)", "value": "d5fba7f2e60c358a43601584ef79ae1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439477, "uuid": "f50bf03c-d68b-4e6b-b264-59aced1ed751", "comment": "Malware payload (Mirai)", "value": "2fdea35950d735f2f97a13f7189d7951ae9d27c5ae504448b1ade310edb8e5b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439477, "uuid": "8592ba97-2b10-45b8-ab0d-2340e0411c19", "comment": "Malware payload (Mirai)", "value": "f45c34837f6487345940e860a254529220bf22e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439477, "uuid": "982a2fd9-ecb2-4d3a-92c2-312c3c0b3bec", "comment": "Malware payload (Mirai)", "value": "ba70a10ef13004e697eb9afb546d5330937ad769e7f6ef577c239b6e37e4623e22a75047247346de72c0bba08ee50707", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439477, "uuid": "9b708c3a-604b-4bfe-9603-3f7394736fbc", "value": "T1AF03E19644D01A10E08EA73D84BF7A891568CB8D705858789F49CEB3ECC9F577B1C0BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439477, "uuid": "9f1b4e76-d389-4bbf-b1e3-e0a771633a0f", "value": "768:jpD441TCCHW4bGJqaOFwdsfOIytgOMlgj3dlbFQm7c9ES5SEI9j3nbcuyD7UHQRR:jpN5CIbamirtZMlY3dlbFDc9ECYnouyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439477, "uuid": "0a5cd06e-75b2-4758-9e36-e9b2b0ea4c23", "value": 39684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439477, "uuid": "b781f24c-16a6-4ece-a76f-da48a051c77e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439477, "uuid": "718bf663-a68e-4a29-8a69-30b626ab6f13", "value": "rizzx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b1107d-0ca7-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771404801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404801, "uuid": "89b2dca4-44cd-4600-90cf-51b89144539b", "comment": "Malware payload (AgentTesla)", "value": "db108b2063b57330f671b2ec61523375", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404801, "uuid": "4536ec82-891f-44d9-ac25-0dd844c40f2e", "comment": "Malware payload (AgentTesla)", "value": "2ffe48aeccac20c38afbff6021572ac8200e07626e54c80e9b234586405fad57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404801, "uuid": "3bec1cbc-8604-4fad-8759-5463378fda75", "comment": "Malware payload (AgentTesla)", "value": "12844e26673252abd791179df6b2565c7d61e03b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404801, "uuid": "dca540b6-3562-4e7c-add4-c1f11fbe9724", "comment": "Malware payload (AgentTesla)", "value": "0866185cbf158ff3f4acd8d3f9f91cbe3d2c9ea03413a09b4506b13c68019a5e03b5906d575db0f8dd477669c1f5e21a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771404801, "uuid": "a35bdefd-6522-42e0-90fa-343bd7648aa8", "value": "T1E603958D32D7B075562F34272C57B0D6762ECF9CB00CA524E66A6EA0F8B431DC9BB464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771404801, "uuid": "ebc8ba0b-9870-4c9d-a710-94c0c413a26f", "value": "768:5/Hd4/Go1m1vWSYyYbWZ6HaZ1/Dh57E7zRdlrW0ea8DrXhtSk/yAVWoW9ySxkcH:ZBvWUhD7/Dh5I7zRXkDrXhtSkfVL8db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771404801, "uuid": "f5e6866c-0fde-4cf1-bddd-d3791f6d5dcc", "value": 37785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771404801, "uuid": "af578aa7-5ba4-4a7b-97bd-655cad3dcb39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771404801, "uuid": "d042117b-3431-4c78-8b4b-fee2667a9e7c", "value": "Product Information.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769333e5-0cf6-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771438811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438811, "uuid": "6bf829c8-96c1-4a57-ac08-f5940ca9309f", "comment": "Malware payload (QuasarRAT)", "value": "0d22c24b833942ffa0d953865b55c726", "object_relation": "md5", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438811, "uuid": "9e752bdb-3645-48d3-82bc-548f73c9091a", "comment": "Malware payload (QuasarRAT)", "value": "303ef2f8f028c4ff2892f4775c7e304a1d5588945c51c6941233bba3423b41fc", "object_relation": "sha256", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438811, "uuid": "26829d3d-ca02-44ac-a449-edf3177727fc", "comment": "Malware payload (QuasarRAT)", "value": "e5808ec66f5d4f69d705d05d7756eaefbc5897e6", "object_relation": "sha1", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438811, "uuid": "4c32e802-273c-43df-9b81-2dd91c4e692c", "comment": "Malware payload (QuasarRAT)", "value": "d550d7620ab779477e0bef29ea9e5a27d8a40414a418e630cf7e469eacefefa5b441fccd73766c4dd2d91c4c9316de3e", "object_relation": "sha3-384", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438811, "uuid": "af7c1d81-1ad5-49c1-be08-d527548517d7", "value": "T106557C22FA0DB046E71344702D79AA2DBC265C391545DD0BB6C6BEA929F25C3B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438811, "uuid": "75100f2b-ba34-45a0-86ac-8ff406bfcc58", "value": "a1e4185320596f7bf2a6f16a4117aef0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438811, "uuid": "82356117-0bbc-44a1-9eda-c8cb1bf9447d", "value": "24576:7XVfFfO/oHzUtq1mRM5txh2LWTg+XZ9efP9kntRsMndxeLCfpDDkk:7FtRHzK3M5TTXZQfP9qtRHlgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771438811, "uuid": "d3d8f6db-e420-4879-b3f7-79ef6bcf2818", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771438811, "uuid": "742cb0f6-c4ff-4a93-a729-d789df04f7d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438811, "uuid": "fe546f78-6024-43b9-81a0-8a9c0a4e4cf5", "value": "303ef2f8f028c4ff2892f4775c7e304a1d5588945c51c6941233bba3423b41fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b0abd4-0c66-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771376853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376853, "uuid": "cdfe49cf-90e6-4e14-9699-5065e37f32d0", "comment": "Malware payload (Mirai)", "value": "693ff3d4eff3011f2c239abc4f01b3ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376853, "uuid": "7308f81f-b983-457e-a42c-c55ea994ba8c", "comment": "Malware payload (Mirai)", "value": "311b1491faba218851f9041547a4bc6bc9fddd28076e5f6a508b74d78a68b4b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376853, "uuid": "b344d98e-6b41-4291-abe3-3c818aa52b9b", "comment": "Malware payload (Mirai)", "value": "e4101d289da671c2be7c9628ceb14946c52a185a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376853, "uuid": "93da7c92-ec86-47db-ae07-70e1c38b49c9", "comment": "Malware payload (Mirai)", "value": "267905b6e11159bb737b8fe42679ba05c88d401dc72f24cc0beba218f5611a7e3c6ed60c9c928f65c7a53ef49b076bf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771376853, "uuid": "151186c1-75c4-403e-854d-809ab246696e", "value": "T1DC045B47EEC90EDFC457CEF046BF836B19E356AB8CD1A1F5447C8C0C795928A86A3648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771376853, "uuid": "b76b8057-5520-4a7a-b5f5-de7cebd8d8b1", "value": "3072:B94IQupDehF6EAjwdqQmFk4HYVMQcQ1u7lKn6aS6Cr4PnfjsG31Qqjt:/4IQ+CH8HYVJClKn6aVCrEYG31Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771376853, "uuid": "e45332a0-14ea-4dae-ae65-80f79f96fedd", "value": 184964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771376853, "uuid": "7d30a0c6-faa9-41ee-968f-6c19369af122", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771376853, "uuid": "f92d883c-8bf2-4c0a-a2be-ba7642a92886", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc05729-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771406824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406824, "uuid": "ab003165-c6ca-41cf-b7b8-85cb3461f9ba", "comment": "Malware payload (DarkTortilla)", "value": "c4dc7a350a0ba324ac638c49b6261eb7", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406824, "uuid": "a209d352-6f1c-48e6-baa8-c7f796682385", "comment": "Malware payload (DarkTortilla)", "value": "318e9982c61601e95d9b2d9ccbd5e2e02c33d740b73752b87426d65ceaf1e0d2", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406824, "uuid": "35d5f90b-1511-4aa8-8c1f-8313f0423eb5", "comment": "Malware payload (DarkTortilla)", "value": "d6c33d33cbb6c92833484fb5e24baa073df75d01", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406824, "uuid": "5ee2c18e-b464-4c1a-89d4-90ad8015012e", "comment": "Malware payload (DarkTortilla)", "value": "9aad6fa56256330eb627754a1af4749a430a019630e2dbce32046fd3e9a5a8e57ef37ee276704e886c8238c5e7967bb2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406824, "uuid": "9857eea9-dd4b-44ad-91ad-2a7ff97bda99", "value": "T1B1350122AD962A60F8980FBDC012159973F4D9071566EB6F5FFC40F8ACB6F19CD274A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406824, "uuid": "eee3f41e-a9f2-44d7-8e12-a37a475516c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406824, "uuid": "59ae860f-638c-4d5d-960e-215cd09384b3", "value": "24576:kcThpLT/4PPH7caoc7usjF3le4JblNB1:HLzswao9Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406824, "uuid": "2deb25df-c842-4bec-9d67-a530b66f9500", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406824, "uuid": "c5f3df44-67b6-4251-844c-d4858c0ae652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406824, "uuid": "b668f9a1-ef31-4ef3-abd3-4505c3413d91", "value": "F\u0130YAT TEKL\u0130F\u0130 VE TEKL\u0130F TALEB\u0130-T\u00dcB\u0130TAK-SAGE PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d645c6-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439449, "uuid": "0ae44a2b-4995-4b22-9a08-dac8cba3b97f", "comment": "Malware payload (Mirai)", "value": "91f922e5c94827ff72af59bb5b467fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439449, "uuid": "318a6af7-67f5-4ce2-bba6-72afedbf7878", "comment": "Malware payload (Mirai)", "value": "319d9d1e529560228df3c58f29f8090ad8cd087ce992ba2e3e92b59502178e0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439449, "uuid": "376c0ad7-8f16-47f0-94f9-b44e096f7340", "comment": "Malware payload (Mirai)", "value": "dbc557494389670ffdded005fff96357d2ff7802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439449, "uuid": "57ca74d3-066d-43e0-a09d-31982641968f", "comment": "Malware payload (Mirai)", "value": "0349022db81a20675fa8cebcfcb6e3ef9201705930d2fb35044f814e815dff78fa6f49c40261a9d6f0855ab30ab0be6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439449, "uuid": "474860a0-0eee-47a3-8e45-dc8f702ae0f4", "value": "T10C934A22B539093BC5E4953722F35326F2F6438A14AC8B2E7E710E8EBF156D026477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439449, "uuid": "61f558ea-f93d-4a64-b982-d9b8b7407dee", "value": "1536:zCTLJ0Jld13m/EqBtga0vStPhYm5roASoAteS5:GiLuW9a5hYOc4S5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439449, "uuid": "c25a8c61-64e4-4b90-b73e-0679aee64916", "value": 91976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439449, "uuid": "aa42e666-4ef3-4a0f-a9b9-3a4d01734b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439449, "uuid": "a591af67-90a5-4dbd-a250-343f51994b21", "value": "rizzx.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd3dc70-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423415, "uuid": "4ff53bbd-e977-4b2d-afb7-b8e91a9e0555", "comment": "Malware payload (DarkTortilla)", "value": "f57abb3d240ec1b72095c7b02a80eb6f", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423415, "uuid": "9dc081fa-e6b6-4f4c-83eb-4622e8391a20", "comment": "Malware payload (DarkTortilla)", "value": "3275dd74299e16c59e42d1241c3ff847f48b88754708dd7d847ba2b4fc61bb98", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423415, "uuid": "5f5526d6-455f-4bf8-aa24-a29879b1e449", "comment": "Malware payload (DarkTortilla)", "value": "72d642d3576514329c1dcd816e969bba309c10d4", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423415, "uuid": "beae43a8-0175-45a1-a2a8-a4b7ea90a095", "comment": "Malware payload (DarkTortilla)", "value": "262faad883f563a25ce48b03f0357b2438099886827654387554e549dc500131cfbb0bedbffc81f62c1b59fbfd0fbc63", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423415, "uuid": "3e9e5a04-b597-4830-a3ef-d0d9fc6a0629", "value": "T138B49D2023E84A58F5FF5B79993105258BF1FC13D732E76EAA94809D0D32B81CA66737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423415, "uuid": "10344102-eb7c-4a14-a274-9a13b9e6f235", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423415, "uuid": "28a400fc-543e-45dc-8c8c-c5d41a1d1c98", "value": "12288:eBLpjgE52Ybv2daD1xAKrZUfZOQygPrjgCc2:cLH2eudmAeGIol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423415, "uuid": "1e12ca4f-e4ea-4802-bb45-508f09a40c46", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423415, "uuid": "d1b2a239-839d-4582-9263-84f10c69158c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423415, "uuid": "65dceb38-0e44-420f-a0a1-581e393f9d26", "value": "3275dd74299e16c59e42d1241c3ff847f48b88754708dd7d847ba2b4fc61bb98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d87971f-0c91-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771395336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395336, "uuid": "530e03d9-4634-4b36-a21e-fcb34deb8a0b", "comment": "Malware payload (Mirai)", "value": "73ed70442925bcdec5756bd7ac0f09c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395336, "uuid": "f9a798c7-19bb-4397-911e-d107020a2cf2", "comment": "Malware payload (Mirai)", "value": "33036bde102b6f23ae63496019cab2d6aefd9515667b6dee7c0e4710981d4ad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395336, "uuid": "2577b017-7b40-4d54-9e61-ecd7235dc01f", "comment": "Malware payload (Mirai)", "value": "d90baa2010d159e207316fe245a67b3c21984901", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395336, "uuid": "74ee07e7-ea62-4b72-a471-bc5cf3820a19", "comment": "Malware payload (Mirai)", "value": "39a9b04bab1c4c4c651613c815c584310b894c591ec06f00e648460196ccee50b3c36eeacc9f7c862969fecf2f7b38bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395336, "uuid": "543c9e8e-8ace-4bf8-898b-6828a4014758", "value": "T17AD3E0A8F980DF72C6E125BFF64E5A0A73070B58D2D63246DD044E39739B62A4E36D07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395336, "uuid": "1b033b7f-8934-4efa-9ffd-8fa4ea543671", "value": "3072:7D0ownSrawknWuy7fRNxXCWu8gaWue6qj/S4KoBzQFR:7xwSuwYGRDXs0Wkqjq4KoCFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395336, "uuid": "0399505a-3284-4499-bf98-5d7262e19490", "value": 142049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395336, "uuid": "9a35e75f-97d0-4791-a05f-b63734c4f563", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395336, "uuid": "fb43de9e-1934-47e3-bc3a-1e5488ee618d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe58714-0cf9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439981, "uuid": "2fe974f4-1b4a-415f-8f69-3a25838f97c5", "comment": "Malware payload (Mirai)", "value": "9fdf05841c063a2f751e348bfc6f2ec4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439981, "uuid": "5979ddca-2397-4d8f-ac5e-f68bd2585658", "comment": "Malware payload (Mirai)", "value": "33446f98e49714ac509ef7a5f542c9bb557968f2a640f104ce27fca80d576580", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439981, "uuid": "2fbad67c-1495-46f5-a4b0-b2011e201c3a", "comment": "Malware payload (Mirai)", "value": "0c355149bc133f75e03c889a94bfe0aaf5c2c8ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439981, "uuid": "078938a4-5175-4546-b721-dec9d09e1d6a", "comment": "Malware payload (Mirai)", "value": "71f2c8a161da52705d9374421a1d0cbe3c965fa38c13b9fc32d1409748df0d42cdb7ff0d3f6326418ad4c5287ac2ece0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439981, "uuid": "c1302264-3439-43bd-9d40-b6627f2d0872", "value": "T13661B5CA02C58B715DAA896373E5E4C97D9DE0AE2082DF36CFEC34F2084DD1871595E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439981, "uuid": "542fe522-da89-454b-98bf-59d5281e0445", "value": "48:is0csxGsiUsFJYsb2sDSskTkLscUs7YLsKaJsF6sTus6ssQssfgW:iCfEPBtoe5Le3LQ4FW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439981, "uuid": "1b8f2c23-be8e-42b8-a581-11103efdc10b", "value": 3194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439981, "uuid": "8ffd5b04-1885-433b-8d7d-1396e6bd29a5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439981, "uuid": "a2ebe92d-abc4-4397-91ce-9702c07f8524", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3185ea1e-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433112, "uuid": "c24e355f-9f57-408a-adcd-7d862a65eecd", "comment": "Malware payload (Mirai)", "value": "bd990586cf7176c2e6a573176dde7197", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433112, "uuid": "fe166dbe-edab-4bba-86b5-0846725bd72a", "comment": "Malware payload (Mirai)", "value": "35074e677812d2ed1c44262931d1b2be81a5b0b52431fccb0759f39322b9512c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433112, "uuid": "4d4570b1-1515-46c1-93a9-db6e10331e5a", "comment": "Malware payload (Mirai)", "value": "87918b274d012a7a5b455624b6c42b3cf878ccf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433112, "uuid": "96d0fbba-aeab-47db-917d-0077af876042", "comment": "Malware payload (Mirai)", "value": "191d36207973f471e1f2a845fb8be777db368d0513b3c286b7b8911dd5a4669a1bd70579103515be36f12d95b0caa010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433112, "uuid": "7e68d935-df24-4056-a3de-ce93c3545044", "value": "T1D114851E6E328F7DF368C73447B74A34975D23D626E1DA84D1ACD1052F6028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433112, "uuid": "1f6ddafc-37a4-43d5-9d16-81ace92e51ea", "value": "3072:Y8Rmsk+9dRgZe3yiuPTk+FFwHWBKgs5MXcDpgSkbtdt6nwkZ8:Y8RmskzmyiuL7DPeexPt6wke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433112, "uuid": "c70bcb42-5904-4c74-84e5-e29e231341db", "value": 203384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433112, "uuid": "0705f4b0-4d46-4f15-b26f-86ce826f1ec6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433112, "uuid": "f7fa61d4-b79a-4d53-9c59-ca00781ad640", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1669c1ec-0cf8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439509, "uuid": "b3445675-d0ec-436f-aa0a-3786617890ab", "comment": "Malware payload (Mirai)", "value": "c6bf04bef1d0734f277468fbcccb902b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439509, "uuid": "08e92bef-bbed-4f87-941a-ce6403cca5d6", "comment": "Malware payload (Mirai)", "value": "35e55ef426c6b27972de6bfa164b5dcae611bfe6182cabaab951e2f61e5fd875", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439509, "uuid": "95d3462a-4756-4e21-a6ef-0cd32e631156", "comment": "Malware payload (Mirai)", "value": "0556a088b6a0fbea2b5ab6ce304bfc736e588d50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439509, "uuid": "768446cd-eeab-4c58-8c61-19a6465a4536", "comment": "Malware payload (Mirai)", "value": "e71fc0c1adfc66cc620eca25fb0e0f97a4ea9fbb9084ed10848463312df123233312031f8cdc54494462f82a4b8f7c94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439509, "uuid": "e469f958-5b22-4f6d-9607-bc8187c58c68", "value": "T103833A47B98190FEC499D03847BF7537C923B4BE1239B29B63D8AE262D09ED01F19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439509, "uuid": "91ebf108-e0a4-4f74-9309-5f5f07b0a31e", "value": "1536:MqbF7IdAcsgpY+jNR/EVkCkj6Rv3U8GbdGrAyvQ3ol:TF74AcsgpNNmVkCdRvAbdGrXQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439509, "uuid": "459e45b0-bdba-4809-b695-95913d63a764", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439509, "uuid": "a7861075-0968-4412-80be-e57a6ae95e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439509, "uuid": "ce0a9673-fadb-4bc1-92d3-49d6c09f4567", "value": "rizzx.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ac1800-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423341, "uuid": "ab8130dc-94b9-4879-b2ca-de2707ef9633", "comment": "Malware payload (DarkTortilla)", "value": "ad8f81f94124bbd530861558cc24d865", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423341, "uuid": "c110327e-df81-4fec-bfc4-9dae6dec3b15", "comment": "Malware payload (DarkTortilla)", "value": "377d19cf9572f2987ca7fda5253d2255955a73bc75039b5784d8c12bd263849a", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423341, "uuid": "56e4198b-e3fc-471b-afe2-cfb9a27f77a3", "comment": "Malware payload (DarkTortilla)", "value": "b5ed66b2f6c8e2651a06fffa9e8b049a759cd43b", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423341, "uuid": "63baa3a8-8b78-4c95-a091-a5f02554fb4d", "comment": "Malware payload (DarkTortilla)", "value": "9a46d2b2f8aaab792684375894a97890a35fd98e060b1cc36b955c9a551e5f49d4ea60b8c1b95cf562e498057d301dc7", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423341, "uuid": "3f1ec846-65a6-4335-8e45-a3958ae9e5b0", "value": "T1F2342206EEF654DB06D2F646B92A0D91BB7FBC796506B8071A378B7493B3FC25240423", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423341, "uuid": "3bbe35c1-1877-4979-aed2-a5a5077473dc", "value": "6144:JSn9KH9enKXkeX2sNbq4TsdaFJ1a0sT4vgEYGcl/smSFDkmBZ:JSH2H2YbvodaD1KHEYGTmKYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423341, "uuid": "3407c2c1-7ec3-4bed-bbca-ced87e42e3f5", "value": 235281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423341, "uuid": "005dcfa0-5888-4917-9b83-7a38925d070c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423341, "uuid": "6b043264-5c59-4cf7-b4f4-9cb2efab72b7", "value": "377d19cf9572f2987ca7fda5253d2255955a73bc75039b5784d8c12bd263849a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b8f7cd-0cca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771419769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419769, "uuid": "79cecdc0-8ac1-420d-90ab-98ad87347cd1", "comment": "Malware payload", "value": "e580288673fb75bb104c7637398a58fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419769, "uuid": "505b5c63-6e79-4dce-8952-80f3c82ee28e", "comment": "Malware payload", "value": "38964f4ea166351620c7ae1f7f8ef4e64b362fe6f506378f79d331479f135f1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419769, "uuid": "d59fe466-8600-41ad-ad28-d2146f8949a5", "comment": "Malware payload", "value": "4433f7bc39ed498d0899f57925dd929aa9ee7974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419769, "uuid": "ea074ca6-197e-4acb-abd6-1390259a210b", "comment": "Malware payload", "value": "51ca5b7027e87c0f274420cafdf573516d08cff2094cc070a7561c4b6ca65f24aa2ca0afe66397b0bd45b5c08ed21541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419769, "uuid": "1d50af9d-a4bf-4718-b73c-57328ef9dcdd", "value": "T11D060A267DD65169E6AEF134E09052253A713C790371FBC32B89356B0D7ABD82B3E318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419769, "uuid": "f7c28ba0-030a-4a65-8f3b-d9b3fd212741", "value": "91802a615b3a5c4bcc05bc5f66a5b219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419769, "uuid": "09471bf8-cb35-4abb-bc7e-9f1289e56974", "value": "49152:eAjbc0JgmMJijGb1W51a2XB1y4eIuXl+e5B:DkZwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771419769, "uuid": "de3e8a7b-33f0-4e49-b9f7-ac0da16f3fdb", "value": 3850240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771419769, "uuid": "d281203f-1dc0-4dc9-9a4c-e496e9cf6c33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419769, "uuid": "94ed39a1-0446-4fa8-be53-9df77b535e4b", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3caff11-0d08-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771446672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446672, "uuid": "b6096a76-6786-4e98-88fd-3f7f2ad1c578", "comment": "Malware payload (Mirai)", "value": "3a8a592e5a6fb06d8df5f4aa502521fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446672, "uuid": "f7b1bef1-082b-44c0-91e3-b32f59ced0da", "comment": "Malware payload (Mirai)", "value": "391d25a88753c5d8b52faa0633edca31cb3099f670a8830e97c12de6ff0f74d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446672, "uuid": "9b633b32-c22b-44d6-acc0-8808a902b5b4", "comment": "Malware payload (Mirai)", "value": "a5c2f92c683dd08d70aefbbe2112600e7f8b14b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446672, "uuid": "3327cbdc-b5ff-4dd4-8bba-267b0406d94f", "comment": "Malware payload (Mirai)", "value": "9aaeb6c49cf6b9a40ad1c412b90629b209074024e04833d87b74afa192d089798789d9f79aa0fed7327c4c76324524db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446672, "uuid": "fe5a57dd-3c63-4f30-812a-0ae920e9e311", "value": "T1ABE30859FC819B11D4D635BEFA0E028933531BB8E3FEB112EE155B2227CAA1B0F36515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446672, "uuid": "1e3a2345-4ef8-4ca0-97e3-cc60317a91a0", "value": "3072:eoOo9RU+Kzzo5A5WdjaFilBfJR1LFqLgE0fXaesAFZFmgtJS3dBCePb:JVRdOWz1LwLgffXaesAFZsgt4Cej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771446672, "uuid": "1ddf2fd3-a061-4f7f-88c3-6a6a013d9491", "value": 154530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771446672, "uuid": "ce93bfee-e2b1-40c3-89da-fb2b69f0b22c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446672, "uuid": "eb5bf375-1398-498e-9637-e79cb16797e5", "value": "sync.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a08d3d6-0c91-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771395330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395330, "uuid": "0c127d8b-6818-407e-ab4a-242082b19bbf", "comment": "Malware payload (Gafgyt)", "value": "1f1791d7b8e837425d5e969d78f579fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395330, "uuid": "6fec2fa6-fc57-4d65-be45-9000b3c5610a", "comment": "Malware payload (Gafgyt)", "value": "392131e76e68bdae7bdab5da386eeda8c570a6b7bef76f0ec891e87ae9f0b8cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395330, "uuid": "dcd997c2-a15c-4a21-9e6e-78a31302ae23", "comment": "Malware payload (Gafgyt)", "value": "68d1e59de800f89e24c4b544cf79a8cb60d9a2f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395330, "uuid": "6df580fa-32f2-4e4c-8979-1056f340af1b", "comment": "Malware payload (Gafgyt)", "value": "7417e7d6109ab45aa9aaebccebb01790020ccd69e3a48e878693a45d1daa359a9ed4305697e1b099a6185f902c719144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395330, "uuid": "28ce5c4c-015b-4d75-ba96-1114de693113", "value": "T12DC3F141F5D39AF1F0C392B3214B8352E7399A161098CFABD7097FB4A8E1797419F289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395330, "uuid": "423b4a5a-7918-4bb7-99b0-96fc2ac94ef7", "value": "3072:rOlNTZa+Ef6j8l/7ozWh+q5j0IGwySaI2Xn99iHR32:aPGfc0/7vh75j0k3aI49MB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395330, "uuid": "06ccf6b3-d0e8-4bbf-b15f-351ad03cbfc9", "value": 126957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395330, "uuid": "548978ce-5445-40af-9207-bc5cb8273d9f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395330, "uuid": "9640d4ae-7438-4c61-9d5c-aff217905700", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ce6e2b-0cbd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771414427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414427, "uuid": "2275da20-202e-4871-8f6d-a44073f01886", "comment": "Malware payload", "value": "aaa00178ae0ff5b8cadc436e03e8ff14", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414427, "uuid": "e35cf0e2-645c-4498-995f-1b2d5d2293ee", "comment": "Malware payload", "value": "3aabe1aae38d2e0e4880c5fdf3659b708e6119b7addce1438d8919bf59bd9dde", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414427, "uuid": "cd2bf0ea-4b5e-45ba-b561-5eb14d406884", "comment": "Malware payload", "value": "92e64d2c40aa7eed4550360498f4fabc0d50021a", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414427, "uuid": "240edcc9-5a40-4b9e-8509-82fcbda2ba9c", "comment": "Malware payload", "value": "db6dc1daaa9283160f9b14842c0b409e09cf4dbb6141ca98570bc7eb0cac878d65058906c9431bf61704b0ef62fd1d2e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771414427, "uuid": "58bc4256-cc40-4199-9f59-74b75ab92368", "value": "T1C434235D9FBC53EEC1FCEBF92680A009327E291DEBB2DF6EC1899159033143974095A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771414427, "uuid": "6667f9e4-be0a-4346-a06b-f00af0353735", "value": "6144:ny3YcL69etBRz3H/U5DLTBolsgbMVBLmW9vf:nCYZ8xbf8LTBcbAmO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771414427, "uuid": "d5fc921b-0e60-45b2-a2d0-b53d9247fec1", "value": 252087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771414427, "uuid": "8119655e-a40b-4018-9c3c-0e55a0c42bbd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771414427, "uuid": "a863267c-86f7-418c-b089-c6cd5cfb42b8", "value": "Bltenonpr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5834a5-0cbc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771414014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414014, "uuid": "282ae3cb-aaf7-471a-8789-59d214eaea19", "comment": "Malware payload", "value": "f3a39e664828650b3dcb6119b2f82dd9", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414014, "uuid": "4ba9f940-6ed2-46a8-b2f2-5e1e56920fdf", "comment": "Malware payload", "value": "3ae477db5632cb48bb01e206ce8827e09249a501947e93c48ecc679ef7e392b7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414014, "uuid": "e81f6909-8188-494f-b55d-52595fa09dff", "comment": "Malware payload", "value": "091e15ede1ffb46e680e1386806e6bbacda8695c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414014, "uuid": "4d6feee2-1450-42e6-b9c9-fda59b967687", "comment": "Malware payload", "value": "2744d53d3ed6b1f915fb4b839fdd4c5b87409740c5cd45a947823cc3597fa62763a509ee0bba4f9256feb06479708315", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771414014, "uuid": "d4db0f6a-eb14-45f4-9794-30b23eeba4e1", "value": "T1AB61D8041FB588E387F440A2B0D925B7DA01B43934273E5F233D723669AEC5D674D89D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771414014, "uuid": "c1d58ee3-553d-405d-a3b7-de7738059e1b", "value": "96:s0NxzW/cLb7uiye1lAzmdAM8nCVdd8NSjDzv/tf:Bby/+n//MmdAxnMXtDztf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771414014, "uuid": "b4919255-33f3-4f18-b999-ad0d57fff25c", "value": 3344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771414014, "uuid": "3237feb7-d2ba-4fb6-b2fe-9505ec92e83f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771414014, "uuid": "3b4e25f8-75a2-48e7-aa3d-c35e5d47fc40", "value": "ps2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665df173-0cfe-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771442220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771442220, "uuid": "d939405c-897b-4a80-97d6-57edec0412a3", "comment": "Malware payload", "value": "e965483ae3857c858ab529338e2e21df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771442220, "uuid": "809a2e08-8951-4379-b69b-c705f17a37d5", "comment": "Malware payload", "value": "3ba285431ba23a06204c81bc6ea10240a0e987c7a613a9e2d23e4313039fdc30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771442220, "uuid": "d4d54092-5bd8-401f-bbca-611ce2c0e9e7", "comment": "Malware payload", "value": "28d66b77b3e797f5a0294964ef9bbbd756113318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771442220, "uuid": "7b003538-4c2c-447c-b239-ac568d6d5bcc", "comment": "Malware payload", "value": "c63b1f5d00170d416e1cb49be8f21b041abd4f0890a6939e617b7d7257f10428adcf1bc7277a64d7569a2804354e9901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771442220, "uuid": "4899e07b-b04c-4e47-9263-e6619c0ec89d", "value": "T1B7656D53F12E0F8BC01CA9754E5EA5E9D0F28FC0EE14C8E6F77A868B974C7102659A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771442220, "uuid": "951f9a1b-b528-4dde-9360-8e3c51f3d724", "value": "0c04363417c8544dfd508c7272e7940b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771442220, "uuid": "473cd6df-c300-43a5-bf72-b8987a423b88", "value": "24576:1ilrhP4yH6xUNz0j8BbSPdMiTCFXJrZlx6YFi3DKtJ3AbmOPaaLfXEovV:1u76xUNza8Bb8cZrLhFeDGJYDjPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771442220, "uuid": "443c0bbf-123a-4a74-b382-cd720aa4d9f1", "value": 1488064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771442220, "uuid": "e596fcba-1334-4732-a473-097606af417f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771442220, "uuid": "72469626-5fb2-4028-b488-121aa92b97a1", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1d08b0-0c68-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771377642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377642, "uuid": "05918f9d-4ccf-432c-8ef9-036e9ca08302", "comment": "Malware payload (Mirai)", "value": "12979fdcca47fd79ea949490d452a43e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377642, "uuid": "c36f0444-0902-4591-8e68-5938be18d772", "comment": "Malware payload (Mirai)", "value": "3c241816ec8fbcd4500d44333a363faaec3f910d938ec8490ecd9b18e06bf291", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377642, "uuid": "a624f56a-0b73-4a24-9742-0fe553ffb58f", "comment": "Malware payload (Mirai)", "value": "de94207ff8628c7ba081d2a2ad1ab93a624ad355", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377642, "uuid": "23055ee4-84f6-4c29-aabe-9248bf17321b", "comment": "Malware payload (Mirai)", "value": "36fb6d173c58fcf08147a4bbdf1479c94211212b6c9a883f64f13e692de28ca0b18bfb17f33ceb6ea76422a1f1a1dd1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377642, "uuid": "5c1128cd-997f-4ddf-8974-b1056fcac8b8", "value": "T191A30A52BD42CF17C5C261F6F7AE42483B126B7CD6FA3142ED24BFA127868DA0E27511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377642, "uuid": "90deb841-137d-4e31-8860-e57ab9231c40", "value": "3072:lbFkAXTjO1BviWkAgd61mv5PiegLXcMui:lBkA/O14cgd61o4XcMui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771377642, "uuid": "dfa4a317-4e5b-4e41-9e70-ec52cc330b64", "value": 99744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771377642, "uuid": "6bd7f183-3ae8-4258-98cf-43061c81c481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377642, "uuid": "672d0b3a-e61d-4bab-918b-7edca9db7af2", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9044e8-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406720, "uuid": "e392773b-8880-4e3f-ae9f-ff31bc458ed6", "comment": "Malware payload", "value": "6ad3135e591eeb02368d45b777e65ded", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406720, "uuid": "6bb9f0bd-b2ca-4eeb-81d6-e7cd34ffbbc9", "comment": "Malware payload", "value": "3f922d9dc1867d7d3b2441b5f681893ab0bf1e0bc3f40f75cfcbeeedc5c266cd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406720, "uuid": "6f9c54ab-452a-46a8-93be-465af8eea76c", "comment": "Malware payload", "value": "4ac9a82ced3d908a6065e447aaf4dd77ba93bdc3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406720, "uuid": "629e8839-dc36-4170-939a-bc55b0080e14", "comment": "Malware payload", "value": "8bbb8a1c8d9b0949a80166c413fa4449bc3c33378485ad25a28dcdcaf7fc65fc172e2ce5c0ccb49ce7394ae3f3598a4b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406720, "uuid": "38bb50e0-9919-4de8-853b-9962f49a47ee", "value": "T17B4633306DE81D5B06B4833AB09F9F663FEE49538D4DE1E649D8E183318EB85903F1A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406720, "uuid": "ed6e6cdd-567f-459d-b41b-8d6e0751d0a3", "value": "49152:YHC8COHs+F8DyDwVeNQ3SjgSI50//QXyhQ5symzavo656tn1D9mlllX/lzkPe:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406720, "uuid": "f7595910-fc71-40ef-bf2f-3318347a9368", "value": 5350395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406720, "uuid": "1fd68eac-7357-4b3e-bdd2-b1ebc7223215", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406720, "uuid": "62bed13a-041a-4eb8-966b-77d72137fdb4", "value": "TemporlCYES4009qskdzr-OZ9HIICOB_9924GFBU.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580a7f50-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402253, "uuid": "83dd1a09-cf78-4d54-953e-99b71b661e04", "comment": "Malware payload (Mirai)", "value": "df4a0aa47cf8608a0c4a91bc70db44e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402253, "uuid": "66583a59-fe99-4038-b9ca-2bbbd0eb265b", "comment": "Malware payload (Mirai)", "value": "3fc94e75ad119ecd196596512ad6ffb4a1d9613b95b3e418e71608d9c14e2bd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402253, "uuid": "0931828f-7d54-447c-8fdd-f428ab8668f6", "comment": "Malware payload (Mirai)", "value": "87ec9f92fedc37603644593d0ccaea086b663d66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402253, "uuid": "ee13f437-faea-4890-bc37-afe6ee8afdb5", "comment": "Malware payload (Mirai)", "value": "a0cf008831af7af1462dfd8d21e9ec84f0b9472ccdebc54fe110c963055d8408760e687fdbe733ff051cfea2c2ba2895", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402253, "uuid": "2ecf3740-ef25-45dc-acd2-758ae3144d27", "value": "T111933A56FD818B21D6C112BAFA1E118E3313177CE2EE7212DD146F60778B96B0E7B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402253, "uuid": "02f1c056-c8b4-40c4-be1b-a050db28e7dd", "value": "1536:/snguAyikwK/nIcwrgAq6139vaQ4tivCwDOiKPxCbab7Q55fY17HN:XuAyfIzIi39vaQyPxCbabM5hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402253, "uuid": "044bac23-ae27-42d8-a21f-0c1205f8c747", "value": 97512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402253, "uuid": "02654aa3-bead-492d-9ab4-b326302802c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402253, "uuid": "d7d5c199-8fdb-4aac-a092-6ca0ab6f5968", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d80c435-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402208, "uuid": "173973e5-5d0d-4ee4-a8b7-dce7f6372fcf", "comment": "Malware payload (Mirai)", "value": "6d00d7a83f0220814a38e1d8993e5acf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402208, "uuid": "c46ed7a3-6b4f-4db3-9e68-a77286603be4", "comment": "Malware payload (Mirai)", "value": "40c63c16669111687fd70a7dff477c5de0d4315ab4546616952ff9fcbd09dd64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402208, "uuid": "d9478562-58b5-4b57-8b8b-50b595d65834", "comment": "Malware payload (Mirai)", "value": "3af5ebaab597dce536392b49254b939d1345ca39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402208, "uuid": "56a1b639-ed92-42c6-b9fa-ad910e2a4887", "comment": "Malware payload (Mirai)", "value": "fb03fb30cb7b8784db79f108fdc8a3537833efb4d660aa46c47d8de4397612fad89415264994f09e30f5ea345bf5703f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402208, "uuid": "fe40fbea-ffd5-4c13-b47d-40bc457fbb96", "value": "T1B5D308C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402208, "uuid": "70ce76cf-4c56-4cd4-b378-8a577d5fc79b", "value": "3072:OXbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFInx:rrybytG/Oyi42VOgLNAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402208, "uuid": "0648417c-2c2c-45e0-bd8c-7230125b0be3", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402208, "uuid": "2c41cfc9-7dd1-4372-93af-cc0841098a43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402208, "uuid": "c374a2a1-5a9f-4c0f-8570-f8f54cf4d52d", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c733b026-0c99-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771399003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399003, "uuid": "56633fe9-6a46-4a71-8344-c9f62cef94f8", "comment": "Malware payload (QuasarRAT)", "value": "268fae4066afe5439b4fd6e5ec142929", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399003, "uuid": "0ded6da0-06ec-449c-bb72-56b7d4fff98a", "comment": "Malware payload (QuasarRAT)", "value": "40c6d95876d7a085020471145c41cd5a16090625919d5de147334a52d24a6f1b", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399003, "uuid": "5c22ccdd-8997-48f5-b6bd-2624c38b3832", "comment": "Malware payload (QuasarRAT)", "value": "87f7b0010d51d5d5f5bd4e8dda2ead158c393bf1", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399003, "uuid": "038c1247-a588-4887-9056-d5db60746064", "comment": "Malware payload (QuasarRAT)", "value": "1beb6f28a7af2ca06521ca25120a0b90f3789f01565f53495a0c3e6e45f2473c5958dd70a216b223bd0843efc05feeb7", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399003, "uuid": "c042b054-50ab-4816-ab80-8a759f3d47ac", "value": "T1DB4623393D825404CA680BFC803695C63BF1F68F6B16C72D7BED129CDD42A4B9B27664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399003, "uuid": "e310b36c-e928-4782-b414-9fa73f33b3f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399003, "uuid": "8346139d-a7fc-452d-a92f-6b23088b5c50", "value": "98304:OcRDwNuAWm3GMvD+dHLRC9AdY3WkYSyC:OGlNm7r+dRCWRyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771399003, "uuid": "78daac1e-c854-486e-b513-ef6f1d46ee22", "value": 5630976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771399003, "uuid": "c496f369-15ab-4583-b62e-ccd73a9fa66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399003, "uuid": "3dc89d13-855c-4222-8807-d6aa432c512e", "value": "CH1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb0e09d-0cc5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771417885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771417885, "uuid": "7d575fbf-89e6-4766-95a5-b51094dc32d7", "comment": "Malware payload", "value": "e281a30a7af625b562d384ecea6d90db", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771417885, "uuid": "0e8eaca6-e37f-43e2-96fa-c491f33d93e2", "comment": "Malware payload", "value": "413f3e927bdfd6e755dd6ae1c232e13eff8de5ae4756437060e1dfd5e0440a80", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771417885, "uuid": "2320d67e-20a2-4b90-bf06-185c9f61e584", "comment": "Malware payload", "value": "5b605d9be233b3a87a795731039c36911b4f6084", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771417885, "uuid": "227d7537-f875-408e-ac99-8e9bd91d33dd", "comment": "Malware payload", "value": "802233fade19102129af7277d36b3bd6ffa17aea461bea40b8b50ac2a0d70622c30602a04c0190b948141e484d64c9c4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771417885, "uuid": "e6e2c90b-8a75-4554-84b5-dcc495b538f9", "value": "T18BE4B787F1208AC7F44FDA7F14504210AEB0E4704607F2562B6E885B6FEB9CC9E657E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771417885, "uuid": "518cb975-af2d-4cef-8252-ce73ae4d4c97", "value": "6144:S1eMX5Uh/W94gpr2T4PjhMoMu7/RWBheOgKetuXB2x4WU30wO1/1vp3x1Zjo:SZjJKT+tl/1Fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771417885, "uuid": "321984b9-7b19-4cf6-b03d-d5d5a9e03186", "value": 702326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771417885, "uuid": "739ce3b0-edb1-42e7-baee-ce0d501a9c60", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771417885, "uuid": "1345efa8-1fe2-434e-940c-867f6b9912ed", "value": "donutdupe-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975511a5-0ca9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771405795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405795, "uuid": "3e00c1b7-1d59-49f4-9ad5-8f048670e743", "comment": "Malware payload", "value": "670e21e932e6aeb303cbf594de129a64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405795, "uuid": "74fe598c-9cd1-450a-a25d-302f78d16a64", "comment": "Malware payload", "value": "414c4a91a9c5f6c64a9ed896c643497e5d3e88d1a3b20cee5dd014f71e58571d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405795, "uuid": "f4cd7582-60d3-4fd5-94cb-19b8a365ed51", "comment": "Malware payload", "value": "1a085b3f13c07ae44c7cf035abdbe077a61647f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405795, "uuid": "dd500faf-82c2-49fe-92fc-4e39459e6791", "comment": "Malware payload", "value": "f3cc969efec0ae62b0f48f0f2dd215baf0d4889c2d25b312133e6fc148f9093ba5777973661d84731db5c1f6eedc6297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405795, "uuid": "fe912dc9-d8df-47fc-b419-f14930f88888", "value": "T191642356CC7D76E191EC10F7079BDA549083CCA1DEB9E72D46C93AC01DD09242BCEA6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405795, "uuid": "01013a28-b6ee-4201-9c8c-bad008664a25", "value": "6144:4JeqYjjXoagH36NlwWg24GPegf+GJZXRO7iqcKeGF1jjNF:YcoagXQfg2L87J1jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771405795, "uuid": "263ff298-d053-4a7c-a5f8-792137011048", "value": 331965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771405795, "uuid": "379299b4-fa0d-4045-962a-7c08b6e3c9e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405795, "uuid": "9af8814c-cb28-4082-8e6b-83d925e3c424", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb077c3-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771423331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423331, "uuid": "25936bc1-60d4-4ebe-9b21-54e04204547d", "comment": "Malware payload (RemcosRAT)", "value": "48053311ab5e0d44d4f056dcc0799695", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423331, "uuid": "df6b636b-966d-4a4a-aba2-de52d6c54629", "comment": "Malware payload (RemcosRAT)", "value": "415e0c65ed2c39e1d831cf8b07c07bde44bff073b72b05a8fe4a1141850e6947", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423331, "uuid": "b2723117-23b9-421d-a1ba-e307b0b7b58a", "comment": "Malware payload (RemcosRAT)", "value": "7a27e76625f53e4a422c589a40ee5003bc36cb21", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423331, "uuid": "cbf25fe1-7ee5-4e2b-a231-1ffe45461f2b", "comment": "Malware payload (RemcosRAT)", "value": "ec184c7c0121a08ceb61b9a674654e93a53b5250603d096d05f38b5d2036f536deb107f3b293b71e7a6ec6fde51d780c", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423331, "uuid": "7ce70a32-2da3-4cf1-9279-a46cdbd6b205", "value": "T1B3A4AE02BAD2C072D57161344D2AE735DABDBC212835997BB3E61D5BFD30180A73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423331, "uuid": "94fc139d-39b8-4f4c-af6d-33ecf864fd7b", "value": "5d354883fe6f15fcf48045037a99fb7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423331, "uuid": "88e4bce3-a0e8-4c39-8bba-f7f00209f88a", "value": "12288:Obmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQScn9:uiLJbpI7I2WhQqZ7c9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423331, "uuid": "2acdbb03-3071-4d79-a108-1a2aef1b89b0", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423331, "uuid": "f7ef26ff-749b-4e7c-b387-360f154b55ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423331, "uuid": "d639fdee-a10f-41d1-86d3-a586a0ed1a8e", "value": "415e0c65ed2c39e1d831cf8b07c07bde44bff073b72b05a8fe4a1141850e6947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959e19d9-0cb1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771409228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409228, "uuid": "7d9b6cf5-4d19-4aa1-8b6a-47c54bc5881c", "comment": "Malware payload", "value": "cf749636eeaa05c2237b21c83069734f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409228, "uuid": "6d131417-a45b-4521-80dd-2308f9ae434a", "comment": "Malware payload", "value": "42e3e4c5097c46efeb107426bd33b359dc6eb93e4f524fd8441706b3f5563b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409228, "uuid": "4c5c1ba8-5d53-45b5-9e34-aa005fda3c55", "comment": "Malware payload", "value": "e74e96907302bd0c0c601b7755958d85cb38bd87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409228, "uuid": "842ca430-343e-4dd4-825e-9f1b69e94543", "comment": "Malware payload", "value": "fc464e1e0375211b59e609fc8c05895c0bf6193f06a19d00769e72ba71c824a66d2a0a5812ea7e2d3de6b94206f3881f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771409228, "uuid": "d644ebc8-1aa5-4f87-9880-5d0b5c6a640d", "value": "T142C38E5BB3A531F8E1778178C8621A05D7B6B4360A31AB5F0364469A1F377A08E3EF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771409228, "uuid": "3af546bf-6b36-42f6-8b43-340e054353b3", "value": "7ca45cbd273401c11c50082a341033ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771409228, "uuid": "ee65c8c4-08be-485c-8a0e-e1e4743cae7b", "value": "3072:JG8W2KHYrlwLTmjsHE8FKZPAbaABMFqsZ4O:JGWKHYrlCSiE8FK9dAOZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771409228, "uuid": "74c78618-888c-4575-b96c-54bb3effea3d", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771409228, "uuid": "c75d0f13-2e0c-4c04-854f-1762bb67c936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771409228, "uuid": "749308f8-2db6-4765-89c9-6df43faef105", "value": "pl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62897afb-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402270, "uuid": "7ae74a33-4f62-4b8b-af46-cb77ca3ff99f", "comment": "Malware payload (Mirai)", "value": "a04932e8a91affcbc872cff96c6b5a45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402270, "uuid": "b4539e96-5cc3-415f-b312-15bfd64ebb47", "comment": "Malware payload (Mirai)", "value": "436a1ac980162fdf25a65a5eb6f3ef7a8df9b03dba57a9c06cc45209ac1bce7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402270, "uuid": "455e7f5f-70f2-44bf-bbfe-ffc3c1caf023", "comment": "Malware payload (Mirai)", "value": "1b7bcb3b24f77551dce25ad1cf6d9f06b03ac8b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402270, "uuid": "dd2d36db-9c09-4c7c-8e69-4e8fda4cc30e", "comment": "Malware payload (Mirai)", "value": "97c1850165aed35833dfbbe3ee1d83234cd04b09d7c7c0f670cd7a59727e169e665ddb53e4e68ba562c1d936d76f6304", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402270, "uuid": "d3b21b20-4e89-4828-9827-3f7b6e712335", "value": "T157042B46EB418A13C4D227B6B79B424533239B64D3EB330699287FF43F86B9E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402270, "uuid": "3371150a-48ef-4919-bc07-8f4721344457", "value": "3072:othQN6EUkArXmaKAZrvJ1gF0LYcQopHAOXP2SBbeM/9OmXyOU:KhQfImaDZrvJ180LRpgO/2SBiM/92J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402270, "uuid": "aa9172bc-eaa4-4a54-9c08-9886fbb6660a", "value": 177843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402270, "uuid": "368a0365-ba3f-42c2-867e-c708ab95b243", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402270, "uuid": "26114099-f16a-4e2f-bef3-ec8abfae4047", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea1b8f5-0cee-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771435496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771435496, "uuid": "e5e63888-235a-47a1-9546-e5f980504b82", "comment": "Malware payload", "value": "ac698304842890ba704cf0a0c810d5ce", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771435496, "uuid": "dbb8161a-d458-4f54-bc68-008328fe1a06", "comment": "Malware payload", "value": "43dac84fcc25935ae002fb9513c199f6aa988e32f0157d25670ea4a2ce018703", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771435496, "uuid": "f87686c5-a15b-45bc-8a2e-853c4785e0d7", "comment": "Malware payload", "value": "d0bc179268754574ddbd37c2cc0474515bfde4da", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771435496, "uuid": "8b3505f2-5865-4a7b-b0b8-36fb9bf96421", "comment": "Malware payload", "value": "889db99569000e9d1a2787ab3ef0b3c680fa88f1047d003fbd3040dc73d8915716084d308b27bb310b9717a95e674392", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771435496, "uuid": "e00889cc-4822-4da5-b127-f4a1ee3b41ba", "value": "T135F6339493E448E9E967583E4D619012F3F2F86107A1DACF0BD44B672F6B2E99D3D320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771435496, "uuid": "47474ddc-1b4c-497e-b715-676bd335e469", "value": "fa28a256f23b68ab4376980fd1ab2aaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771435496, "uuid": "b8d0df32-f3fa-4eee-8224-6e08fe5b86cf", "value": "393216:jVuEmNGYN1bPsZg2KeiCxK4BHsFhktlapPLbYYYH4a7o:BS/N1ILX3JtUpTbLYH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771435496, "uuid": "418611cf-4a2b-48bc-82b1-5feb5aa27a00", "value": 15662080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771435496, "uuid": "a40571dd-7cae-411d-bb14-f9d222957673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771435496, "uuid": "49104b0f-17a7-4b47-a851-2bb1e1f1231f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9da313c-0cdd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771428240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771428240, "uuid": "9e98e2b9-0f7f-4707-838c-8e15d7015eec", "comment": "Malware payload", "value": "7f8f7bc214460fd3c92bc77ae04683f3", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771428240, "uuid": "9666ccc7-e664-4015-9f3f-09bf10e751f9", "comment": "Malware payload", "value": "44a88b810323b1daaa76543881a4adacbb8f8c69808a279a2952f4642eecb6d7", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771428240, "uuid": "ca723dea-836b-417b-a522-f315428f2112", "comment": "Malware payload", "value": "f6c60f1a06cc09cc39f10acfc6f5ad59579b37db", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771428240, "uuid": "f95d6f8f-a8c5-41c6-b265-b6219d5724ed", "comment": "Malware payload", "value": "709800626c311e932006d724762848bc4172ec94c18e428b0ddcc661b3dc507c658bf4631d3283cfa3ce8c6188de0bb2", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771428240, "uuid": "7f5231fb-024a-46f2-8262-fd918967000d", "value": "T17266070CDEE5AF5BDA1276BD8DAB5682B1BE99C0AB03E3538304B11718517B546CF0F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771428240, "uuid": "18619632-7297-4b95-a989-d5297df2f85f", "value": "24576:5aSM5WQuHbofVqd0bovQRWrSM5WQuH7ofVqd0bovQRWdrdR:3QW9bORWWQW97ORWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771428240, "uuid": "af9ede00-d244-4bae-8ca9-2a880db0046f", "value": 6960344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771428240, "uuid": "c29037d7-0654-4916-a6d8-a2896683de98", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771428240, "uuid": "413b3db6-74cb-4c34-ac0e-84ba95667522", "value": "malicious_mac_binary.macho", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c3027b-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1771406779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406779, "uuid": "e24afe0e-eeb0-456f-831b-84899ca76605", "comment": "Malware payload (MassLogger)", "value": "31bdd6d70c7886ef2fffd9a9c2ab5244", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406779, "uuid": "796da183-d24a-47e5-8013-0269ac5d7aeb", "comment": "Malware payload (MassLogger)", "value": "4549466f115ec3729f7a4cdd5b1d8d535e7ff2e153307fa3ae502b71d6170846", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406779, "uuid": "aed4a8af-9455-4a85-8550-a9d7652bddbd", "comment": "Malware payload (MassLogger)", "value": "80bc180c98681f565e45228d298c7faa528dfe3c", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406779, "uuid": "67d8b182-ce6b-4ce0-8cf2-f1ef9238cac3", "comment": "Malware payload (MassLogger)", "value": "f93f86da5474648a7bf9320b70dade6183ce350c6a1157ea51c788771e5693722797bb8e75691bd46153a239d9bd5f88", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406779, "uuid": "bc5f7db0-ff9a-4613-a969-84531b8a9520", "value": "T15335F55FA138F2772614BA3CA43E418F4EFBCA4A7918D958413D874F5C59CEEA0D7882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406779, "uuid": "ab0cd199-874b-4cff-a325-f566562735ea", "value": "192:OG0OjvQQfzSfkNi4ZynHw9GAzoK0r7kO8ilmys07q+IRXj:Z0Ob9fzSfkAnH9AKmjRNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406779, "uuid": "aefb61db-9fcf-4ded-9dec-ba97dafd002c", "value": 1155344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406779, "uuid": "ca9993f3-dedf-41f1-853e-cd9687f225d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406779, "uuid": "6cf8b860-d547-4bf6-bb2a-11c256c0b41b", "value": "1103170226.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2c1dae-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441315, "uuid": "cdfef2a0-e9f5-44ec-b440-538203746b1a", "comment": "Malware payload (Mirai)", "value": "2993511190034b31309020213adb9320", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441315, "uuid": "12cdd13b-a1c6-47c1-a338-ab53c4f3cc9b", "comment": "Malware payload (Mirai)", "value": "45962e37b878e756c42e1f0ce0280aebd93ef51fb13f145ba0c19125d45cdf07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441315, "uuid": "51dec38b-69ef-47b6-add1-194c8cf78509", "comment": "Malware payload (Mirai)", "value": "0272e95704ea4fd8a588ac00adbc335dba5c09b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441315, "uuid": "75755b0f-3e7f-4376-9af8-c675047e4ede", "comment": "Malware payload (Mirai)", "value": "c222f58f6cbe1d62d40a7201e46b8057a039f669b9603fe3001c804a0872ce17b70aab229aa20fc965d5e8e87352e5cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441315, "uuid": "89a71adf-f2f9-4a03-ae0e-4a6f26cc82b7", "value": "T14896F814ADC42BEAD42C4E7890EEC95622B45D104AF14B2A6560FFEDBC772797F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441315, "uuid": "7718c7bf-d9ec-415c-bdff-63321b680b83", "value": "49152:fzbImEJkxEnxsmMl6+5XSbfPY1cVVj/VqVPiI8oe4FzkZnoVTm9/1Cxs1Xr0R2mJ:7/mM0g1c36pzvEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441315, "uuid": "539ac208-71fb-436e-bc76-4d2dd575b9c8", "value": 9044147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441315, "uuid": "b4ab4bb7-ab3d-49c1-9327-fa847514fd07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441315, "uuid": "c64ccfdc-3033-44ce-848b-b14585b726e3", "value": "devfreqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cdf8e7-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441197, "uuid": "96d417ac-963c-406f-8e58-aa8c07351ebb", "comment": "Malware payload", "value": "59d2fcc23087bd3e5d79283f18bf9e0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441197, "uuid": "4e362d21-7c5c-4224-9f55-1319309ac423", "comment": "Malware payload", "value": "46574ddbc05deef1abd5bc77938a3decaabb05fe3b07da3ae14ab5238f0fbb5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441197, "uuid": "9b90ca57-2f4d-45d6-bc24-d1ae1a56fe1d", "comment": "Malware payload", "value": "7f00454f5010258c291fa85c131a954ad415b878", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441197, "uuid": "4cf1f611-7c58-4a03-9c3c-87e030e6105e", "comment": "Malware payload", "value": "18d674326059614c8480e9c3a0f4e32a491ebab53c0006d6399e39d52da8f758b33996e6d109f523240d18c4c238930f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441197, "uuid": "c8bfe06b-a0a3-4be7-9be8-5aba0e5180a0", "value": "T143041A02730C4E43C15B2EF026FB17F183EBED512AA6A640F61EFE845275BB16549F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441197, "uuid": "9467a839-00b1-4e10-a874-fe34938d8b17", "value": "3072:xVDPRn9rAx8jS6Yzxpu+lMkxSriQTmG6JQp6F882/4lH0RA:P99rAxgtYzxptl2HTmG6JQp6F882/4lB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441197, "uuid": "8a40d882-dd18-4280-b318-1986668ac5cc", "value": 178075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441197, "uuid": "6ad1a93a-9171-46f5-9825-f5dad989d38c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441197, "uuid": "5e5b55df-6e5c-43ca-be2c-0d81d8793002", "value": "mynode.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc601827-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441183, "uuid": "46285203-a6ec-4ae3-b7f1-ea1982f9b9e1", "comment": "Malware payload (Mirai)", "value": "e3b5e27af925bc6d6f12c85f30848bb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441183, "uuid": "59410e7d-d2da-48ad-a313-de26abf3b965", "comment": "Malware payload (Mirai)", "value": "46fe79436347039b0b45bf994922afd9a95c958076bd2113def830c513ee1ac5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441183, "uuid": "092fcb5e-edd3-4cbf-986c-2cf478a40be4", "comment": "Malware payload (Mirai)", "value": "db8fb1539112e77a04c43ed6595c602fbf8cee72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441183, "uuid": "232b298a-3821-4aa6-ac5a-42e962f71289", "comment": "Malware payload (Mirai)", "value": "449d20f00e74e8626aeb6be98c5e9ac45914d588341bcce19bf93c5230b8e76afaa2e150259c01d3e8a00266707255a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441183, "uuid": "32f48460-2324-43b8-a1e9-3cb266a3d614", "value": "T129866C0EEE558FA1C6A0067688F911582374AC036FCB5706B324F73CFDB66D8EE46691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441183, "uuid": "78e97afd-099f-445c-b7ac-cb7bbd48814e", "value": "49152:pifRb1dRXs1sdlzYN0Nu/fzioNo7BCsf0S7Igwd8p1EOTgyOEF6TlUDpD4nHm5EK:Mb1o18lzYNn0pjOm6TlUDpD4ncEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441183, "uuid": "46dd15c0-f0cd-4768-828d-c5372ef0d5a0", "value": 8061076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441183, "uuid": "1c7187c9-14b4-46a3-ba52-54c0ce70147f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441183, "uuid": "ffedc902-ad77-4a74-8c12-4e4f183637c5", "value": "kvmirqd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36edec37-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402197, "uuid": "c5acfc3a-ae54-4d49-8822-c37b529aab36", "comment": "Malware payload (Mirai)", "value": "39c1ba8b2a2e9fe4e891c9cf8197908c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402197, "uuid": "d2341786-b5d8-4c9d-a517-1b56af005ca5", "comment": "Malware payload (Mirai)", "value": "47211bc5318a0a940a9bbd822a712ad392f5bf7259f343b126ceaf1a03959ce2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402197, "uuid": "512c3093-d68f-48e8-89df-3635314cdf9b", "comment": "Malware payload (Mirai)", "value": "5f6a38a1f3c946718243409a55e717527a777d4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402197, "uuid": "c2ea1441-3060-4927-b391-8116c44f5e2b", "comment": "Malware payload (Mirai)", "value": "c00551f8629b6dd4c3f2d652212e78424816ef99c597534125b48b7c61095725f714f920b1ade05302da8336a4854748", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402197, "uuid": "d0ea657f-3563-462c-81be-bd63b29657f3", "value": "T1AAA328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402197, "uuid": "18a28165-35ea-4aac-9394-db5475d70406", "value": "1536:71ufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXA0:wbU2RC4kPCtSzWu3/3L10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402197, "uuid": "371497e8-ecbc-4027-9144-aa56aac3d49a", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402197, "uuid": "67c950fe-536f-4ea7-80d1-1e01ce7b83ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402197, "uuid": "f19e73ae-e708-4c4d-907f-3841c2fe3a59", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b78433-0cf5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771438221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438221, "uuid": "85cbb65a-b3a3-4af5-8690-160f0a1f3976", "comment": "Malware payload", "value": "f15a9674d9301de986e874439e2e6a1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438221, "uuid": "feb45700-5078-4a75-aef3-a3cb5d199426", "comment": "Malware payload", "value": "47cb9e90844ad8fa449c54a71004c729fa8f56aeb7dad02f4d364d760a0f58d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438221, "uuid": "5e489450-3e0e-4b07-913c-4f8ca68b3e62", "comment": "Malware payload", "value": "302cd93fd13d2e4f32147e8ccfa87bd708723544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438221, "uuid": "4a669ef0-3d26-4428-86f8-0fd2d95aad52", "comment": "Malware payload", "value": "d76266828d84aadf3ed401246c33f96220f8248d57d1a05c1496ffd083ce624454a45618b55bbb37882081d48282fa99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438221, "uuid": "38a548ad-52f5-442c-99b1-6fdd89eaa26e", "value": "T118C26C438B641892FFA74E34B0E999139DB2BE510CD4D9865264B7990E30380FB9A36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438221, "uuid": "031ff0bf-5250-4dba-b730-9e793379e4a0", "value": "8658e3927099de6e638b64426fa1b2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438221, "uuid": "7c95579a-27e7-4642-b60d-0a361701fda8", "value": "384:yaA/qm6iHbV+Jlpha3+y7+XJAKyMQv/uo6ki2dijqGtry8RbmL4nNy0h:dA/qm68Mnau/XqKfr20jVr5ALo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771438221, "uuid": "e87cd4e6-8024-4682-95bc-91103791e094", "value": 27608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771438221, "uuid": "257534eb-4a28-407f-8c3e-6a974c6cc0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438221, "uuid": "3c302904-8ba3-4766-af27-2212fbadd0f7", "value": "47cb9e90844ad8fa449c54a71004c729fa8f56aeb7dad02f4d364d760a0f58d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c81e69-0cc3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771416880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416880, "uuid": "fa264b01-c498-4dcf-b3f5-e21777279f0f", "comment": "Malware payload", "value": "5fdab07f60212759a94510d34548582b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416880, "uuid": "5024522c-8362-4e7a-b9e0-2899e4f8eee9", "comment": "Malware payload", "value": "4845bbe3b1f17da3783db71b6a471b9dc073c8459fe2981004fbbcd70144ec01", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416880, "uuid": "d90cd7c8-e8de-4b01-95f9-3bc39c0a8b05", "comment": "Malware payload", "value": "b7694d363b7bc937aab8395414734cafcc0ccf2b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416880, "uuid": "0bcaa859-5f88-4dd1-9a17-d1caa1c11708", "comment": "Malware payload", "value": "070ad844bb7d3e6c1ef13f4b5211d868c85309ed8745287224a8b30acbe5e25d65f380ec142b9627ea4f3ad751a24eb4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416880, "uuid": "aa0a9d6a-f76d-4335-9ed4-76761e2c69c7", "value": "T11D9633E2F326097ED87B40350EAA57602B268C4ACD479B43A4593B3C79BB6D50F58FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416880, "uuid": "529260fb-41b0-4744-8bcd-cf0d28ed19de", "value": "196608:Kn6uXpmJRWiDvGYmV6thatCCPibFsMWd+B9YSi74En71WANtLov:K6KpmTWyvBvnjaiy5O6Sit1WA38v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771416880, "uuid": "7ffd92fb-03e5-43fb-923d-7be79f77571b", "value": 9259067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771416880, "uuid": "80eec375-d3c4-4f5a-8f8e-3d592c261c0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416880, "uuid": "08539134-8ce9-4d72-83af-3b99f1d2ba70", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8f86a0-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441049, "uuid": "dfc7784d-30f2-4443-8231-9aefbab4474f", "comment": "Malware payload", "value": "bc0fc851268afdf0f63c97473825ff75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysteriousElephant", "colour": "#D3AEFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441049, "uuid": "64d2e08a-eadf-4e90-b566-8c551d903d17", "comment": "Malware payload", "value": "4885affbac1695037c5fbfc000ff54021406c5da58a14fca96dd34f6de499220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysteriousElephant", "colour": "#D3AEFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441049, "uuid": "d0cf667b-9613-498c-a095-0a88a685ce1e", "comment": "Malware payload", "value": "1ed86ea50aa7b4e1575fa1b6959e2bcb87f9e23c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysteriousElephant", "colour": "#D3AEFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441049, "uuid": "192819fc-d34e-4c81-a574-8bcde2cb3dd0", "comment": "Malware payload", "value": "951b7ec0fcd380b442975fd800243d1046a3568afb5736a0a241d54595830545f6c60404f12acc2f2b587f745964eda2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysteriousElephant", "colour": "#D3AEFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441049, "uuid": "d4c30dac-fd97-4af3-9d93-3dd4e3069a11", "value": "T1222612259C71EF2AF57909385362AF9A421C2A3A03F4820C756EDF4F3796B95307E14E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441049, "uuid": "9e4a4600-9e94-4846-b9a8-d618f71249c4", "value": "e64cff6f352ab568e2f5aa654f3aa703", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441049, "uuid": "a90cf88c-1df0-4183-90c3-361d183f2dde", "value": "98304:SsI+1hjr5GLR+g2JsI+1hjr5GLR+g2JsI+1hjr5GLR+g2JsI+1hjr5GLR+g27Tsm:SsI+rCcgesI+rCcgesI+rCcgesI+rCcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441049, "uuid": "77bf458e-1cf4-4db5-b7ba-909dec258a34", "value": 4453888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441049, "uuid": "645d6089-623e-48de-ad27-19c7481c89ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441049, "uuid": "f5a94b09-4b79-49f7-85cd-dc697f0a43b5", "value": "debugger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ebbfaf-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771406833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406833, "uuid": "7a91735d-0fae-4314-8cb9-d47784747fe5", "comment": "Malware payload (RemcosRAT)", "value": "1e1ce2f2d08ab0a5b0b87ef16d6905e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406833, "uuid": "df5046a5-0139-4413-a57c-2ce30283ce2b", "comment": "Malware payload (RemcosRAT)", "value": "4938a476ff27c7aa4ac3658b8ccbefad50245c78de2094fd08a6d619b773f623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406833, "uuid": "06b7ebb5-59d4-4fd5-acb8-e3d29ba5eeb4", "comment": "Malware payload (RemcosRAT)", "value": "90ef63cb1f0283239731f53e0df1e69998541eaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406833, "uuid": "5490eed9-3c0d-4de4-b2e3-7d5228d3811d", "comment": "Malware payload (RemcosRAT)", "value": "bac07ca65aec5af72a9d577384aaa884ec0886d05f13e3d74f52ddd6b5124d55ebde52f59cf695b002f3e4577ed745d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406833, "uuid": "6fafbc24-28a3-43b1-8551-009380f506c0", "value": "T1F965124527A9ED02D0E64FF06A71C2B41BF56E8AE921C353DFF6ADDB78363501981382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406833, "uuid": "8599624e-dcbb-4f5f-9bcb-33b0351e3bb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406833, "uuid": "0b6ae9f1-55d5-4f20-a4d2-32168ef7e67e", "value": "24576:tqu2VX9EfetbWtBK745Y5tHpgp8VWRlKfaYrYQYIMnGk6DxK5jYLLRm+mNoaJc4O:teVtE2titpYHHpgPRlKYiSkFYN+4Qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406833, "uuid": "fd4f6b7f-681e-4ac3-9137-c34d8aa27760", "value": 1542152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406833, "uuid": "aa2f7d4a-ea51-4f1d-b417-c468ee294e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406833, "uuid": "8a037f78-79d0-4db8-ad48-f8c4263a872c", "value": "TEKL\u0130F TALEBI _27803 _3423 Siparis IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb12ff2a-0c99-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771399010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399010, "uuid": "8d88051c-64a3-40be-8be4-fde2e7c924d7", "comment": "Malware payload (DarkTortilla)", "value": "45b134dcf1bae5b1f415f377b29393cd", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399010, "uuid": "acbf862b-3b65-4e19-b1c0-c3505b646311", "comment": "Malware payload (DarkTortilla)", "value": "498a318a261405e073f01eb5a715305d0f202e21bef42e9a473d92bc2db33ac9", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399010, "uuid": "68f70404-f1f9-4496-9dc1-fb0366b00cc1", "comment": "Malware payload (DarkTortilla)", "value": "91084a58f982715eac125318cb398be00c3e2546", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399010, "uuid": "e4806377-7c2f-4cd2-9bcf-05db31516575", "comment": "Malware payload (DarkTortilla)", "value": "0b07723a0541b16667c7650d1d700d9f7dd525841eeb98c0568cb934bb63f50779d90f4a7074fcecf43c3959c659437a", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399010, "uuid": "1b445634-1744-4c3f-b48b-1d0649278472", "value": "T12E5501275CC315A0C9B40FB4D2AA04E873F0C65F1555E77B6AED02F4EE66A0AD8234F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399010, "uuid": "83f59af9-afd2-4bf0-b6b3-5bcd5a095027", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399010, "uuid": "6958ed65-540e-49fd-92eb-8f9a49ca4001", "value": "24576:u/khpLT/4PPH7caoc7gCnRveYepqMKDmfC4KOSSn2M6p5eJblNB1:uKLzswaoSRveYkqM3fC41p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771399010, "uuid": "21a98245-cd74-4501-9734-77ed4837cf9c", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771399010, "uuid": "4b57bef5-7ec4-44d0-a018-96da01ab27b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399010, "uuid": "07f58af0-9476-41f9-9b09-1110b31ed583", "value": "CH2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f155d0-0cae-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771407757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407757, "uuid": "b02c444e-763b-4cdb-b372-6d9482c6855d", "comment": "Malware payload (PhantomStealer)", "value": "8c7f5198f4137de4aa6c3e2aa1bd8825", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407757, "uuid": "56569365-ab53-4bed-8453-6edd31642edb", "comment": "Malware payload (PhantomStealer)", "value": "49c4b35621349ddf337cdb4e63a4f99305d65dfe9021600c90ee94c31351fade", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407757, "uuid": "bfc19d47-e017-4ced-be14-5675a478185f", "comment": "Malware payload (PhantomStealer)", "value": "82fd4364013a2282199cce0569187e654a155d65", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407757, "uuid": "0a58cffd-afa0-4ac0-a7c1-e972d896b2a2", "comment": "Malware payload (PhantomStealer)", "value": "354c4d44a61f82e41130259aa628fa1d17b92b1d7e1adc64ce638e31623d903fd5e1062ec1d245ab2b37fbb9cd97cf8e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407757, "uuid": "9eca27d2-6dde-473a-b60e-c5f9de793695", "value": "T15226B011614FAE2A9BE8802C28FDE90E73B5469F3166330BCB37761C97CA715A1274F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407757, "uuid": "6ce99e2b-d0c5-46c1-af81-7a9a988c5252", "value": "24576:PuAWwmcIFVbYar08wSd8ONLE95pp9Z+UZpai6vUSUROgdSbDL+PCnaqr+DoecrpT:mGar072qWih3qetgYj0trmqacYcpeU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407757, "uuid": "c860d7bc-636c-4f93-9d55-053d18ff2f55", "value": 4706019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407757, "uuid": "b38dd3bc-1844-4004-8721-90deee89d341", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407757, "uuid": "8f7dcf06-29f1-4aa2-af5e-ccdc1c6fd075", "value": "e_dekont 20261802_ xxx9709900000000000000000090.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4dcbf0-0d05-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771445394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445394, "uuid": "414a7132-f43c-40e4-a207-5e7538986eae", "comment": "Malware payload", "value": "af555be5b2f72a0c2638d26186401929", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445394, "uuid": "fb0eb956-c8fa-4596-9493-97ab3be248c6", "comment": "Malware payload", "value": "49d8b8cab4a5324abbdcc9c55a55b92e050175ce45514bcf0438ee746fddadab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445394, "uuid": "3dac0ed7-3952-403e-81cf-09510198f71c", "comment": "Malware payload", "value": "624eb7371ae3a7a4a4849d5d7db47da196084e1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445394, "uuid": "01fa3d6a-eaa7-4eb2-8fc0-6ccf5e013397", "comment": "Malware payload", "value": "9d3cdd22b643f288a28e9abd87550182e37c11969a30ba6a1ba72d552e5375c96b4129258e41ce0a2f9201d4a4ca937a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445394, "uuid": "b0dcc8a6-af9c-4483-8ef4-e1ac0add6cf8", "value": "T110E32A45FC509B26C6D7217BFB4E428D372A17A9E3EE320389255F21378A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445394, "uuid": "a5e6513f-5054-4b9d-9697-063d92b6c16e", "value": "3072:z80Cqf2SJwvlqeAs4rSdu9Of04DoTyJG:o0CqflQseAsySdu9Os4MyJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445394, "uuid": "061f92ee-fa85-4f94-b306-b8bf7a50131c", "value": 150240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445394, "uuid": "39a20194-598d-4931-8cbd-251739b0e268", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445394, "uuid": "30d34085-c508-4284-8619-aaa2f52daf5b", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428209c1-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402217, "uuid": "fbd9b79f-e3c1-4c71-a06b-0b454cb9fc90", "comment": "Malware payload (Mirai)", "value": "cea1e30a909111f336b286b27cb42f42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402217, "uuid": "b15ad3a1-64e7-4812-9d63-73c4c27add6b", "comment": "Malware payload (Mirai)", "value": "4a7012327dbcf34c13f88a11977950c9a59168f5da3d5c77f5b73782bc940a44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402217, "uuid": "536c8dec-affb-4f8a-b3db-80f6c8fa49fe", "comment": "Malware payload (Mirai)", "value": "2cc077bbfa37c23f4579b7e441d5929873c481aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402217, "uuid": "7a0143a0-f8db-4c4c-a98d-b5375a9331a6", "comment": "Malware payload (Mirai)", "value": "b8479c49c88fc4255af034446715f72214408a99ef10b52fc22ceaeed96a0ee20c37b15c066de5aa6069b879ff61f29b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402217, "uuid": "f7f9eb79-f094-45ce-9daa-2b4f662dcdd9", "value": "T141930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402217, "uuid": "2eccdc74-b3e2-46ca-80d4-4f93b27b21a7", "value": "1536:wqnZK8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1YYn:C8NUv5nTacgzafVAwe4BNRIbT2gXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402217, "uuid": "55aeaefd-4c96-443b-ac47-c71fb50a4afa", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402217, "uuid": "af0a56a6-7dc2-4ef7-85cc-3fe04ed2106d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402217, "uuid": "f5c2b75a-e2ea-407e-abfd-7f104d28b53c", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f807da42-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441176, "uuid": "e6a04162-a0ba-463d-8237-d5b19e1e912e", "comment": "Malware payload (Mirai)", "value": "113a6444d87fe59cac7429a4442d322b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441176, "uuid": "f81c6f66-458f-4051-a301-a9b0822a4a32", "comment": "Malware payload (Mirai)", "value": "4abc96acc174f8c134d5285322606fc07ff9a423f6eca00a8a18d83258951501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441176, "uuid": "a233d965-4a03-401f-aebd-1215a73b1980", "comment": "Malware payload (Mirai)", "value": "98ca519d30bbd80fa5f7e61e2b0429b50c302dea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441176, "uuid": "f4e1cdc8-3e48-40de-9e4f-1842cd471031", "comment": "Malware payload (Mirai)", "value": "14275295d4433a17406b40409f50f0712d163d523e745da6b6628ab1757938881d4c6072f4bf46f77d4eee21e302201c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441176, "uuid": "54f54efc-6e94-482b-94f9-e0f58b757ee5", "value": "T18FA533C518D4D201FDF8FCA9A1390ED11A472013ABFBF892432A7C5A18D45A95EFD71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441176, "uuid": "b2b77731-00d9-4bbe-8fb7-d8db1ab8ae9c", "value": "49152:HX9gStb65bOpTC3/q3WbxJ+8R4oN16sWmIM1q24M:HXfVps/qkT+G4oN1635WqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441176, "uuid": "26aba14d-788e-4a49-bd57-3d4557ae8254", "value": 2108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441176, "uuid": "7be4a8e2-a69b-47e7-a170-08ae398a2d69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441176, "uuid": "bec046d3-0fa6-4dca-886f-3203f2b56dc1", "value": "ip6addrd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280d64c5-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771445981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445981, "uuid": "bf587a0e-5439-46f9-b90b-7580c0e3616a", "comment": "Malware payload (Mirai)", "value": "5c1bd2f78b97fc923c45ebf819cb0455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445981, "uuid": "42847b13-ce6e-463b-b6c0-02b85cae38f5", "comment": "Malware payload (Mirai)", "value": "4ae515f6edaeb5a85ba227ff378681e9d56bfa66e1907accc3a102f0d345f83a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445981, "uuid": "65608223-6dce-4ebf-840f-942e4b22523b", "comment": "Malware payload (Mirai)", "value": "8f6acec292564b71f567da8f9fd1c34110dabc13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445981, "uuid": "080d89ce-ac7c-4f2e-a294-f3ebdd13acec", "comment": "Malware payload (Mirai)", "value": "6e6543eb7cf6f87f7b37267b9bc402494a133b39541cb438e7fcae8a825b8f5b4953b0ba7f926502edd6fe0d255d0756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445981, "uuid": "0dac7dea-e8af-4dfa-aa9e-1d2847a3611f", "value": "T175D33B06731C0A47D2633EB43A3F27E193EFDA8121E4F644255FAB8A9171E321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445981, "uuid": "a71e41e0-99e7-4171-becc-2ceb2f8208b9", "value": "1536:bz94fQVaghEZmTA1FboAExfTIoEPtn2n+Y7bQ4znvAbj00WulzNsq1GcsywJ4:bzZEIE1poAEx7Et27k4kbt3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445981, "uuid": "487166e1-6132-491c-8b50-c8e87ddcd987", "value": 138132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445981, "uuid": "72ad3725-baa6-41b2-b968-14de120a829d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445981, "uuid": "ac96f87f-01ce-4c50-be0b-28ff6437a5ed", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9619f56-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771406791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406791, "uuid": "1811d410-4d2a-427f-802a-3569f6c94498", "comment": "Malware payload (VIPKeylogger)", "value": "746e5db70c7b640e97d3ee1992ec4cfc", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406791, "uuid": "29113490-5afd-48da-83a5-ce00a1121132", "comment": "Malware payload (VIPKeylogger)", "value": "4af6bd47196aede1b8125d4e791b6538f5a01e0a5f3b4d2d1bef43e67066ba15", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406791, "uuid": "bba8fc90-7e70-4a4e-8555-b3f31ba13980", "comment": "Malware payload (VIPKeylogger)", "value": "eaff22d47ab4eafdd5484e581ac99ab8b304e1c0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406791, "uuid": "0b4b4fe6-eb70-4162-93c8-90ca24725d1a", "comment": "Malware payload (VIPKeylogger)", "value": "c4ed0219b90c0bf9afc715a57f30c6bac624094291d411df19ea50d8699bb948e930c978cc40b56649a055b620eb037d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406791, "uuid": "4bdd8c68-6aea-40ae-aa4c-49a74beb202d", "value": "T10F451AA6D04D7BB9A4AEEAFD3A497B322C8E09D007643B383470961B5346F0B8D5FD15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406791, "uuid": "588247ff-d37b-48a7-8a86-8998eb7c069f", "value": "192:4RgNCl/3COC6Rm8iHS9yE9VQGG9m5BMxKD2YR+cJxRoizG+9lo7PfRYAYCc7bRcw:Dw05Wxdnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406791, "uuid": "2386ad7c-430e-40bc-a993-0c6593ea8c0b", "value": 1248800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406791, "uuid": "59e4beba-322b-40a2-8314-d2776254dc45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406791, "uuid": "f9d909e8-a790-4f86-b001-346af29d61f4", "value": "746e5db70c7b640e97d3ee1992ec4cfc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04078e2e-0cad-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771407266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407266, "uuid": "9e59e3d6-ae23-43ad-a339-c837f2c54f7d", "comment": "Malware payload (Vidar)", "value": "f477415cf10a802034cdbeedf00508b0", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407266, "uuid": "603ae65a-f31b-4241-9a5a-5d708a820f8b", "comment": "Malware payload (Vidar)", "value": "4b654dea03a97d6377b85785bc4075302b230aa68089beddaf3fe32828f7ed78", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407266, "uuid": "0213ae7a-165d-40bf-842d-7e49f8881230", "comment": "Malware payload (Vidar)", "value": "df9f22b1ecef0653bff1a91cc1c5658674e15c99", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407266, "uuid": "981497bc-7b63-4952-a595-807145144410", "comment": "Malware payload (Vidar)", "value": "5913cf64b4eae5cc6c6071836a8acdaae93367d3e2c78af865e2fde021194ddfe31d164d8bddeaa6f50c410226f688b6", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407266, "uuid": "4768c1b5-f773-4eb6-a499-7fc58d20b64c", "value": "T1D2F54C02BCA919BAD67FF130507012617770749803323BD71AAD65BA1D7AAD82F3F768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407266, "uuid": "a2e9d86b-6548-4a11-b77d-f616e790759a", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407266, "uuid": "16d8d945-6264-4caa-9f92-228b1a6a39b1", "value": "49152:Xq5s3DpqBMDYeVQ3w3NFKs/y4vmG/jBbUrNhvraaXBpDmoaaStzBuxSuD4lvw9iv:6K3UDiKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407266, "uuid": "3d95f179-bb1c-45ab-9c9f-515edaf3f128", "value": 3324928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407266, "uuid": "764578f7-e7e6-4d77-807c-c91bc16ca5ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407266, "uuid": "b797c26b-7fa0-4323-9370-3afc81d6cb60", "value": "Licence_Version_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43783f90-0cd1-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771422834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422834, "uuid": "7641bbec-8b69-40a4-998b-74fc44be372a", "comment": "Malware payload (XWorm)", "value": "13244ea0da106ebeeb0d0c9053c85170", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422834, "uuid": "b6e4129a-1fd2-487e-b49a-232764b732cd", "comment": "Malware payload (XWorm)", "value": "4b7857b0c84613d3132f968d6b0022a1cda6244fc425e0f2d5bdd79494cd6867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422834, "uuid": "d5f5d423-1c07-4d74-94c3-747903b91245", "comment": "Malware payload (XWorm)", "value": "addf00079589100ce1cf85a477d0734ee6b18f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422834, "uuid": "cdb4b6fe-36a6-4217-a80d-996bfda7a52b", "comment": "Malware payload (XWorm)", "value": "6a953569b3245fe3f12d507f69d2bfa7c7e2901dddbd62d6ab2f6f936bc5009feea41a3acc788954d28e91bda5d3ac1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771422834, "uuid": "6d871b23-4cd9-4e0d-ad21-82539606a5ad", "value": "T1BC45FB7B70393DAA9CCE90664C341C8DCE1B9231B91620CDBFA585CEE39046755E98BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771422834, "uuid": "eb918064-1f1b-4ed7-9d50-39cea15b2f34", "value": "768:z4ve7KOFcsIKVkXsMQxPOqLT/Fm6KEYKcoN5rFMhNcZu61Yb:cIKKcEMkRmVsrLY61Yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771422834, "uuid": "c06e4310-820b-4e7d-a816-f9764cb63f31", "value": 1232586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771422834, "uuid": "7d949d5e-96dd-4f31-a1ca-b0c9d51514b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771422834, "uuid": "a5db6bb1-6eb3-4f20-a25b-bf895d523a71", "value": "RFQSSOS-015746_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8162db-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433082, "uuid": "4dd8158b-b577-4edc-bc37-c109e53890fa", "comment": "Malware payload (Mirai)", "value": "eae037112be292519ec0cf26c67acfc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433082, "uuid": "c6ba93a0-7c57-46c7-b437-2d25c0e2c715", "comment": "Malware payload (Mirai)", "value": "4c929497b3e360a85136bfd75abd2b57a30c294ee833642a71dff035d9c535b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433082, "uuid": "08a4d6f8-e6e3-42f3-8c82-ada63f72e1a4", "comment": "Malware payload (Mirai)", "value": "62fccf52124202a4bffbdbf17689e9c76c9f764a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433082, "uuid": "614b71bc-55f6-4c34-af64-c24fa2b8c99d", "comment": "Malware payload (Mirai)", "value": "33e8083c88bfd6552f9f98c1b038bf60c36817ab8ce2407b4b6dcf099eb34e4d0b3bcbe139d97d8ed78c940927eb3216", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433082, "uuid": "05d6d89a-f779-424e-8086-eb31c4826728", "value": "T1C8E3F649ED41AB00D5D536FAFE4E428973534B6CE3FA7102EE245B2123CAA6F0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433082, "uuid": "4d4be064-ff84-4189-b8d0-9719f71a5fbc", "value": "3072:Z7Yinkzc6QgeTRy4J1jPJIqxpY2WZZUqa/u9iyV8wSflCIhfzy4q1tUaxz:RYinkzc6mTRy4JhJ1pYHyqa/giyV8wS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433082, "uuid": "244b78c1-c994-4b6e-ab88-4e39ad67b9f0", "value": 145128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433082, "uuid": "3c4b3acf-0dbf-44e3-ae9d-73242e784853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433082, "uuid": "31f4d0cf-0bf1-439e-b0db-983574184c28", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9df8b0-0cd5-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771424591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424591, "uuid": "18ba1814-5be3-47f2-892c-1b6b10303471", "comment": "Malware payload (Vidar)", "value": "272a4123f231ff4d79405d72dc4e2f2c", "object_relation": "md5", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424591, "uuid": "eecb8232-c24f-4c90-a0a7-a34ecd6bad34", "comment": "Malware payload (Vidar)", "value": "4d3f539a225854995af6c0c6c374ed800099e9dbbd1d3cc1af9c8bf2aa86a5a8", "object_relation": "sha256", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424591, "uuid": "dc783444-aa98-405c-92eb-041d98e83320", "comment": "Malware payload (Vidar)", "value": "49c5613c51c13fe680dc0a3d270b8b571033abb4", "object_relation": "sha1", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424591, "uuid": "4dd0d158-d57a-42d8-95c4-828063f1c6b1", "comment": "Malware payload (Vidar)", "value": "1ccb80c8effd7f07b5d185a1e0e77ac754162c19a0bcec260cab63c9c6eaa43d0dbb125a81567d3fdb364ee96e2f9e52", "object_relation": "sha3-384", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424591, "uuid": "7cd140ef-c86c-4c87-b0b0-f8edebbc9a24", "value": "T1764633A9C2CBD043D289F7AFE19987C821D3E569007E4F8096FC1D91B76EE6B9481718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424591, "uuid": "36024bdf-db31-4ec5-bedc-1eb9cd6f5947", "value": "98304:3esZDPyPlUJU7xEDUs/YBmcBp5K/B8q8pdNValfvHzEqt71CsDmQSK4:5ZDPIDuztWGUNQl3HXt78sDm9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771424591, "uuid": "0090b6ec-d41c-4ef3-a243-9f5d98282658", "value": 5488998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771424591, "uuid": "515d2f22-57f9-4759-8167-5dbc18f5c588", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424591, "uuid": "b6e64dfd-a112-4dc3-a5b4-aebee441f50c", "value": "\u0412\u043e\u043etsta\u0440\u0440\u0435\u0433\u0443\u043ess.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3686bb2e-0c66-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771376856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376856, "uuid": "325c1cac-36d0-4044-b27b-3ae45430602a", "comment": "Malware payload", "value": "1609745b00c80ccc50ed2daa7aa80ec1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376856, "uuid": "9478b511-5eb4-4232-9abd-6eca85f1405a", "comment": "Malware payload", "value": "4d96d9cdae5b7b14829d6a68834c9178630894309c1553a182a88856e30b16d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376856, "uuid": "d2b9cdcb-fd6a-4b94-b172-394bd37086c3", "comment": "Malware payload", "value": "da8c5fe9a83a07ac7d19f747c6ad60bcde2124f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376856, "uuid": "ce77cf62-0773-4cbf-b2e6-fb35451c9a56", "comment": "Malware payload", "value": "2c719e4f803af55bbc39dc9b8b8e9f397680f239f674e39baf987da435cab64b94e0e14dc35620612ec337ebd0dafb59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771376856, "uuid": "b0847474-911d-4971-b8ea-a3cdce23b0ca", "value": "T16F9533A3CC7706B0CE6D0E04A5906FB8BF0D95FBD581D8BE8976A2046B39B75037A14D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771376856, "uuid": "1b0ac880-60c9-495b-a466-1da33a280a28", "value": "49152:SaoiGIou4bpyKEsNZEhVuQzbUlD0VmHnN1d:KtIEMrGZOwQb+GmHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771376856, "uuid": "c7efb6cf-d3f1-4bbc-9e68-347752794b5e", "value": 1937157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771376856, "uuid": "cdf28be1-4bb0-45d1-9ad2-714cf080d421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771376856, "uuid": "f9b879c4-9529-4c42-aaef-774391ba81fd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02228181-0cf8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439475, "uuid": "3bc4e649-a688-4335-b43a-7983ab62c1ac", "comment": "Malware payload (Mirai)", "value": "3f3f5ee9098873b7d7754bf0b7033d77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439475, "uuid": "fd9f8319-1e5f-48a4-9b5d-d8e6cbc99746", "comment": "Malware payload (Mirai)", "value": "4e1c257c6d2bee664454a0876cf97a9268cbde72c15ac7821bfc27a9e0a0a76d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439475, "uuid": "58d72bc6-66fe-416b-8a2c-002c8f614909", "comment": "Malware payload (Mirai)", "value": "3f860469a06c98a80130f0b453f2c6ef098a3db7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439475, "uuid": "69d5ce0c-e086-41f1-a8be-ef25d890cbe4", "comment": "Malware payload (Mirai)", "value": "5bb822e8855de10726597016fc9423b4eafa1a607b6070c6d2ba9853e66eeaf650d942539a83ca72f3b202a06b770514", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439475, "uuid": "a653e56a-649a-4002-b5bb-4059fc6ba687", "value": "T19AB3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439475, "uuid": "40d48d6f-a0b9-49e8-8404-648ffc9b0e91", "value": "3072:Pdub7djS5HECMP0vlyhRhFczcmVRh865xl:Pdo7djS5ECNyozcmVRbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439475, "uuid": "474473d4-75b3-4b48-9060-9be922c97d87", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439475, "uuid": "c3b362fd-da32-47b3-a99c-017f82709d68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439475, "uuid": "fd158816-f9d2-4204-8398-40dd638d55f6", "value": "rizzx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a765c6c-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406579, "uuid": "cc706a44-3ed5-429f-872e-721e577d9d90", "comment": "Malware payload", "value": "55c9272c490f05f9f1a3de96c834a5ff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406579, "uuid": "2f96e790-dc4d-48b4-b7a7-112df82d6412", "comment": "Malware payload", "value": "4f060c126d2f6ab81a62e681c1b07bc07da44afbd0418092218f521db16b0442", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406579, "uuid": "a6c7cb51-303d-4209-844b-66817297d9af", "comment": "Malware payload", "value": "da2272d58e6f01eb595075ded396e22df6c11c34", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406579, "uuid": "4a638638-2aa4-422d-9c1e-74ee39be6a0c", "comment": "Malware payload", "value": "68212d06eb3c004341c2f6d744fab99c71ba302166ad8b278b783589fb14701c479b852f6f8479de2f4793324db4cb4b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406579, "uuid": "d26d7b69-35a3-431d-ad9a-ec045e159255", "value": "T12EF2194DF9BA7B0AE7BE2C1BC13879E0C68BB6E53E7063995662089BC0DD8CF05D5540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406579, "uuid": "f979ec1e-2b41-4496-bb0f-5dc188b670ab", "value": "192:B7+MbJzCl8hEetosW6vTEa9ELXQzYYk4eIvcT0so6n7D17Rt8R4BgM2D:B77bkyEKUIEHy4Sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406579, "uuid": "a37c8a0b-692e-404e-be24-15b2b6ce5fe9", "value": 36710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406579, "uuid": "0b6eaab0-df90-465f-8982-d1aef24472d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406579, "uuid": "e3d79a57-911d-443a-b06e-5f175729727d", "value": "Order Docu..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51081f35-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441325, "uuid": "56fef923-08b7-4939-b30c-05269e1350ec", "comment": "Malware payload (Mirai)", "value": "819a33aa58b9e316c37e77a5ff26d400", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441325, "uuid": "9ea473e6-390d-4a0b-95c9-21243567ce2b", "comment": "Malware payload (Mirai)", "value": "50b694e09efbeff05c7194bb7a092990074ade54658e0b6b2921d4ef9302423c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441325, "uuid": "3890c98f-dc55-44ca-baa4-c433c025d700", "comment": "Malware payload (Mirai)", "value": "dbf9dc2afe535a1e7c696c20a12ea8a0c681a3ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441325, "uuid": "64e5a0cd-e5a0-40b3-be28-6c20f152bb5f", "comment": "Malware payload (Mirai)", "value": "12e88b27f78d041b8c6490ee412d4a847d984e23aa7e8c8323100655f50df112f8d53f200d8e7cb9c0fb97949dde051b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441325, "uuid": "0683d2c8-292b-4678-92b4-20f30371733e", "value": "T18A861887B8D24986C5E43A37B8BD80C433635EBA8B8752566D05FE383EBE5D90E34354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441325, "uuid": "e8072b22-2fec-4db6-ae7c-9e50654d08d6", "value": "49152:BrH6wHCo6hAZJLfvSJsyK/54yk84pMih9MKY6kKI4YB/O6FjG5EB7:pTDJfvSJ75eB/OXEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441325, "uuid": "a5b9e50d-8096-46b2-819c-67b80d4a300f", "value": 8061076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441325, "uuid": "20320b86-f36d-49c0-bc9b-7e8bbf4e050e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441325, "uuid": "12203b0e-38ca-43df-9176-bdd6118d7fb4", "value": "ksnapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05d3231-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441566, "uuid": "55e26df0-aac5-49f0-b8f3-e5c531c941f0", "comment": "Malware payload", "value": "e5cd8f90bf54e855b5e5e5d1445d711e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441566, "uuid": "82020490-4a26-4e93-97ce-df8837e8cf9d", "comment": "Malware payload", "value": "5273878a02fc3de5576f27dca29eb0f8a415066aa341cc819a9177bedb3d5378", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441566, "uuid": "34e1bb1b-ba7d-4ffb-85d5-fe287fd3c8fb", "comment": "Malware payload", "value": "66664c6d7553e302fc0bb89974475d429533bd7e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441566, "uuid": "a40616ec-7535-4b43-81ad-2a73b05d46ac", "comment": "Malware payload", "value": "e10c0c0d948b49f2cc97ce2609818ba0f966c827366f0e553da9e8c7cee1a25ec4f32746d498b235fdfbd7f189b750ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441566, "uuid": "7a1ccd38-fe02-4110-bed9-9627b2d85b0d", "value": "T103E0D8C9059B44E141881D6B72BBD40C99C6878ECE019EB8BCBE7067A758B08A1C6180", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441566, "uuid": "e76a35cc-7dd5-4570-836d-9438c4753d0c", "value": "6:hMfchX9+kEDdqaIuOA9yDB2/vXUgoDu/fMhU+Q7ZYLdyr:ua/MIuz9yd2nXeDuHMUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441566, "uuid": "c09d27b6-5ece-481b-8cdd-8f2a2d686537", "value": 392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441566, "uuid": "3bb5c074-4fd8-4bbb-8c8c-de0e8010e081", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441566, "uuid": "d43ff808-71ff-4188-a526-fa2ef2b0f4c8", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362c16ef-0c9d-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771400478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400478, "uuid": "60955ece-6fb7-427d-a838-ef3eddafd9d4", "comment": "Malware payload (XWorm)", "value": "f6435589badb8bea27d6a0b767b7af14", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400478, "uuid": "50bd88cf-0179-41d4-94f3-392d1d240e11", "comment": "Malware payload (XWorm)", "value": "52f0617e83064f5b248ddb4b32417d6453a0bedcd7ff4eced405d2f66df28670", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400478, "uuid": "fd0a9958-f027-48ce-ad88-e66fa9e5b8b5", "comment": "Malware payload (XWorm)", "value": "720a9e803ccc65a21671655a0e5da510547ac375", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400478, "uuid": "c0464549-0ef5-49fc-ad4d-1e39cd0d32b4", "comment": "Malware payload (XWorm)", "value": "d1413fde0a62e0009219f420ecde56108f34e9437962a1a688f6480523874e33b0ba759d42401f9d27f688defeb40878", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400478, "uuid": "39906279-98c2-412d-89f9-04b797c68e0e", "value": "T14BF4CF0723D48E68E5BD977A856A04D547FFBB42A732DB0CAD0A10EB0D26B51DF41F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400478, "uuid": "9c8d71ba-5c3c-4682-99d8-3e5bae7dbeea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400478, "uuid": "a050d698-30c8-4546-807b-856924541632", "value": "12288:2Ys8r5p3hWg0fN8w6ZD5Ww702NUAHKbNCX0WT0D88NoV0NW+LqUvkKQmjiyZh4g:28fZNC8ZHKJCX0fI8mVS7B9Ph4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771400478, "uuid": "bac35705-fefb-4b0d-8cd8-2a426b157ada", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771400478, "uuid": "292fecb3-f90e-492d-aeef-2ceb3acf9365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400478, "uuid": "5a4ed3e0-fd44-46cc-a308-90e796669598", "value": "52f0617e83064f5b248ddb4b32417d6453a0bedcd7ff4eced405d2f66df28670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e144af21-0cad-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771407637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407637, "uuid": "9e8e0435-a3dc-42fb-84d0-0fb1064e02b5", "comment": "Malware payload (SnakeKeylogger)", "value": "3d0d5452aed53331c9a7a078401d2cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407637, "uuid": "3fe58d1b-0114-4d60-b313-4d9d293397b6", "comment": "Malware payload (SnakeKeylogger)", "value": "5372feb26154af8cce542c549282b296c94cc8fac8f6dfd64662c10f8050564b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407637, "uuid": "c8970fa5-f67b-480b-96a2-a83cc1bb1a45", "comment": "Malware payload (SnakeKeylogger)", "value": "f8de6e3efe2b74f8b2e93aba5fc2cdbcf20fd0eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407637, "uuid": "77af7578-758a-4d91-bb85-43ef4063f814", "comment": "Malware payload (SnakeKeylogger)", "value": "740000a33c4619e8f5506a7ede405baae7ef32443f99734cd95be51f4ef72e375cab88d568515a0149c61ef6f1f6df03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407637, "uuid": "82f14f05-580d-4ccd-9e11-78c16e057e2c", "value": "T1C625AE027391D062FFAB92334B5AF6115BBC79260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407637, "uuid": "5c0f7380-9a91-4927-b0fb-d64b9bf400ba", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407637, "uuid": "e24dd6ea-3276-4d5f-8db5-b41ffb4aefec", "value": "24576:95EmXFtKaL4/oFe5T9yyXYfP1ijXda6gu48hG:9PVt/LZeJbInQRa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407637, "uuid": "e1927a3c-6140-4fcc-a787-891b4a57ecf4", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407637, "uuid": "614bc04f-40ef-477f-a086-6dafc5f64122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407637, "uuid": "b21703b8-5778-47b8-867c-76509454c227", "value": "H999876545678900098877654.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fcd9c0-0cb6-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1771411319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411319, "uuid": "06f80bff-3b5f-49c5-9d94-8d29351d3388", "comment": "Malware payload (Socks5Systemz)", "value": "8f070ba2eb0df8ad40c6500654c9cb8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411319, "uuid": "ab2168dd-4af7-4cf8-a096-abe0eac9302c", "comment": "Malware payload (Socks5Systemz)", "value": "5387fedfd5dd6828a0d7efe9ec1076f4891ece46f46fb4d7af369a7d4974b2b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411319, "uuid": "98998f92-e4c3-4a92-af0a-b2308bed2b00", "comment": "Malware payload (Socks5Systemz)", "value": "32be22f03d86db35811ff73a784de7af9eeb9aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411319, "uuid": "7f0c40a2-ec03-44a9-bf6f-353866ea324c", "comment": "Malware payload (Socks5Systemz)", "value": "febf5082dadf24cce7b79eb948394ceae9aa937c851f19197b0f96823e9dd5853f937c38d154628b15074e00208d7ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411319, "uuid": "ed6bdb82-5d6f-44e7-94cf-3bcd1c19df95", "value": "T17CF53304ABA7C1B3F6A1687410258B5D4E90387734B6F1A0278CE75E9BAF2C4DD2379D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411319, "uuid": "33f90678-74d8-455b-972d-1968f2d671e6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411319, "uuid": "72ae6d5b-d29f-4238-9183-35b55cbe04c8", "value": "49152:C9F7+lwhq7qe3h2xJUHhvumCJ9OswsgX/CXDL73ZhHFNWGbrYYIHZbiCIe:MF1eqe3hJ8dJ9Z1gX/IDLbZAGb7IHZjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771411319, "uuid": "3f25dc78-af40-4c8d-b0b3-4c7cea32f16a", "value": 3533875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771411319, "uuid": "9deeadbd-ca99-4f97-9d06-013c6884fd44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411319, "uuid": "325e618d-42ef-45c7-b3ae-4c4672e95540", "value": "8f070ba2eb0df8ad40c6500654c9cb8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26503a3b-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433093, "uuid": "adb6a34d-dd36-4ed8-ac15-9aedf5403f48", "comment": "Malware payload (Mirai)", "value": "8b8412bdfccd9c6de0f7eb8cbb98cbbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433093, "uuid": "5ba57f36-1b3a-4f4f-876d-95e15848a278", "comment": "Malware payload (Mirai)", "value": "542412fb3a2b0f3704c1fd9f6eb603095f93a1676e9104339136c3aea238f608", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433093, "uuid": "29b9fdd9-2117-43de-a71b-4ee6476a953d", "comment": "Malware payload (Mirai)", "value": "846ad1b3be79ff80faaa406c5fb2e8d9020f8c6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433093, "uuid": "11ae63df-4cb7-41f4-bcd5-cb33d5758bc1", "comment": "Malware payload (Mirai)", "value": "56fbf95e7b5f7a296776ed3a2d12f4cf00bb258df9310907aa2da6b64fdbe2fa962a7626f2e718e091c39a4123753cd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433093, "uuid": "e1cc2ef1-fe33-4437-9548-6764b603a1ef", "value": "T104146CA9BA0F6C41F2C2D3F8DE4C87E13E1B35E3C7768971791212EDCAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433093, "uuid": "e2439026-7177-470b-bb19-9de5ee24a567", "value": "3072:Bxq5+DWlIzP1l0N26fxiqH0QwO9O7grSaioRplMlE/7oq:3q5+DeIzP1lq2qxVH0L7g+Eplv7oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433093, "uuid": "d544d8fc-9924-4044-b35d-56bfb8e7ac03", "value": 206832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433093, "uuid": "fcb2fe1a-1275-4709-848e-2ef95b5b527b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433093, "uuid": "9bb4c35e-51c9-408f-9be7-6b3f08ceb0af", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f2df29-0cc3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771416872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416872, "uuid": "65bdfec8-618f-43f3-bdb3-f8c71265c0cb", "comment": "Malware payload", "value": "ec1031023ed8d07c0cde1e85f2920bad", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416872, "uuid": "0a26d445-dc71-4520-b232-8f70bcd2bb37", "comment": "Malware payload", "value": "5475341cc9c749c3d9a6d0f090b369dfaef9de19b44fa10ef27e3e981f62926b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416872, "uuid": "12b3a470-c8c5-4e76-a37e-7081bd64835f", "comment": "Malware payload", "value": "2ee69cbc61edb7996121ebd9e2774652335b11ea", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416872, "uuid": "402546d1-0781-4afb-b547-5162c09874c8", "comment": "Malware payload", "value": "9f9391c33e8a9102e150c0a25c65703472787db8c7dc4c453deb13aa0f4f12f3b23e61ce3b366a469e2e6911033e4e38", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416872, "uuid": "2aabb52b-03d7-4e2d-bbf3-9a9b88028443", "value": "T189772386F758FF6BC0F393328A7E462231AB8C64874382B75915723C58B7AE40F45AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416872, "uuid": "8df60b8d-15e9-4e7d-932c-bc4509d09f0a", "value": "786432:zYjmivOQzYsAoMgAKfcZP/MoUIwQ3iS2COWPr+WJcRbtVujBPVe:EFnzYsAXKfo/0IRi2dPkVwBPVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771416872, "uuid": "5ef4c2d3-2457-4234-ae28-845cbf2903f2", "value": 33590127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771416872, "uuid": "f8229087-fde0-4d71-8d5b-3343494ebbf0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416872, "uuid": "f9ba7faf-d71b-4c6d-9f63-724763f2199b", "value": "Ibo-Pro-Player_3.9.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04ecc3c-0c6d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771380094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771380094, "uuid": "067fa26e-42b1-4b28-b9b2-6724926d68d0", "comment": "Malware payload (Mirai)", "value": "94cbf514ba21d63399ddde8f14dbca18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771380094, "uuid": "6f637eb7-09e3-4c50-9ecc-530533a8698c", "comment": "Malware payload (Mirai)", "value": "5487767cd817a57dc1fbf77509cab82462bb2b8bbaa727509b9661ea09ccac75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771380094, "uuid": "3285658b-fa11-4bf5-b575-2b80279a84cf", "comment": "Malware payload (Mirai)", "value": "17fd19900a30029f100c91bb645b4bd9f77fe0b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771380094, "uuid": "56943dd6-d7b5-4c38-b1f8-23daebfb23ce", "comment": "Malware payload (Mirai)", "value": "a2b17243b6e18192fcbedd626703044455d58c5d65894f8b352864c1250300ddfe4b476fbed7d33d697ffc87297568bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771380094, "uuid": "803f6a89-29be-4940-86de-40de33f2fb8c", "value": "T1E8D47E9CFE5E3C42E2D7E2789A4D87E1732771E4D32391A33982430CD5CA9E98BB1552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771380094, "uuid": "ef18dd11-f0a9-4759-8297-a2d11457ea77", "value": "12288:pl3W3VPthMnMR2icfgOuchACX6k0MZyayU4oRoaWw5nzUNUVMq8:b3WFPth4T45chLX6FM64bIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771380094, "uuid": "e497a16a-2c5b-414e-b7d3-980515e97d2b", "value": 653616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771380094, "uuid": "ea0b34e5-bb55-4617-adc9-63cb59e16947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771380094, "uuid": "e3106873-35bc-40b5-ab39-14e65d21a296", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa77138-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439471, "uuid": "537703ec-f2ee-48a3-8a43-1075273f5cdd", "comment": "Malware payload (Mirai)", "value": "ed0c56d86f82cf5f3594f45b2165cbcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439471, "uuid": "0322a76a-fd9c-42c1-9194-e05f1304b3f9", "comment": "Malware payload (Mirai)", "value": "54b6c012bd3bcda4dac68ff91783687efecb33da8c034c3da78503c4053553e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439471, "uuid": "2a4fe55f-6fa3-43b3-827c-6a4238f31628", "comment": "Malware payload (Mirai)", "value": "732c5e609dc2b4f09345dbcd211503b9682f8840", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439471, "uuid": "52d28d3f-58b5-460e-9ba9-aec4b07d215b", "comment": "Malware payload (Mirai)", "value": "f5b6a5518a377006ef4b3e134310570b8b9af82b55fba71e5ed5958f7aaf9861f568299823f22149ade081d7ad6d7d77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439471, "uuid": "b2a11f1f-7d74-41c7-b6ef-5d2ddfbac0c5", "value": "T17D03F17A91D5492DD09B43707CCEFF4F41289468CAFDD0BABA98A036A494BFC295C0D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439471, "uuid": "22da3d11-dbf9-43d4-adbf-e26446e0e970", "value": "768:+2rJeRm10OTa7HEOerokYnVAn5/3TUzeekH7I2r5fDnUnbcuyD7UHQRjZ:T2fnerokYVO3akZDnUnouy8HyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439471, "uuid": "afec2644-767c-4db4-b6ab-c35244af5b45", "value": 41304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439471, "uuid": "d920ff15-9c79-462c-a2c9-e1d0ed5642de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439471, "uuid": "9c1658c5-ed3c-460a-967b-c7d9c1adf840", "value": "rizzx.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0cb1df-0d03-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771444293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444293, "uuid": "d60a3244-9c3c-4cbd-b725-be3d0ffe5c99", "comment": "Malware payload", "value": "2e50e0672fd1932c417873df436d3963", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444293, "uuid": "30b2d317-91a9-43f7-90b1-3fa315078c80", "comment": "Malware payload", "value": "54cda851e06b831f9f3f96e309789abd5fac1fba930ce0c422a17dca41d72afd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444293, "uuid": "20e6071c-dda3-40f5-ba9f-a8f32e8903d2", "comment": "Malware payload", "value": "dbd1fae966ccf175cc06669576aafce7159f5e2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444293, "uuid": "fa8024ec-2f17-4b6f-8876-7a72842f316f", "comment": "Malware payload", "value": "2c6ee6e1507900d167f8f1d09b35a13183749d0a4cbb8e3fe69cbf79dac63aa51fbd244b55337c30eb3050d4687b180a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444293, "uuid": "65404d37-7eb1-4138-9288-2449139e9b34", "value": "T111E34B1AB4C098FEC899C2744FAAF137D971F4195234B59F27D8AB222F4EE202F5D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444293, "uuid": "4848dcf1-0ef4-438d-8a94-254712ff534e", "value": "3072:509NhGv7fVzGTTBeG+6R7vb1g5ACVieuLTHH:2VGgvJbOcHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771444293, "uuid": "7492d005-9f3e-4d25-b6af-4b71389df33b", "value": 155816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771444293, "uuid": "5e42a9ed-c0a1-4119-a450-37e74b1e6cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444293, "uuid": "550505f8-304e-4f60-8194-59771f27f923", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a2cb6e-0cb3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771410226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410226, "uuid": "7e5c2a82-9665-40af-8c40-7b2103646fc2", "comment": "Malware payload", "value": "cc001b06ac7e7d38b0ecd0828d6895d3", "object_relation": "md5", "Tag": [ { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410226, "uuid": "5661a22e-c74f-44ac-8708-556c6c872dea", "comment": "Malware payload", "value": "5648061d72abbadaa4c0912870ba0766d0fcef63524a76dbb86c36b52697205e", "object_relation": "sha256", "Tag": [ { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410226, "uuid": "e96d799d-805b-4453-91c3-ca41eadd0256", "comment": "Malware payload", "value": "8deb878d12d36be691b1390fe04d411ef0e6e46a", "object_relation": "sha1", "Tag": [ { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410226, "uuid": "cba93c8a-33dd-4991-a1fc-8fce9798260e", "comment": "Malware payload", "value": "23e26bce97274a5910c0e17910aac5600a9cd2f58121e857e7cd13ae4f94444b7920d9d29aaf8d46a8a6601ed1042f6d", "object_relation": "sha3-384", "Tag": [ { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410226, "uuid": "6909a67d-fd71-4568-86bc-8929a3259627", "value": "T19F1733A4CC3A7DCEA835B345E4322268FD02874BA594B82F7D46E9D45D8603EF4772B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410226, "uuid": "0685f4f7-34db-43cf-b72e-8b999a21d631", "value": "393216:MnXLQKnXLQJnXLQ3fHhI2w3D6nXLQeaJ59pgsIEP1mrgQB:6JiIfHHkPxNygQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771410226, "uuid": "25b0286a-2f64-4351-9e4e-e372d95c5577", "value": 19119051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771410226, "uuid": "c16e800e-f1c0-4a54-a7a2-3a9f2714c9f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410226, "uuid": "e6817357-6a70-42dd-b277-fa4051d8aa9c", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8d5aa1-0caa-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771406394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406394, "uuid": "08e87caa-6fdb-42a4-9edc-6d6c0fd08944", "comment": "Malware payload (AgentTesla)", "value": "41d1225c13abe2bff29d26ef07fa614f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406394, "uuid": "e87842ef-8de4-4aa9-a55d-b73d04fd6d0c", "comment": "Malware payload (AgentTesla)", "value": "56b090f830a67ccc93611771a790d7625db37ba50f3538687cf3339eb6f9e4e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406394, "uuid": "2852dfd0-e97f-4de2-a108-64be5a67fef4", "comment": "Malware payload (AgentTesla)", "value": "b62f655181cc5027ae0dd5f23b06d759e064f16f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406394, "uuid": "4ddd35c1-a020-4b39-a115-feb8121e24d4", "comment": "Malware payload (AgentTesla)", "value": "77480c5bab425a5d9c4225be0402ad6621b265171c1b330f7bf2ad5fb371087960efc50ab06ad8871e14a9559a655484", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406394, "uuid": "0d730480-777a-4635-a926-568004d09b54", "value": "T182659E89B46FDF1B697B660D40BCA46B937048D6919AF71FDF66EEA91FE3300012B041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406394, "uuid": "ad5ee046-83c6-4665-908d-b5a54c3bfa22", "value": "24576:ZBfXg8NoTlFJamk4rleV0kbbaoZbzZghgPI0imtdcBNFT1bra0dO2L8AX1/6cvqF:3/N4omk4ReJXZXSgPICaBNFTFa0dO2Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406394, "uuid": "3e78ce48-91b2-4416-91ef-5616d4e5b567", "value": 1444299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406394, "uuid": "acf0dad9-5006-4895-9cfd-99eded709efa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406394, "uuid": "711ee8fb-5b62-4a2c-85f6-7d051535f419", "value": "140010839520269100.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0768f5dc-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441202, "uuid": "12d19b7d-3a54-4773-90ae-57dbab597f9f", "comment": "Malware payload (Mirai)", "value": "fb05069243d1bed49ebac8b9814dacf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441202, "uuid": "0fa0656b-2422-4a99-b88c-b6c62a27402a", "comment": "Malware payload (Mirai)", "value": "56b47e1ca1a9cf3baf5fb22a8ddc7efea8580916ec609b0cf820970c928a2cf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441202, "uuid": "84fd2d52-7f5a-4e76-b3d8-4a8f60826b5a", "comment": "Malware payload (Mirai)", "value": "4c94778d471b2dfde5f19eb02d3e7745b3c7108a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441202, "uuid": "a47ad051-7af3-4844-84d8-4c44a5a84ce0", "comment": "Malware payload (Mirai)", "value": "587d56b93cfff54007d3059ddb787686339f2765bd1dc2789b3ab93f852f74c1c9216334c861e0503749b5c9463af8e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441202, "uuid": "69b3e18c-c4a2-4bdd-8e65-20aab0dc43df", "value": "T1C234B71A3A21DFFFF56C863047B38A3056E976952AD19746F25CD71C1F2028E680FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441202, "uuid": "2950979d-30ae-4eac-823c-cd90178473ae", "value": "6144:Uz95xUSn6Ue8Otn1hTd99Dbm90NCcZRscGVLkhWMD:SUoSd99nm90NCcZRscGVLkhWMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441202, "uuid": "d5052df1-8c36-4fe9-8eea-c50522dcc857", "value": 236973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441202, "uuid": "76483980-d638-40a0-bd4a-70baefd2bc48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441202, "uuid": "526855d8-4960-4e41-91b3-58208c880340", "value": "mynode.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b0c27a-0ce5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771431319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431319, "uuid": "3529a8d8-2a42-42a3-8cd3-060dd253d41b", "comment": "Malware payload", "value": "0507b89eeb35741df61eeff7769b3397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431319, "uuid": "63d52794-b648-4158-b0d4-a5300c04b966", "comment": "Malware payload", "value": "5701dabdba685b903a84de6977a9f946accc08acf2111e5d91bc189a83c3faea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431319, "uuid": "59d7af24-eb6a-43c8-867d-95b34d0dc46f", "comment": "Malware payload", "value": "253238019e1ea386d2d72584bff8eadf4f5ec5b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431319, "uuid": "dd778fb7-c7dc-4686-88c5-d0f6d6002c58", "comment": "Malware payload", "value": "895325e70ab14022a003834b935afaf22a411040793c0d7f8fb1f51cb9d21f1f1d4caec4098aa34f379a044e40dd7549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431319, "uuid": "8c42706e-16a8-4407-ab59-0e20d850f2e7", "value": "T1D8871256E2FD00E8D5BBC0B8C6575517E7B1341913309BEB66A48A692F37BE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431319, "uuid": "61bdd987-58df-4689-80fa-74fcf1534b7e", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431319, "uuid": "490bc5ff-7dd1-4c6c-9eba-530f8b739561", "value": "393216:vKxapWfkzI/r4SvhZ6sRvI9cR8vq/mQFgeyh0LfHPQu2jYvnUwEbc/81t:z48Gr/vbpvuY7Key+7PJsYPUlb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771431319, "uuid": "31639cd4-c89e-41b8-9452-427cf6bb4037", "value": 36333184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771431319, "uuid": "85f24b72-5edf-424b-a320-db46a7c2ab69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431319, "uuid": "dfa32f1a-a46c-4bb3-beff-7c310190549c", "value": "ZoomWorkspace.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772da6eb-0cf5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771438383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438383, "uuid": "cba66560-1002-4ff4-8a7f-52892ad7b249", "comment": "Malware payload", "value": "863c434d1baa380c96f9eb5f010da1d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438383, "uuid": "312ac156-9a75-453f-8b6e-f26cf80188d6", "comment": "Malware payload", "value": "5809af6b37bdfe9067765b7a3a3b3086c3c75b706ba05a77148a361359b62f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438383, "uuid": "2fcca6a6-c85f-4851-83c4-eb7a2f607c3b", "comment": "Malware payload", "value": "52cb300a1838358fcb4764bcee40f230cd08bec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438383, "uuid": "844031e4-2f05-4a40-a93f-3ae257092859", "comment": "Malware payload", "value": "4ee883fb81d896ecb99daedb7a0eedb90e70ba8167f1cd733352228cf42d6f4e790e1f7e7488456b929f67d091e63645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438383, "uuid": "6b4395d3-cc09-431c-b985-cf600ab0f211", "value": "T13E28E01663E112A6D577D138C79BA603EB72B40713309BDF329C03652F63AE45EBA760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438383, "uuid": "ed663d26-173c-4c43-86eb-6b5a77c6d956", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438383, "uuid": "cb01962a-0ff4-43d2-925b-da0c697fd808", "value": "1572864:VVDG5MiP2aVxUXMGyNCY1VJdDg11QZ/DudOaoxPN2:VVDG5NVyMNcYdDg11QIdido", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771438383, "uuid": "d669ce59-94de-4325-80c8-5849a416c8c2", "value": 96020966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771438383, "uuid": "92258957-f051-4a7c-bc57-8ef56f36c28d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438383, "uuid": "1106b463-3c0d-49b7-878d-582617cf0201", "value": "Schedule I.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb9feef-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (GORAT)", "timestamp": 1771406614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406614, "uuid": "b7b56c7a-335f-4dda-b1f4-a3a92b63ece3", "comment": "Malware payload (GORAT)", "value": "fe1e6131e9e9f60d83b74be7a87c70d2", "object_relation": "md5", "Tag": [ { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406614, "uuid": "3c49dfc3-1564-40b3-b9fd-954a13ce5d80", "comment": "Malware payload (GORAT)", "value": "580e7e527accb66f3a5364d33058c7be6112dcfd8000b00374230f95bfc4d3ca", "object_relation": "sha256", "Tag": [ { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406614, "uuid": "1c3b5f9f-a0a0-49f3-a0cd-b8ef2a068753", "comment": "Malware payload (GORAT)", "value": "55bbea16798f54cdbef34219ba8d125b128886e8", "object_relation": "sha1", "Tag": [ { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406614, "uuid": "ba99e22c-27b2-44d2-b872-b409c993bc08", "comment": "Malware payload (GORAT)", "value": "870fc172fed8025c17bab79db89e248cc8f685fe1144ed411b734723a8cb63fb67942de030e3fc9060b49d2f3fded304", "object_relation": "sha3-384", "Tag": [ { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406614, "uuid": "7b194ea5-bc23-4153-b66e-49939e8ae063", "value": "T1295136100EE61298F2B787716BF9B3B1897BB861D9394ABD004D82845773650E8A4F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406614, "uuid": "3b84e6cd-c4c3-41a9-8706-9f9a2e6cde01", "value": "24:8Ayw/BHYVKVWO+/CWnGlswIJtsmaoghs5X4wJ5CWAcEf6XimVdd79dsrabFI:8y5a6awIYag2GwJ5CdcEfCimVdJ9Aa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406614, "uuid": "4fc6b189-dd2e-4561-b03d-1da0551de68c", "value": 2950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406614, "uuid": "64fb014a-8d9b-4bc9-b3c3-cc4a83e056be", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406614, "uuid": "f25d3f33-9a33-4618-a011-814ad03ac538", "value": "WellsFargo_Estatement_02_2026.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88096382-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771407058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407058, "uuid": "23d2b049-dae4-4733-a412-b84e23d442f7", "comment": "Malware payload (VIPKeylogger)", "value": "c9debc37938dd4c7731b0de839c8bd08", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407058, "uuid": "4a2569ae-657b-4822-b572-f8231d2d98ae", "comment": "Malware payload (VIPKeylogger)", "value": "588d349625e246ab2fb2c991a898220befc3891d9f9848783519d87cdfd82e7d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407058, "uuid": "c74c6b48-a917-45db-9956-60c12bfeae03", "comment": "Malware payload (VIPKeylogger)", "value": "4afb01eec5c931ba9dc9c703c47f3afcfa5e9062", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407058, "uuid": "8da6e9e7-2e4b-4342-ab8b-449b68147117", "comment": "Malware payload (VIPKeylogger)", "value": "45af1c99e987389184394dc9f1119bc96469955c6fc590067455fdfaef36b371d1674ac714ec7aa0d643555b850891e0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407058, "uuid": "1b669702-feb5-45c2-ae84-87608b5f0532", "value": "T1874523A1FEAD6D140B95E2266095AD049AA50B4B1C4CB58F3F8C38DE0F1F6CF84765CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407058, "uuid": "e9b70d03-fc98-47fc-9614-610b2eac5900", "value": "24576:hPqoHrFARERreXnWkyk4AyYcYwUvcTqrxCN7:ZqU9sy3AmYXeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407058, "uuid": "39257ea7-bf24-4791-9110-84e006330d6d", "value": 1197105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407058, "uuid": "d6a6d69e-795a-49e9-bbda-f3d233fe9c71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407058, "uuid": "2ae9b9c1-8eec-4b92-8295-9fb7e52b5957", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0aed1d8-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439392, "uuid": "23790f9c-d13e-4557-900a-6dc31207850c", "comment": "Malware payload (Mirai)", "value": "409a08594f9e527368c3394773080b0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439392, "uuid": "736891ef-5056-44fd-84a0-4676880b0a24", "comment": "Malware payload (Mirai)", "value": "58f6f5ac44d446bb9eceb9eceb7849cdf43052e68e88dec6278d049c0c3f8e63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439392, "uuid": "d2145cd8-2982-4785-9a7c-45606756be90", "comment": "Malware payload (Mirai)", "value": "06c364187126cf9006e4c138753702fd2fde219c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439392, "uuid": "3f6416bf-1499-43cf-bdfc-62df3f0f4ebf", "comment": "Malware payload (Mirai)", "value": "cbfcea8e44105cab0a2882d8a72bc2839ecec1c2591ffbcbdefef2b3b751e5c2def45e6dfe262f7867b7fb0da800855b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439392, "uuid": "8c961553-1e35-4349-8536-c859a5251fc6", "value": "T14D9328C6B401DC7DF80FDABB4463290EB631E3611A935B26675BBE53AC321E05917F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439392, "uuid": "2660d5ce-63e0-4e80-b736-257dc3ca898c", "value": "1536:qsdLEbXJld3JWU6FRs/yeLn2lTjiGtFW6yh5Pb8bQThLbKrhsX5ZH1M0zznBheZh:qrWXFIyeLn2ldw6yhBruuZVMq6uaBrOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439392, "uuid": "c386bb2b-c012-48dc-8615-c2524a638c33", "value": 96732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439392, "uuid": "e0ff80d6-68fe-41a5-a56a-126a7c9c0775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439392, "uuid": "eee157be-1107-4f31-aca2-a0d22a0ae1cc", "value": "rizzx.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce717d4c-0c99-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771399015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399015, "uuid": "1295975c-fcf7-4a00-bd98-3359dbfd9d9a", "comment": "Malware payload (DarkTortilla)", "value": "08aca902632976774636f2556159d761", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399015, "uuid": "86b09e83-5425-470a-8517-106dd0c1a501", "comment": "Malware payload (DarkTortilla)", "value": "5930ab67fc7f8b4c21ceb60ea2eb2f7a6409582397ae248aabc214abd0e22559", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399015, "uuid": "9743bccb-ae7f-40db-b8f0-3b825ea56e38", "comment": "Malware payload (DarkTortilla)", "value": "5acbaec302ffb124c22095a4aed16aa181020f5a", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399015, "uuid": "a68afee3-4b6d-4573-822f-380b499a9219", "comment": "Malware payload (DarkTortilla)", "value": "4b001ee1d58e6d712f851ee5e27104f25278abcc5da3c5ced5ac9313db619ea077f75136c43811fce3bdcd017be9b6c5", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399015, "uuid": "8f01f08c-11b3-473e-a34f-d0210beb2caa", "value": "T1E1F4F0222D422A25C97A5FB9C06711A877F0D8432267EB7A6FFC04F46DB3759C8275E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399015, "uuid": "ce78406d-0498-429c-b821-9800873063a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399015, "uuid": "1dd47432-3b74-41be-9a4e-c0a9ca041d41", "value": "12288:XyWmMHyTGZ7qGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7UUXJblNB1c:iWRdhpLT/4PPH7caoc7XJblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771399015, "uuid": "a620138b-16f4-45a6-80a2-9cb3ae3af0fa", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771399015, "uuid": "e0e3e7cd-58c4-4be9-a2cf-c377d1cb02ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399015, "uuid": "4aeae927-53b0-4e4b-90a8-6a8dcb09607a", "value": "CH3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644d98c8-0cc3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771416876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416876, "uuid": "564da714-0a34-4e3b-b918-54f062092b5a", "comment": "Malware payload", "value": "1aed010f10b237fa4ac3ffe1c78f1486", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416876, "uuid": "aa369de2-a088-43d5-8d68-1cdcbd3a5d0e", "comment": "Malware payload", "value": "59bd5011be93e9f724a61549099ddacc7471e406c96ea25dd78cfd711ccff09f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416876, "uuid": "66ef7dce-d0e0-4e8e-a2a4-8bc3a0fc8c10", "comment": "Malware payload", "value": "635cb12556ec05041df28ce5a8c270eaef5d65d0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416876, "uuid": "04f118d1-7cea-41da-a2ba-c2287a1c81aa", "comment": "Malware payload", "value": "93626a5c21bc50b79bef0c442766a7a0ef3cbc140d557816a7277e0f4263f41c2fee58b19808c479fac26c7abd0a0642", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416876, "uuid": "0b4467c9-f3fa-4db7-aff2-22806e17e31e", "value": "T12DD5AD8AFB0C992FDCB6103A5DAA037126175C9A8D82D7433404772CB9B76C84F5ABDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416876, "uuid": "37cf4a86-925a-436a-875d-890c407f5c20", "value": "49152:ZtID0eicSd/+Nqq8F2+Va7tzlgsSic3QpmxP:ZtIkbssqTmaJOic3Qpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771416876, "uuid": "d415954a-5f36-4dec-8c0e-183c509b668b", "value": 2780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771416876, "uuid": "7dd2aa82-8160-432e-b8df-0ade158c1830", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416876, "uuid": "af58c731-8890-477d-9161-58e549cc3958", "value": "Tcpatel-tcpatee-release-1.7.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae8b449-0cbf-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1771415116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771415116, "uuid": "c0bc7e38-a796-42a5-8a04-b9f50beba281", "comment": "Malware payload (NetSupport)", "value": "1dcd74504d8668b3bc8298fd550c21bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771415116, "uuid": "7199b163-1774-4e50-8bf3-2b616abeae63", "comment": "Malware payload (NetSupport)", "value": "5abf9e91cb8ccbaa2cc4ea33ed1af830bc2a480c4d038b53c16ee1b0947dddc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771415116, "uuid": "f6c013e8-00c5-4c20-b6bb-754a40ed5095", "comment": "Malware payload (NetSupport)", "value": "9ba12c6ca232aecad4de1bd9a3c50453d3db03b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771415116, "uuid": "febfa027-ef8b-4f5f-ae3d-98afb6eb8ec7", "comment": "Malware payload (NetSupport)", "value": "1a87a2fd8bd25845f8bdb8cbf98f6b0ba29b4e89c167cbf8f2a95431582683470c49c938e19289a7351e00211a409acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771415116, "uuid": "7f5aae21-3869-497b-82c4-5cf066b5e064", "value": "T1E7D633A0A6E821FBF9EAD33DC86199A1C99635673B45C183C3F8D5A02C737C4697E704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771415116, "uuid": "4616eca7-79b7-45fb-9067-347ccba70e7a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771415116, "uuid": "dd00658a-c956-48ad-ab77-946e195d971e", "value": "196608:414oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorne8WcFUurH/P/XRLSq2KKeF:414FSsFl7dCR1C99/Lku8XWcFUuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771415116, "uuid": "150c8130-a277-467d-bf01-9fa87efb82af", "value": 13413352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771415116, "uuid": "9f93a447-2391-417b-8c4e-184ebe791c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771415116, "uuid": "b2a0dd2a-f3a3-4fe6-a5d1-7db8258eee70", "value": "1dcd74504d8668b3bc8298fd550c21bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddeec22f-0d1f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771456594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771456594, "uuid": "7552df3e-5b26-4e41-b0a1-c2f0d37a0abe", "comment": "Malware payload", "value": "a311e7fcb2d2a5d85a6643c2f6716ba2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771456594, "uuid": "44cbc6d4-b326-4878-8e55-cb478690abbb", "comment": "Malware payload", "value": "5c55cad75ef7099e261ed0133fedc73b29afa3f150d28c2922cce616edfebc37", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771456594, "uuid": "e1de8676-d78e-43e7-ac4b-f875c62896f4", "comment": "Malware payload", "value": "1e35dfb4012bd5ac3b35b55da368f68f285a2022", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771456594, "uuid": "d62ae215-3231-4549-99ed-5bab1d04c60a", "comment": "Malware payload", "value": "64da55c8a182475361e6c18b17f596f23eed658f689b0901b6fb20a022c39110b61639fe20477d2a961a2af6d83f1575", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771456594, "uuid": "7c11dc5d-f00e-42fd-98e3-db0007309abb", "value": "T1FD119889E3DF7208F85E65756297C1118E5565C4B165FC4EF84C0CC02DD243B4F8794B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771456594, "uuid": "e932ba97-cfa3-4dca-b9bf-806b391d8072", "value": "24:9HhyDq5j5xgQqxWZeWUko0IIEeF1skbSdI+AcsL8uob:9ByDq5lxgQEWZrUmFPbDjob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771456594, "uuid": "c5abc5bc-f9c8-4fe0-a262-0cfc95d732ba", "value": 1056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771456594, "uuid": "7833b330-8885-426a-aa3e-ea0df15a4626", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771456594, "uuid": "a8ae2b46-03ec-4e62-8fd7-2caa484274ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc8d04b-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439464, "uuid": "291208e6-adf3-471b-93c4-b743bfaa460c", "comment": "Malware payload (Mirai)", "value": "93d908fdf4fe448d9f34e346ae86f5b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439464, "uuid": "ed25de01-8998-4026-a28e-6a6306cecf8d", "comment": "Malware payload (Mirai)", "value": "5c705c70e87615cd2d226105f2079a95836db427c84d38baa2bb821daa881cf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439464, "uuid": "a4441f22-49a6-475d-ab84-2253939d3351", "comment": "Malware payload (Mirai)", "value": "ebd2178711ffe1b6f1d5bb8c7860bf74e2c65720", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439464, "uuid": "e91ddb5a-953c-484e-b5cc-69042ca384a0", "comment": "Malware payload (Mirai)", "value": "7e318752d9c9fde7d01467489654d6815081796f0ccd3007e4cef0bf295ae3fe6e61dc8a58b2848c9b89a74bb073d284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439464, "uuid": "5e620a5b-1682-4892-8811-5a6dc69213fe", "value": "T17A13F1B761AFEABAE97618FD6E0D5384D520C51F94823FBB84F0B51D01B30122A06F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439464, "uuid": "a31dabd4-e488-4a3d-b3d2-7a99a0b6718b", "value": "768:JhIfHyA8J99JgD00/1kx+TNDCraQS8xnCO6+mFTGEXWRrKtMox+JLH/6piEj2yBd:JhIvyJ7gq+Tia+xne+mpnXmhox8LEicd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439464, "uuid": "e5f0fb24-e539-44c7-a625-b99315ad1f0f", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439464, "uuid": "00d68477-f9a7-4bcb-ad38-c2b6f4ee01f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439464, "uuid": "71a300ef-e198-48d9-bc94-4e6472872d77", "value": "rizzx.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96bf9c9-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771406711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406711, "uuid": "7227a14a-2c99-4e33-86d5-95e4029213d6", "comment": "Malware payload (RemcosRAT)", "value": "27ee39bbd9bfb9fc56011dcd60d3a5e0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406711, "uuid": "d2a73837-1306-40f6-a236-1688bd9ed7b9", "comment": "Malware payload (RemcosRAT)", "value": "5e37147155a6832c3f23025e52ed90f1c7b609f72e094aa350ab91fffb919541", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406711, "uuid": "4785db1f-62c2-436f-af34-d44cc5f52cad", "comment": "Malware payload (RemcosRAT)", "value": "f8a9991f9e9f0d710a3bb306a5b35fff602c9975", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406711, "uuid": "d0501c8c-57b8-41f9-b50f-4cc3d24aa252", "comment": "Malware payload (RemcosRAT)", "value": "458ef79f6801847a6e1cd0d2db7014ddb2152ae667ba2d3dbfb307a91948c5bba16f622b02069298015e2ffef10627e8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406711, "uuid": "b343939c-2328-4f1c-90d9-0c27820758eb", "value": "T132928718DA061BAC9A1232FD09305418BB67865B7131AA53FB5E0B0DAF518CCD6FD3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406711, "uuid": "7959cc63-a833-4ce1-b116-5279b7f0ead4", "value": "384:6ym9PVSCMz9+dw1jhU31MaJpXJhEOa7BVy3:6ym7MpJ8WV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406711, "uuid": "0143e6e2-dfa3-4498-b4ec-962634d880cf", "value": 20796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406711, "uuid": "ce42e9b3-c672-478b-a484-0fa7dd35deee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406711, "uuid": "a3d4784d-5505-4236-9979-5de6f3f0b1f6", "value": "SCAN-35327-COMMERCIAL-BL,CI.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b895fd11-0c74-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771383087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771383087, "uuid": "045951f7-ae95-46cb-914d-fbdb0ed723ce", "comment": "Malware payload", "value": "5db74f230d1defc0abfcccf630a5cfb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771383087, "uuid": "603a4e7a-7ead-44ff-87c5-03a678f51237", "comment": "Malware payload", "value": "5e9cec17af3ff7ebc3c5dda2d6c31f12333108b89da5337d2192e282763ed8cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771383087, "uuid": "93565168-e21e-4066-9fec-90a601aeb6e2", "comment": "Malware payload", "value": "eb780c4afa07e7fc7042f7f55ffa3b185c9dfae2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771383087, "uuid": "d8aa1409-7907-4b9c-b153-a825badfc60a", "comment": "Malware payload", "value": "2d4220fd5a03a9eaff05505980d088978e022a400d0d51753fb11fa4fb2392f5e2084dc3f653e0d14f643fa5584e9a9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771383087, "uuid": "4755c0ad-47ef-4146-bdfe-3af133259f6f", "value": "T18D25E8117D7EB453EACCF6347721A2E9301F7684D9E59036DEA0CEA946E4B64CE23432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771383087, "uuid": "9c9ad29f-2d6c-47c3-b0e2-f6d731ad0627", "value": "24576:Sld0B3vWrPXBQSH14vgeNMok2/saPS/9HIZh7pNCDhG9GGNy8uCGUGan5oxOe5in:Slds3UPXBQSH14vZh7pIDhG9By8uCGUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771383087, "uuid": "d0734183-5f39-42b9-9d32-17f07ac0a46b", "value": 1048092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771383087, "uuid": "7d32d862-5a11-42a9-9860-8ac0c53f4469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771383087, "uuid": "397df792-089b-44a6-a6ab-99f867ecabe7", "value": "kinsing_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb5f67a-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771445987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445987, "uuid": "fa9d60e7-6c32-4697-b1cd-88a5eb44f22b", "comment": "Malware payload (Mirai)", "value": "0d012f78103c5a5a49f102e2254acad5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445987, "uuid": "a5606966-2d4a-449c-9f5c-7c1fc739eb2e", "comment": "Malware payload (Mirai)", "value": "5ea5a9f024b8cf8f217ef8e1dfc00021c1ea1a6bedaed3c7f927c4d490123a75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445987, "uuid": "4fa69b4c-d8fe-4df9-953e-02646e4e240c", "comment": "Malware payload (Mirai)", "value": "9184cc3cb901debccaf26c799f75789aba2b9a0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445987, "uuid": "16d365e3-9928-4f3d-8d44-807c3cee548e", "comment": "Malware payload (Mirai)", "value": "faa2d55608c3cd9d0824e87e2f9d4e1de1818fba935edf0a04848ff4ffa24e4c162148dc37cd75a623956cc2a0ad35a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445987, "uuid": "a2cbc6bb-23db-4229-abd2-61abd8ebac54", "value": "T1CF934AC4E683D4F1EC5705B56137F3369732E436202DEA47D369AD36ECA2950DA0B3A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445987, "uuid": "b0848524-9957-4a75-986a-b96f7c7cb5e5", "value": "1536:5jjgcjCiP5qc0iY9pPJzJrdCTAiPq7RcPWivzNosjq9KQvOTSTflH8I1:5vZjCiP5dFYjJzJwdPEwWivBjK/O+TZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445987, "uuid": "0f436111-22d4-406c-baae-f891d3f435e6", "value": 94252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445987, "uuid": "5916cdbf-7e9a-4764-9117-afdc0f947f6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445987, "uuid": "a34fc8ac-f43a-4f03-aec1-f8ba908648f8", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c00a1a-0d0d-11f1-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1771448581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771448581, "uuid": "233035e2-c3c3-4750-b2ef-d18f6de4232e", "comment": "Malware payload (Phorpiex)", "value": "6199855251d7b05edb4cf99c25712c84", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771448581, "uuid": "fcc7f329-b95c-4ec1-90e9-7c8dc88f74b3", "comment": "Malware payload (Phorpiex)", "value": "5ee7c0fb726d43c3fec9c254a88240d9a032b2451ef39acb28a7f5aec36d86c9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771448581, "uuid": "63fcbcb5-31f8-41d3-8000-6117d6fe4ccf", "comment": "Malware payload (Phorpiex)", "value": "1b4ec13ad40cb581428c31911285ce77340716a2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771448581, "uuid": "8bbd8ca3-4a85-4261-9b86-e83de9d8ab4e", "comment": "Malware payload (Phorpiex)", "value": "22cbf476814dfe6e0a32bf06a91915fedf7e1d6c1974242545a9913f174489d6eabcaa7933053afb10d30bceeb18b37d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771448581, "uuid": "9e466602-72fa-4456-a24d-7e08c7b58713", "value": "T123834A00F6C0813AF4F740FBE2FB566A592CEFB8530654E753D1A5AF6B249C0A93146B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771448581, "uuid": "9096c7ca-1385-4249-810e-2e8b2f142e0c", "value": "c958c201152dd5b63a8cf3a862f1f1d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771448581, "uuid": "0b29fe1c-b928-4522-9c35-601f4eaa9f57", "value": "1536:XFv12JFmavM2QuUCq42vhhu4ApFur3pOE6bxHppKxZqoC:197OouUCUvr1Apgr3kE6bdppKxZqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771448581, "uuid": "81a4bee9-112d-4503-842e-d081b417fc74", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771448581, "uuid": "964e5581-47fd-41f5-94eb-fc9d5a849d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771448581, "uuid": "a0484a31-0732-4cbf-b61b-3004b38a09a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fae1c0-0cd4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771424125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424125, "uuid": "0c886490-d6f9-4889-abe0-e9d53c4327dd", "comment": "Malware payload", "value": "b84b5860752aa5ae32f0d378780e12a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424125, "uuid": "4fa26ebf-080a-43f3-8981-a6647fcab4d1", "comment": "Malware payload", "value": "5fc94efa584c2de2e48cab3370ebe0a54c86c1739a0def763e653f219b3187af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424125, "uuid": "97afb809-080f-4148-836e-f830b4d2e95d", "comment": "Malware payload", "value": "d70ab59d1ef3fe853ef8040d4b386f521d7a8d04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424125, "uuid": "315a1827-3be4-4037-af21-4bca22cad980", "comment": "Malware payload", "value": "f204170eaf173199b3fb622a8f5283c7d74dda3a48a0194cd4336ce6cc63514eae34e785d5220f828bbd3c122586a5a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424125, "uuid": "f52925df-e1f1-4af0-9898-f8fb1709ae1e", "value": "T1A0D433E6C8A796C7D6E3F3398400CEBE6923017D6986250BD51CE3B1E51D9361F8E932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424125, "uuid": "659fa8db-1813-446f-bdfe-9469af03e053", "value": "12288:NjuxpD7EW9dVbz340Wy3w903mEp8LCNqfpdr+XSpbbuiX:dO7EQb5XgACLCKdjpfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771424125, "uuid": "2e622324-7965-407e-882b-9bea5f7e76cf", "value": 606019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771424125, "uuid": "5b255d8c-3eb8-4f65-83eb-a84bccd99b14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424125, "uuid": "b15f235c-6fd7-4693-b64d-4b47d63ca721", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74d18cf-0d01-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771443752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771443752, "uuid": "baba4ff0-103d-4a3a-80cf-08fbcc0a74e1", "comment": "Malware payload", "value": "e050aa047edf384a195db55d7aa1cc62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771443752, "uuid": "25c347fa-fbec-4b4d-a004-f74ac9afeef9", "comment": "Malware payload", "value": "63b76ac882b1a82f10265a48939e41b5a1825c395e25f3e4ee38ea93b6a63fb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771443752, "uuid": "65f43058-612b-415a-9cbc-479c630a0a73", "comment": "Malware payload", "value": "fa593389fab70203bea33fcbf149e76a4c9bcd7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771443752, "uuid": "b38df4e6-3f04-4f2d-9ae0-9b324c32466e", "comment": "Malware payload", "value": "9fb2ac78edcf7ca4d3662a594463d4f9c543a39958643213af9b1fdadd34cfdac63d74d8a30d53fc90f9975c533cef8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771443752, "uuid": "0a3f14da-bbb5-4aa8-9e67-766066445b10", "value": "T16BC3F745A9428F11D4DB31FAFB9F429933536FA8D3F97201D9205F6127CA98B0FB2612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771443752, "uuid": "20cd16c9-018d-40fe-a9f7-139f2aa62e3f", "value": "3072:faSiveTpcce9hOMwTHxaFCRBGf2XlYHiAJ/7G4H:fmvD9h/AHxaFCRBGf21XA57G4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771443752, "uuid": "cf331ef1-4a83-44d7-830b-5795775027a0", "value": 125688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771443752, "uuid": "0adec80a-ce6a-427d-bea6-3bedfce36175", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771443752, "uuid": "17eadd31-6cfd-4502-8d6b-6e9d3069f415", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d8ce3b-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771406708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406708, "uuid": "4fd3fc19-53d2-4b96-8a28-af903e208fcf", "comment": "Malware payload (RemcosRAT)", "value": "e35525475d93bbb7501ccbd793582204", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406708, "uuid": "f83a30be-c069-403e-9231-56e69a39933a", "comment": "Malware payload (RemcosRAT)", "value": "642ffa36afdb63d7598f3fa0fa229a05ff132ddb6167ac796d15e7bdc49ae81b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406708, "uuid": "53e38e5e-3761-4453-bbe9-2717aa9817ee", "comment": "Malware payload (RemcosRAT)", "value": "eaa105cc39e93386f362fc523e1fa3c02b60f2e3", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406708, "uuid": "3116f686-dc89-4443-b067-168ccd4560d3", "comment": "Malware payload (RemcosRAT)", "value": "b2359c4277a1e33e450de8810662b361797bfa2097a8ece2791f507c79a8fef516976dcdfd1c4b2c9b07f107e6543010", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406708, "uuid": "99148b63-d8d6-4077-9e08-0ff9542241b7", "value": "T1CD9262248A061BE4D62733BC46125614E7658222E13A6F03BF9C0E5D2F32D9CEDE97DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406708, "uuid": "f560bf94-141e-4764-b62e-a605d0b2b147", "value": "384:yymhPZCOC6SWOVQX69YRiNfBogspUqy9zNVb4qc4:yymnCJz3ogwUBxVbQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406708, "uuid": "94ec1fd5-c31e-4a6c-85fb-22a2f29008a5", "value": 20405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406708, "uuid": "a93dd09b-81fd-4bdf-be2f-f984738ed587", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406708, "uuid": "d703ec85-e25d-4606-8a6f-b842a10b4967", "value": "Ferkomcelik INQUIRY,17-02-26.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dc9a9d-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406725, "uuid": "18dc9928-1c22-4be9-8b10-d3ad5030a03c", "comment": "Malware payload", "value": "c22d62b4ff5192db1d4c92e221c4c776", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406725, "uuid": "5507a839-97e9-4bf7-b0e0-76c49b5996ef", "comment": "Malware payload", "value": "646c374926cb063d7cbf80efa6c18a9ee2cec0a5c59e20c1513e2a2794334d32", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406725, "uuid": "bf0c8c2c-e434-4940-af59-e08d1dea0e30", "comment": "Malware payload", "value": "c4bff591703ca56b418596a838d482b2af3127fa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406725, "uuid": "b04a7a1d-b08a-486f-b435-d963a74bbec3", "comment": "Malware payload", "value": "accf7f07ad1d23afac019aa2c76ebaa7eb67cf4959ddbdbfb5ea8da382766836784263bbe1c66016cce4dd3740e6f11c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406725, "uuid": "2fe757bf-6ae1-4e00-bf01-bd82a66f5960", "value": "T14C963331AED52D6B0BD8C325B0BF2E367FBD4F43440DE98745E4E18A354AA85821B87D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406725, "uuid": "ebdeca6c-8070-4bb0-ac93-e0e7e5b95287", "value": "49152:PzJsesu3icyR2T4qtYZ8qMFiDL5VWwwqNRdiPCjHTSbT/WL2FWw2TitwinqIQd25:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406725, "uuid": "26bf16b3-20e0-4d7b-8aad-fae09eb4cc02", "value": 8671255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406725, "uuid": "852bef41-426e-4e55-96d3-9397b7a2cb36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406725, "uuid": "aefc1b29-8857-4632-915b-682f45c52d13", "value": "XSFFG7497IXBQuuqhbuVerdct_Icto488623PH4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86710b0c-0ce3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771430677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430677, "uuid": "36c4c9e6-adbc-4d54-9299-d537dd55d830", "comment": "Malware payload", "value": "5ea3a7a7ada432b5d07d1f1f68eef500", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430677, "uuid": "ff204e6f-92d2-40f1-9a2b-9347598b2578", "comment": "Malware payload", "value": "653094fddd7526fcd696128fbc8b441ce8d4770ffdd2e5ba41cfc8838c864122", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430677, "uuid": "c42d61d1-0b7b-4e1a-9544-e94706d48fbd", "comment": "Malware payload", "value": "c5af07d74077cde64bab106fffa5a043a5f9edfb", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430677, "uuid": "852222d7-ec85-4d1d-a401-6ae36d135830", "comment": "Malware payload", "value": "e9892aea3f92179628f696e1ebbd739b754063a7cc3e9b252a7958c60f1bc57abf42c49f2b48291de9320ac8c9901d70", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430677, "uuid": "abcd66e3-c430-4d11-a087-2e8f4a8ffe5a", "value": "T116F40258CA431805C333F1EB34637BC2466CC849405CBE5EBB56E9D66B66AD6A0B37B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430677, "uuid": "e797990e-41bf-4beb-b064-0014885f6174", "value": "12288:39G5ncdJSEC76g+/zqh0/8DFqSylcuJdFBbKZtRpfpnhVtOXhwre4:WF+VLqO/HfxnHbkhhWqrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771430677, "uuid": "174fb13c-d9e9-46ae-ace6-d39a187d4a7c", "value": 744925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771430677, "uuid": "b1539ea2-deae-4b61-978a-ce5dcbc3e933", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430677, "uuid": "186c3505-48fa-4943-9691-bca1f24df2c4", "value": "92b534d45acea165.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f548cdea-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441171, "uuid": "4a043132-bafb-4f94-a66b-da9735945975", "comment": "Malware payload (Mirai)", "value": "56f05484b454d44eae03d86a41c0056b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441171, "uuid": "d4234b03-fc55-4242-91fc-e084bc5f2e5b", "comment": "Malware payload (Mirai)", "value": "65a5b6f24dfd1ae13a5c7ec373cca7a470bf645ee75a5b586fa22ad371cdc6ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441171, "uuid": "fb254ffd-e547-497a-8d99-4aea64732065", "comment": "Malware payload (Mirai)", "value": "572ac42d11f528c40cc6553af4671718f72f5e0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441171, "uuid": "02781a14-f48d-4389-8631-483e3afca46b", "comment": "Malware payload (Mirai)", "value": "747d1ed79c2e36f08ef3fac8cff8a4c32ea505d3646a56243012f90b5ba167ab7a935c912eb7b8f4a515e517caa31fe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441171, "uuid": "9094f3cd-7a9a-4f1a-a302-a8204bcdb1ef", "value": "T1DAA533663321ED240E850C3B3B3E8717D9B3DE7A57E81D4857A976379BE17F1202610A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441171, "uuid": "423b3dee-fae6-470c-bbdb-c516aae59dc0", "value": "49152:Nwa+NSjXY8zPNHquGhY/J5T6r7+2iHasagR11Ce/ZkQ8f4:2bN0XXzCyZ6P+J66R11nZkQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441171, "uuid": "06551bac-8c7c-4e10-ab95-4dda3c1f8bba", "value": 2124856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441171, "uuid": "85d9a28c-2a2a-4e90-b2e1-92a8dec5c961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441171, "uuid": "a5f9a717-eb00-4895-af62-7641b0a8a781", "value": "ksnapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4943b3f-0ce8-11f1-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1771432929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771432929, "uuid": "e6063ac1-e1fb-453a-988b-fcd3ee40ae90", "comment": "Malware payload (RedLineStealer)", "value": "47429ffbe0cf6a734196534823c7e07f", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771432929, "uuid": "bdf76104-a7fc-46d4-9d8c-7f8e074f201b", "comment": "Malware payload (RedLineStealer)", "value": "6630b43aa6aed23ad6bca86985f38e0dc5d55e0a79c13e62144dcc87a928ad2a", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771432929, "uuid": "7f8f5c94-c457-4535-b854-a76fd8011a1b", "comment": "Malware payload (RedLineStealer)", "value": "28d5ed3b94cdd8ee08d25d1a957caae6054c573e", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771432929, "uuid": "fb675c5b-2d04-4e3e-8a54-77413af74f91", "comment": "Malware payload (RedLineStealer)", "value": "48ce8fe1031235498ca8cabafe568a2042f0688620c07cf11d6cb0a2dc601ef4f45eba656ebc674365db58c4542cceaf", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771432929, "uuid": "8478a92e-83e2-496e-ad7e-aa23cb0415ca", "value": "T1F8871212B9AD16B9C5FAE2388469A211B67238650331BBC71BE8157B1F376D46F3F304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771432929, "uuid": "ed1f3d78-627f-43ad-95f5-b23347b5a5b7", "value": "1f74bdd8275d1c99b371f4a5243e6cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771432929, "uuid": "76f0d963-95b6-4d34-92a6-8b3a8a1ff875", "value": "786432:ni51FLXqrRtb/S/N1ILX3JtUpTbLYH49aj3SWL:i51NqrvbY1u3HUxbk3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771432929, "uuid": "e26d6516-dad4-4cbe-8206-d56c6ee19050", "value": 37302784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771432929, "uuid": "d833d667-c36d-4593-894b-ff27f3ff331b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771432929, "uuid": "c882db26-b533-4b39-b874-bc1ced7b166a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64c12a1-0cb0-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771408826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771408826, "uuid": "39b26d5e-c07b-4cf9-b710-c369864206b0", "comment": "Malware payload (RemcosRAT)", "value": "4f6e839528e8ce9baabccef5108a7627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771408826, "uuid": "cff61dbe-d08a-4112-a9a0-9fb27f42430a", "comment": "Malware payload (RemcosRAT)", "value": "668ff7385b435240fb9bee1f7ddb665f68e8a1c4bcf6fb58e013790f5e5ec9d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771408826, "uuid": "4bc4d9cd-b177-4e92-8b2a-3c909b5e7fe9", "comment": "Malware payload (RemcosRAT)", "value": "22da5112ecf9746c905c5b5bc1f131a95d0a984b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771408826, "uuid": "da804851-ef44-4a9d-a615-6a47b656a291", "comment": "Malware payload (RemcosRAT)", "value": "026a043e34d01354e15fcb6d9dd97d7906226d3a9f48439767a9f83a157d998cfef06d035c54715d2f8cf0b8214d36e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771408826, "uuid": "31e140c1-eb0d-4d07-bb42-febab778b512", "value": "T130B49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BB3DA0D57F970180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771408826, "uuid": "a6467f9a-53a0-4ff2-bbf6-684e8bab947d", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771408826, "uuid": "9d55516e-0c84-444e-a36c-150fc764bc0e", "value": "12288:i6pxxGI8gvGOHJpAbDYGxLhZ+sPZtqmPFN:i6pxxx8U+bDYGxLhZtZfPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771408826, "uuid": "53e43083-f73e-4b0d-8eb2-a419b78b2011", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771408826, "uuid": "b2eee0db-3a49-4494-8766-f65e6aba4595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771408826, "uuid": "10a488c6-1bbb-4cfa-b001-e997bc5beb3d", "value": "17714067070c6e1a6a0e8570928419086f4745c2317b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8511491d-0cda-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771426810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426810, "uuid": "32162bd2-607c-448d-a048-00ddb1e95ec4", "comment": "Malware payload (Formbook)", "value": "ee8db6176b6cf66016183db0c5dd52d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426810, "uuid": "f70a9715-cd09-4cbe-bc8e-295f6a26a6ae", "comment": "Malware payload (Formbook)", "value": "680c3a1fe5c2fe5a84ae9d575f1ef6f4a28dec59090a4018363e58635536e07a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426810, "uuid": "9c4ecf22-d7cb-446e-b158-eb5d280a8b9a", "comment": "Malware payload (Formbook)", "value": "80afcd18c50c92dc7287aef85882649bdd058a8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426810, "uuid": "b2225486-0fd9-4c35-928c-abecaab50081", "comment": "Malware payload (Formbook)", "value": "3c32d2bf9fbc8f5a1d00c02ec0b54c7154cb45910759022085b22fda987e496ab28123da5f9cefc93c2e7ead9176865e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771426810, "uuid": "8856f669-5858-492d-901c-99013d35b2d5", "value": "T1182522181669EE03C5526FB9AAB0E2F81B746FCDA415D7034FD8BDDB3426BB01848397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771426810, "uuid": "09b077ad-16a3-4371-8604-1e5e12892552", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771426810, "uuid": "607fbac5-04b0-4d3c-b17b-822ec5ffc26f", "value": "24576:ql5a3BzrFEf8izcroWCMDlcbwijSW/MOcGUsLhfxiOj/na:85+BEEizcroW5BoDjSwDx9/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771426810, "uuid": "efa54852-7ab6-4603-8ab0-72ef3b665b7a", "value": 1047048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771426810, "uuid": "ab3761fa-c795-4adf-8088-4e2ea8d2c00d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771426810, "uuid": "38253aa8-1a21-48d1-9611-4b6a657ba75f", "value": "z13PUCHAESEORDER2500126877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d77b29a-0d03-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771444299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444299, "uuid": "0d1ed1f3-addd-40a1-b81a-4cbbef4f89b0", "comment": "Malware payload", "value": "a944bf1f7175c59cb8be486c1d3ba9a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444299, "uuid": "ac6fc0df-eabb-41b4-a24a-611259a7d0fb", "comment": "Malware payload", "value": "69079a7e6e5dc7c61ae21d08b8f1886d3e418c0077bf8dfa25ec4bab9f279031", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444299, "uuid": "757ada30-c12c-402f-b9b1-1c081c75fbce", "comment": "Malware payload", "value": "2b4711a569a1bfa44ecce38dc2d10fbde7592e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444299, "uuid": "920e3698-f7e3-4702-a785-f1b9f3d9856a", "comment": "Malware payload", "value": "92f095739003d82179153ff208e7f9051d3180f5bca5e305b2f0afb396ee60e622405dcb26b68c98f54e64f13f9abeb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444299, "uuid": "db8a18fb-a14e-4856-9959-cafbb9bed918", "value": "T198F3123A926B87C5DF7BA57D10164E263C6346F67CC38E82FD28B067C75C526005ABA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444299, "uuid": "3b507459-083a-4a91-a772-a6072308ca80", "value": "3072:imN/vPozEZaYyjGcTxIgJH18o3vkivp2yxeZVEmS9dtJg:ZnyquzduGcs7xSWmIdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771444299, "uuid": "0c2034bb-e4a1-476d-b12a-8c936b042385", "value": 159139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771444299, "uuid": "4c617b52-4b9f-4e9e-b13a-8ba6ce8d34e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444299, "uuid": "72e303b4-d93a-4639-a53f-15a604f8479c", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c2ccee-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771423296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423296, "uuid": "bbce3f1f-d033-4e1d-80cb-a0cc54b06dff", "comment": "Malware payload (RemcosRAT)", "value": "5fa10adf8d8dc52265234a0fe935503f", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423296, "uuid": "782877a7-e181-4ffe-89a6-9002394f8ee7", "comment": "Malware payload (RemcosRAT)", "value": "69534cc29b420bcc38c0e4db450095a806010e922c04040926ad575c793617f0", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423296, "uuid": "de169f79-95be-44fe-992e-2dcac2a73c08", "comment": "Malware payload (RemcosRAT)", "value": "3ea2088268038bc5d7afdedc79f974aa667d4ef9", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423296, "uuid": "ed347fa8-7571-4b08-9478-55d97468fea3", "comment": "Malware payload (RemcosRAT)", "value": "54a20204d459fa9e516a0044c0c1551e32584ed402946ec57174f4501bbe635b3250030148c84dd91917f96489a3e3bc", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423296, "uuid": "086ad16b-eab5-4512-b07c-c11f6cb448c9", "value": "T1A1A4AE02BAD2C072D57161344D2AE775DABDBC202835997BB3E61D5BFD30180A73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423296, "uuid": "e2be9213-95bf-4ba8-8920-24ba27e9cc3c", "value": "5d354883fe6f15fcf48045037a99fb7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423296, "uuid": "c88cff75-bbc6-4629-a828-223284690c3a", "value": "12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSZn9:uiLJbpI7I2WhQqZ7Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423296, "uuid": "228e51b3-fa6e-48d9-ad36-de0ec18a3238", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423296, "uuid": "6be04a72-4933-40b4-a81f-d8e58c89474d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423296, "uuid": "f7aaaa09-0b5d-4988-827a-25c82633fd43", "value": "69534cc29b420bcc38c0e4db450095a806010e922c04040926ad575c793617f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f72c2b-0cf8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439500, "uuid": "fa70a82c-825d-4f4c-b460-528991b25417", "comment": "Malware payload (Mirai)", "value": "d85014290fa6c089ea12a0cceb59f272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439500, "uuid": "75a633c1-1083-45f3-8f75-ed8446c69c24", "comment": "Malware payload (Mirai)", "value": "69d6ce5155731d6495eae234c09eeb0b7efb6f65b340b20314e0e69ddc50abc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439500, "uuid": "1eb071e2-d7d6-4908-b922-fd982e705f7f", "comment": "Malware payload (Mirai)", "value": "40d169f1d6921f0dfa600638193bf133dca3c5d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439500, "uuid": "63c70460-5c97-4ef6-b302-c9b2fcf3e75a", "comment": "Malware payload (Mirai)", "value": "9d91b7c11e13f7cd536350bcbe94f9f8614d5c09d023521a4f144a52fd99cf5fca4cdcd611a12d37c483605c5adb1f2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439500, "uuid": "2e761711-e01a-44b8-804e-f0e9cf2ed053", "value": "T1B2834A0273480D43D1A75EF02A3F37E5D3AFD5A121E4FA89650F9A4A41B5EF2244AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439500, "uuid": "1366e3f2-b4bf-4c99-84fa-a186597bc8e5", "value": "1536:kksLTxnuZ2KLmNNBt0a+F5+Qmae4a6191D6/q:kksXRuLmFSFxmX696/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439500, "uuid": "35e691c9-df60-4b58-8ecb-3aa13e686c71", "value": 87744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439500, "uuid": "43b784b3-ef93-4d80-b72c-eee155957eb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439500, "uuid": "5c49afa2-0478-4619-be2e-7e00e325f6bd", "value": "rizzx.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ea88fd-0ccb-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1771420154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420154, "uuid": "e4a30513-1465-4a8e-8cc6-18bd85634fee", "comment": "Malware payload (Stealc)", "value": "9d33a9fdb8fb108da2aa7e309a055d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420154, "uuid": "fbc8da31-32cc-49aa-98d3-980165cdfc60", "comment": "Malware payload (Stealc)", "value": "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420154, "uuid": "1a32d6c6-22f2-48fd-9826-3e9dc7a937cd", "comment": "Malware payload (Stealc)", "value": "9a22ed53c9f7356930b5910ac5e5258d841ef4b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420154, "uuid": "b87d2f74-5b28-4a18-85bc-9c5ba2d1e2a5", "comment": "Malware payload (Stealc)", "value": "d18a3e407b028acd417df41c240f60f928ceaf93ae648d4cd71290724c85db861906d8479d78f161b871a545567933bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420154, "uuid": "f00a346c-7fe8-4bed-9d1c-e1664405beac", "value": "T15AD49E12799194B6E47705748D78EB558BBDBC700F60AACB63C009A95E702C0EF37B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420154, "uuid": "665563a4-4a53-4636-8c7d-54e881d6b8c6", "value": "23b623d5aadcf64cb25b8fc4c13b1df7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420154, "uuid": "89eab80a-c283-40c6-b3d7-6e92272167b6", "value": "12288:Fv/opQf+pKUX2wfWjTu9MX0Uq6ALSQTbAK4lNl5U:tZe2HjKQrqzClS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771420154, "uuid": "a8ec20eb-cd5c-49fa-8021-65da77aa6492", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771420154, "uuid": "9311f942-07b7-433a-8ba8-aa9078de4ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420154, "uuid": "4363c9ff-aea2-4cb5-a263-3add37028205", "value": "69f28a96c3b1f6636691345e01de8ddc54569c5fd479d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ccf58f-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406405, "uuid": "7c5686de-e7eb-426c-bf55-f7fb2e07db2d", "comment": "Malware payload", "value": "8a49ff366da3f7d7822df6598a5c94ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406405, "uuid": "04d98b98-a869-4cdd-b865-5939c003a754", "comment": "Malware payload", "value": "6a3c7f16b067fe23b036655b2c88a8cb15abb3d91abc1854ff69585a41cb10c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406405, "uuid": "014b43b8-1ae6-442e-9c29-cc3c32dfe7a7", "comment": "Malware payload", "value": "cf52859431c42814b716ca73a2ecb7495e2e2c12", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406405, "uuid": "e7808831-c3ee-4732-9542-3c89f92f1070", "comment": "Malware payload", "value": "d1b02f567fedefca6dde551be83fa16677636f1f454edf1863aa8c917bc931c9f637ad4e1dad3f6520f94dd7e656f012", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406405, "uuid": "143f778d-2933-4f71-865c-c76e153dbeaa", "value": "T1C9C4EEDD2EC2F26D0F82A933F20AF05EE4F488F0636A5C19A4DD1C58F8916D4ED69635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406405, "uuid": "523b0e16-9428-49de-9396-ed1b08b792b3", "value": "12288:RiI/Je/IsV7lMLMM0Is7MDHWuu1NKtpnGeFtntGfbLD4ue3Jxacc:RDGVen0b34z5xacc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406405, "uuid": "00016137-2dec-4c77-88a4-306eb15cecbb", "value": 563885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406405, "uuid": "b33401f5-1787-4463-bae7-a8c49a769a2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406405, "uuid": "cd0b824e-db9b-4bee-b4ed-0f255c98b154", "value": "CKML220066 - MSRS no. 812399.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04b3284-0d08-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771446666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446666, "uuid": "fe648d5f-a3f8-4e03-b77e-f81bdee1da7f", "comment": "Malware payload (Mirai)", "value": "0206f6ef0230968fa2dbb6ec02e9c76e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446666, "uuid": "77e1dc7d-9d6b-41f4-abb5-3e57c0cb01d5", "comment": "Malware payload (Mirai)", "value": "6a8970f3f76f3d6c2d520ec45d53a874f3be453e6ab101bbc2e590ecc38d84b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446666, "uuid": "d9fba620-5f3b-4eb7-9d8e-d81d5ea4e3fa", "comment": "Malware payload (Mirai)", "value": "9622fa7c921dfd90d28cd85eb0df26090bcee612", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446666, "uuid": "56634da4-2707-49f4-acbf-3e9dd2865afa", "comment": "Malware payload (Mirai)", "value": "6a3807fca27046a6dacdb359e376e6bbfbb71cc49a7bd2f5ef37b06da5a93e4a3a4a0705484cf4a7b67174bde4ca1099", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446666, "uuid": "2206ace2-c7b4-47b9-b377-9e31fccfa448", "value": "T1E0B30946A9429F11D5C631FAFBAF414933136FB8E3FA7111D9205F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446666, "uuid": "0acecfc2-7288-421b-8556-0138d5bface0", "value": "3072:pqiy9qVvpOFnQfG/7/0NZYjYhOn1NaVF7h1ubWczgflZI04MbuPsf:pqiJKdQe/7/0NZYjWK1NaVF7h1Hczgkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771446666, "uuid": "03d28ff3-d4c7-4b80-a5d1-2795c417e458", "value": 112656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771446666, "uuid": "cdd56a28-a009-4b3e-8300-a40860a006b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446666, "uuid": "77c2bb05-b05a-41bd-b47e-a565382eada0", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c7fd77-0d03-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771444304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444304, "uuid": "531ff88a-5bc5-4f9c-aa15-f2dd622b373a", "comment": "Malware payload", "value": "7e4ca01f972ceb41694b672f0e80c24c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444304, "uuid": "52a52dec-5598-47b0-b3ce-d8d82e80752d", "comment": "Malware payload", "value": "6aafb9e2e0ae9857bc762912cfd3c068931a492560e60f330db758d32759317d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444304, "uuid": "0ae37164-de06-4935-943e-80db0da9b6e0", "comment": "Malware payload", "value": "59137af12f8a2c69b90b526c0f50e78907f60f34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444304, "uuid": "619e7c5c-b0f4-4d64-8baf-d0d25d57b20e", "comment": "Malware payload", "value": "e992fd10eb73d9fc2e4b3a8efab5ecd50acc8b3dc6c8b24d7ced9b944e76d0c4c21a654313bfc69d08bc865e303182e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444304, "uuid": "ccb3bcf7-93f8-4e81-9706-2a4979a903d0", "value": "T1B414A71E6E228F7EF26C877447B78A35976933D623E1D644D1ACC2105F2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444304, "uuid": "3c55fd6c-1d2f-4aec-a268-0bb696dd923f", "value": "3072:77Ivl38bjkSU5qWrWp8pcPy1yCdYV0QiYAjkb4:77IvN8b3UiOpMjCk0QZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771444304, "uuid": "3137dcb5-8bf4-42d3-bb7c-ba1fd38db3f8", "value": 197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771444304, "uuid": "1700f520-26c8-4462-ba83-0ea7aca2fd09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444304, "uuid": "7735a92c-800b-4f2c-aac6-b0f4a2e3d795", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babdef0d-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406713, "uuid": "c49778a7-ec81-42c8-98d6-dab51446e413", "comment": "Malware payload", "value": "e699d32972229eadcf60fc1e25c0b6f0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406713, "uuid": "c8d37354-81cb-4fb2-a303-1bd69b2fb63f", "comment": "Malware payload", "value": "6b48a1703a107f55f85eb15d5daa8c429b7a7b80bd9abc28e5542ac02e9f5842", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406713, "uuid": "31b1322b-b110-4390-8d3a-860421dc63c3", "comment": "Malware payload", "value": "95c134fa67e05c48fea7141bbbfb35715ced263d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406713, "uuid": "4a2adf31-9199-4f26-aa70-18036e452058", "comment": "Malware payload", "value": "28b7e1c1bd702827abb08f3929d0992f588bd7fae4f86ac779aa3f3cf2e8cc7ec105f63c993afb6ed92c4051387ffc05", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406713, "uuid": "dca0d0bf-7f62-4710-8d4c-11e75082b077", "value": "T17382A627CD049FF00D7EB3E16497A816CA624212BA347949B98DC5E97F33664DBCC0DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406713, "uuid": "e1de41da-896f-4f65-a269-4434f78779a1", "value": "384:KwG58RhDqOCg11Lmw8ny+/GAHzqcW2lAG9MF4:KwG58PNL5gPzzWwAG9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406713, "uuid": "56062984-f6fc-44ae-bafd-80f963a938c4", "value": 18922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406713, "uuid": "155a45a6-f9ae-44ee-b073-450f11276957", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406713, "uuid": "14e235ed-f12b-45ea-8e4c-1c45fa0362f3", "value": "sostener.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d318fd4d-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771406754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406754, "uuid": "cae7f2dc-1f58-4111-8b02-561fdd97a90f", "comment": "Malware payload (AgentTesla)", "value": "6a4fca8c775b7c8573250b3d590d1d40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406754, "uuid": "7a26348a-b9f6-4837-b4b7-1b9c60b7fe7c", "comment": "Malware payload (AgentTesla)", "value": "6b48c1a93d578be488de9a50defadf8a3c0560f92b2a6e815f28232882296175", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406754, "uuid": "51112194-6b41-41d4-9057-bd55a33c71b4", "comment": "Malware payload (AgentTesla)", "value": "f274e0c32ed07977ade4e2a25360e85f2e1b3548", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406754, "uuid": "0f14aadd-1643-4302-a6ac-067b98078b5d", "comment": "Malware payload (AgentTesla)", "value": "028c432abce5abdc6bb6ece4bf0c4e0883e19d900005fe2861137ddcd31675f6b40f205340691bc5cffc342446ddce00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406754, "uuid": "5d5e66a7-dc65-4efb-8fc0-c88b29901f2a", "value": "T156837174190C45EF2493EAB4B088A7E3FE6C0A5C9FFD664F525487DA163EA8734839C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406754, "uuid": "af2c7054-428c-4760-9926-4c46911cb2db", "value": "768:NBDah3FALaPOz6Oof6zIHwg+iy8rZMzQKMDstdbQlxMlzoIqm:vDsVALaPOmOqHMWhKdDU2lzovm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406754, "uuid": "a8e91702-c288-407b-b3fa-79dcd03025e2", "value": 88178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406754, "uuid": "75dc82bc-623d-490d-a0f1-e18aa382b876", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406754, "uuid": "898e03aa-76df-4c34-bdf7-cb2e74331fbf", "value": "PO37895-Fantastic.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1d0520-0cc3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771416862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416862, "uuid": "ccb5539a-c839-4655-bce0-26f7e70b22cf", "comment": "Malware payload", "value": "c066ff078204e3dcf52d066b3461a146", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416862, "uuid": "a2d9908d-c4cf-4027-b661-d1baf49f70f7", "comment": "Malware payload", "value": "6bdcf094575b9f2a3cf09586535edc5aa899d16e9058f04f57b7b25f3844ded7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416862, "uuid": "4e34f071-c843-41ed-85a0-ab3e7a08b5a1", "comment": "Malware payload", "value": "33127f9237b1b616d97f5724d0c6b40be1c20f63", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416862, "uuid": "3b471cf3-d7a0-46e9-bf05-3a4ceaa4f50e", "comment": "Malware payload", "value": "48c501f3678e6ecc976df2ed1a9d1b910508dfdf8ce90b517a984f2ee3935ed4e738d037ddecd374112e6192ac6af5d2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416862, "uuid": "21ce5c20-a127-4d57-b555-9003c7e18289", "value": "T1FE51129FAF098330ED61434ACA17AE1BE7F9146E5510D17439EAD0097B2336CD6E50CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416862, "uuid": "0b5e6b52-81ec-4c2a-acbc-b3308ecbb6e5", "value": "48:PkA+nvI8RWWa4841gBppYXEPBz/d9G4P4hJ780Arp4orUyrsgdd0C71RAf7LKYa0:WnvwBTxPV/KR7CrUkHYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771416862, "uuid": "745ac19a-4e0e-45c9-83af-f6e267d16f64", "value": 3052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771416862, "uuid": "5546cce1-549d-4ded-9efd-f3b2acff6d49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416862, "uuid": "2d7e9e6b-53da-414a-b8f1-0be6a62bc122", "value": "Docx_rws_02.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdddee6-0cef-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1771435654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771435654, "uuid": "cf2bb87e-198c-49b6-9f11-e52fe8899f08", "comment": "Malware payload (njrat)", "value": "589a56978552986c0b7a724452989e4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771435654, "uuid": "ad73cbc8-e064-4b12-9f33-3212b517d954", "comment": "Malware payload (njrat)", "value": "6be3f79dfd7a14b4b568675da231eedbbd232d7fbab76e25a9f252f5b5facad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771435654, "uuid": "622461bf-ef9d-4aa2-83f9-655157317ac9", "comment": "Malware payload (njrat)", "value": "c13a1ce1ea1b9b59085e6ecc2b25407b1cc26493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771435654, "uuid": "8513a724-c7b7-4777-b1f1-2e2d03d6fba2", "comment": "Malware payload (njrat)", "value": "05f90cadea80c211682f2a1be4c65d2c2f5e19fad06b6a00116f98b3af360259e7e76d9fe7b00ed6348c69f43d38914c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771435654, "uuid": "2c727db8-536d-45f9-a505-dd5bef816741", "value": "T1BFF41267B26034E5D167067BC1218642D3777C758B16ABEF13A8838A3E236C19E3C776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771435654, "uuid": "92f9bf7c-b532-4941-a8a6-c2c6cc4e54a3", "value": "469e59bd592f93ae01ff61cd0d813e4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771435654, "uuid": "446b9714-352d-4863-aa8d-ac80a95fd99e", "value": "12288:Ir8VpxdYrS5SVuuMPzB+AdhKX2BBGFldiWq61RXZGchIzjNATgLZZL9Hg9TKxxmB:28VtMykAdBgZq615ZGce/N2qZZiRnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771435654, "uuid": "eee43c01-deb5-4ac2-8d38-2a00f2deb32b", "value": 785100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771435654, "uuid": "b680cad8-84c8-4cc0-a195-43960a03dbab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771435654, "uuid": "67365a4e-28d3-4be1-a13b-e805094900cd", "value": "SecuriteInfo.com.Win64.Evo-gen.86454621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154790e8-0cae-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1771407724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407724, "uuid": "0fbe0454-bb56-4f3a-b359-c852f8b5b48f", "comment": "Malware payload (SnakeKeylogger)", "value": "5508b057d626d95f512ae1141184dcc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407724, "uuid": "cfff6b78-a156-4938-a2b4-3723948fa0c0", "comment": "Malware payload (SnakeKeylogger)", "value": "6be46812dca2e243c3cff4680df088b68478233a4d71535dde80fb2b720e3f48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407724, "uuid": "f2f2de89-b7da-4bf9-8834-f7037b696b6d", "comment": "Malware payload (SnakeKeylogger)", "value": "d995774fcb67ec50caf9ffeecb1cf717a39ee252", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407724, "uuid": "b722dbfb-9d1f-4579-9cc8-4ab3462ea0e4", "comment": "Malware payload (SnakeKeylogger)", "value": "84d2492869409eff889cefd44c416be1402605a958440c603d98b744ab860ef25a660a747dac9b5e4fa292ddc5f78ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407724, "uuid": "ccdee15d-63c8-44f2-afd9-b66568d5d7d0", "value": "T15A94CF90E285DC9AC84732717D3DD635295ABE1FA370091A372EBE2A76733831067D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407724, "uuid": "abea8bb3-c875-498d-8337-8e5969b9013f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407724, "uuid": "7dcd515b-fc05-473f-acc2-6f62fc4e5338", "value": "6144:C5lz/9GpewMCuSgeH7/we9CGxR0R20JuOw7oKavnpvOP1pX:iHzYUeH7/wee4nUX0dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407724, "uuid": "b7b72251-be01-433d-a7ba-238fe4961cc4", "value": 410264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407724, "uuid": "db473399-e643-4e14-89bb-81b295fcb82b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407724, "uuid": "b772a3c7-269f-4924-9ede-b832e9b9f843", "value": "Aviso de notificaci\u00f3n en Sede Electr\u00f3nica.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad065509-0cf3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771437614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771437614, "uuid": "29fe4668-db93-48ca-9454-fe594bf3e2ce", "comment": "Malware payload", "value": "2a17e8870e030eadfc6f17f783488148", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771437614, "uuid": "64af2d9c-d41e-4011-8cf5-070cdbcfcb20", "comment": "Malware payload", "value": "6df6c9b9a24e6245e8574379b6d362978247bf37e53aacd5807a1f53caaf15a5", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771437614, "uuid": "82704b41-039d-4017-aa7f-ffc8501b00fd", "comment": "Malware payload", "value": "affc98148099d039941ba1ad641eb2f340117971", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771437614, "uuid": "845b0a77-548d-4d84-80ee-d39858777be0", "comment": "Malware payload", "value": "7133ab123c1435cb080d7086f43524d6e2dd9db7a909347715f96b5f3415b6ab40124fb5090c28232b9820128fcabbe1", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771437614, "uuid": "da7b167e-7d5e-4aaf-af29-3d5c427dcae1", "value": "T1F3C24F3935C4B19BC4B9A3A9E713F03D3F9039BA462461E5F3E1B2878919488DC61FB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771437614, "uuid": "b0252fc2-105b-4c2d-bfba-2198a3a6a34e", "value": "384:YaGTtOzGuPT7XZar855zW2761rwTBzGOp1HKI6b+HPPEvUEXTX:sWZqy1W1rwdTJKI6KvsvUur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771437614, "uuid": "29627169-e1e4-4f60-a90b-88e113b2337e", "value": 26393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771437614, "uuid": "992a3e34-21b8-423d-8608-44cbe0dffcf0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771437614, "uuid": "31b9b22d-e635-4155-bed9-98ea72af32a6", "value": "nOrden_de_compra.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72b6415-0cc7-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1771418760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418760, "uuid": "fb4af0f3-557d-431d-b457-66d312ee1577", "comment": "Malware payload (ValleyRAT)", "value": "1c2e299915cdc673268a5a75a8eda9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418760, "uuid": "92c3db19-b54d-4556-aeb3-b0b4355637f6", "comment": "Malware payload (ValleyRAT)", "value": "6e85ee87f262873433358776131ba496e63d0fe85488036cf3c4ac299bb12cde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418760, "uuid": "c6ea95a1-3306-4734-b896-26b7a23fc981", "comment": "Malware payload (ValleyRAT)", "value": "aca1068db54f3618e3de2f73657d0de4fe5c0e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418760, "uuid": "b8b20f13-e766-4c07-b14c-3dab5f68153f", "comment": "Malware payload (ValleyRAT)", "value": "f102f6d48170cd54d9caffce6e76f74b5b346e6a55a3d518e721cb40d8c1d6f259c43a2e1940eef88903ec89b0d7609d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418760, "uuid": "c56d2b2e-0be0-44c4-9409-713a3be086a2", "value": "T179345C063ED92873D5A9E53CCCB31D179266AC0901B94F3A3A508BDDED3A2A3DC54ED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418760, "uuid": "14f5ec24-4399-477e-ad93-af4185ecac51", "value": "3a37bf193db4fd53450d331354a82fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418760, "uuid": "7103d06b-29b7-46ab-856e-32d1b7b845f4", "value": "3072:TEtXFczcLRTJH0xf1kBY2m5dWzn9GVbcrrn6cFstyOhpIRWcyloGIvPWbvQVQOXv:TEtd10x99ddunc+OI+hMl8olvo4Ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771418760, "uuid": "50a0922b-15f4-4c7a-ba3f-7e62ba8e9092", "value": 252449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771418760, "uuid": "adab4150-2220-422d-8994-92b37d835bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418760, "uuid": "9005de32-2d6e-4bc4-afec-35aae118e679", "value": "6e85ee87f262873433358776131ba496e63d0fe85488036cf3c4ac299bb12cde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ce6822-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771446027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446027, "uuid": "973b46d8-d4ae-413c-bd80-950fcd2ca000", "comment": "Malware payload (Mirai)", "value": "40d7b35a3863f61ab4606415324be371", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446027, "uuid": "700eb4c9-f385-4ced-b991-776e785cc351", "comment": "Malware payload (Mirai)", "value": "6fa3f2d1c82dd3ec536fad566fbae1857298cfbcfd7b07e8f46d79c4039498fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446027, "uuid": "73867574-a5cf-4783-b71d-6ecf9b65bf82", "comment": "Malware payload (Mirai)", "value": "af81999fe11f9cdb7bf7acd9dba8a5aa0f3f2d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446027, "uuid": "bdc6cb4d-940d-48e2-b041-ac0e93fccf25", "comment": "Malware payload (Mirai)", "value": "7169a4ca19c921ef458d6978be91f0ad7d59366a53117d15cf0e03a8aaf09d4e1d87bbd2d78195d0913549533bf35c15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446027, "uuid": "30b1ca67-4ce4-41d1-adfc-ff962c97a1e3", "value": "T13BE328C7F900DDB9F80AE73748530909B230BB9245825B372297797BED3B1D91963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446027, "uuid": "cc7c3c9b-818b-47db-9852-a76ecb0ce7a9", "value": "3072:r4X7Hj6rP6Xy4Rj0P3YVdW0pgEly+VxjbiOLlfZUSHW:r4Wgy4t0P3YHWOlyOL0SHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771446027, "uuid": "dc64d38c-af89-4e5a-94a6-e8dce8ead54f", "value": 154432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771446027, "uuid": "6e9f5740-154f-4f1d-9ae5-c454ae68a67b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446027, "uuid": "3172ef23-a094-4457-a3e9-794ebc0c79bd", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cbe5a8-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441174, "uuid": "8d933ddb-b8ae-4ec8-bd11-886c44efde7b", "comment": "Malware payload", "value": "e1620ce267814985eb0c49b5b4ea168e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441174, "uuid": "a59c37f0-324e-4fc8-a966-d4a913835970", "comment": "Malware payload", "value": "70ec015591e78310a99efe40d629a1b51cbc812bf85f4dd15e77e4eac461e5cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441174, "uuid": "4f100975-d0aa-4efb-98a5-de111333e09d", "comment": "Malware payload", "value": "ab8c4fa3ec4d403b97183be623494f640601ce14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441174, "uuid": "a14479f7-a7a6-4451-b1d1-39de56253550", "comment": "Malware payload", "value": "293ed760a2f4d88aa83a3777fb6ea91c978de242e5178bcd260276231564dfdcb103aa73e2b88e8a956d9c8198fcb25a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441174, "uuid": "e90ca13d-212b-44e8-86f8-f726d37870c9", "value": "T165A53371FD589D97CE1E5F0A81B7090507498D61A7BD1BC206EC4CE319BBBC224EE6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441174, "uuid": "926f28a8-846d-48cc-8245-75fd64e046ad", "value": "49152:J8obHinm8ZSCxQ2HEgJ73U7MpGM6ApXtFau:JnTim8Znxl5J732M6ApXtFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441174, "uuid": "24e9d666-b455-4317-bef1-d826ef79e055", "value": 2114388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441174, "uuid": "7a81a7da-298e-4e1d-b6c8-95b0a10b6399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441174, "uuid": "7aa3ccd7-80c5-4a53-8bbc-b3eae320dd33", "value": "kpsmoused0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5962f34-0c7f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771387860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771387860, "uuid": "555ae719-d6ba-41d8-91b2-cb61a0ab3ae3", "comment": "Malware payload", "value": "c0850d4046aba816584a7921cf150378", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771387860, "uuid": "263f9635-572c-458d-98c5-a77239865017", "comment": "Malware payload", "value": "7157b2f01595b417f3f36c5c18c3bf9794ebb9a00345ef3d5f4f6a28849e22f6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771387860, "uuid": "859057bb-2ffe-4cba-b89c-5b0529e3dbae", "comment": "Malware payload", "value": "6a4e78c28bb2ea58ec5f2b9c9cdb3854fc5d3f3e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771387860, "uuid": "b4422933-652f-49ae-a4dc-3e6170488e15", "comment": "Malware payload", "value": "63ee1552cb88e20a3ccea934718245528af5bf9aa7a024751d867a8cef9368bb2430d3fe88b65e09835b7e39501dc101", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771387860, "uuid": "b872de29-a054-470c-a2e3-b957975544ef", "value": "T174F01D786AB229778661AF08B411D8B9F8A7909C0DB78AC4953D01FCC567605FE70D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771387860, "uuid": "f1d62f77-26fd-45cc-a969-a63d67af7298", "value": "6:bocPcdbdlhcehci0dFhcqhcrWitPQcGQcNhFd1QcgQclLKiD7:bgbj/1TEXhFKLK27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771387860, "uuid": "26fc6dd9-638c-4fd2-a8d8-281baee8554f", "value": 564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771387860, "uuid": "8be9854b-8161-4bf4-90d2-2f8ad29ea7d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771387860, "uuid": "f06e97b6-c626-414e-910f-19219a7ed681", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95a4d6b-0cf6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771438896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438896, "uuid": "249a8c18-a808-40b7-9a60-866f5f769ae1", "comment": "Malware payload", "value": "8360e33f8394537cda9c241e7dc16cb1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438896, "uuid": "4daaf96d-059a-47de-a394-c0ebedd4780b", "comment": "Malware payload", "value": "71715f3dffa1f759daf555579cdd0c275637c3e47668e89dabac66c0a9529ab9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438896, "uuid": "fe91a963-8471-4527-aecc-9d10c6f1586a", "comment": "Malware payload", "value": "a052acd982ed8927579c83acc1f2bf6c8a53e8cf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438896, "uuid": "b64963b2-cade-4ac0-9169-6022e37d1e32", "comment": "Malware payload", "value": "971110fd9d70a38dcb188784309d35d65c49768b5a4d78822022a6f4c902af0f074b8821a996ab9a7db77ed2c099aa8c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438896, "uuid": "4c92d463-eee5-4170-9f17-efd267c85fb9", "value": "T12A51B38F739BB722AFD3D472B45521302683C165D0ED5A4CF6C438DDD06DCA4A29D1D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438896, "uuid": "a1ffc8a0-c6c2-40af-a658-c33910b63e66", "value": "48:wOqNZNfgNU/qNuNbKzAddqNYN4tCXaqN1NLc5QyqNNNTERB211qN1wN1A1V1a1fX:wOqNZNfgNU/qNuNuzAddqNYN4tCXaqNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771438896, "uuid": "46c08b81-b367-45be-8817-08de5a0d32e1", "value": 2544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771438896, "uuid": "80676875-4b7f-469b-949a-925ef2ff0fef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438896, "uuid": "92139d83-9012-47a4-94ad-197c485806e5", "value": "fuckjewishpeople.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab6c79a-0c6d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771379950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771379950, "uuid": "cacd316c-e0a4-4182-bfff-0c696e98c362", "comment": "Malware payload (Mirai)", "value": "6df0ba5125f8d544afe10529a9829faa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771379950, "uuid": "d5764a99-5913-46ae-a847-10728a1b9d19", "comment": "Malware payload (Mirai)", "value": "7272632cc19f5f3a2249ff0bd9f11d553158047b3f112aad19ed1e74255b3a47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771379950, "uuid": "ef19a922-5355-475b-bde0-dd9a5804c4f0", "comment": "Malware payload (Mirai)", "value": "4267beb4e103046563d118361956df43ab5f8dc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771379950, "uuid": "154d25e6-408d-4f2d-830d-583042f7f6ae", "comment": "Malware payload (Mirai)", "value": "d162d4f955da6577bae3f7c1bd7d09284e2487d55f6a9fa295b1882b8834b0557960f657e70b98d063747813eff39c7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771379950, "uuid": "5886c8d9-bffb-430e-af42-d3a4a439f6c7", "value": "T11EC3C91E6E21CFBEF65A827407F78E31965877D61AE1C685E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771379950, "uuid": "7b31fab5-0798-4412-8c74-0ff3bd07df10", "value": "1536:tw4lPfv7d7Y/YLYdAo1OhNWHv7t9i8pPDoM1ISWlKnKevNeThNF:7lPfDdMLdAoKoHv7tppPDoMCsnShNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771379950, "uuid": "6020117e-dc60-4c7e-b641-cd417fb4394b", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771379950, "uuid": "190eb34f-a0cd-4074-a65a-12331b40ed3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771379950, "uuid": "acf5b9c9-9b3d-4752-af56-96e3ada2881e", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac3a9cc-0cf9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439999, "uuid": "701c1237-b2f3-4229-9e80-175decaf3d4d", "comment": "Malware payload (Mirai)", "value": "fd489711f80bbdfd13e19b169d53cf91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439999, "uuid": "8ed26474-0b45-44fa-b98f-283210596b57", "comment": "Malware payload (Mirai)", "value": "7300b5fe7fd512ac5c004588a2390da754ff3087243644b7e4e6a48a2a3fbb28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439999, "uuid": "938616a5-f4af-48ae-a6c8-d3414b8f6c92", "comment": "Malware payload (Mirai)", "value": "6004c99ba07e4894b0bebab1ea39199eecb75a47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439999, "uuid": "52f415fa-f7e4-4cc5-a23e-0ad0acbbb17a", "comment": "Malware payload (Mirai)", "value": "34b8e03840aeb709ae5f6aaa23564c79e7ff799b82aac9edb7cc7a9b55eeaa7b7006822724cbd129f824b9a27c478535", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439999, "uuid": "2d37206c-af94-40e5-9cc6-5e4769bbce88", "value": "T13E64D08AEE00AE25E9C022BAFE5F034973774B6CD3DBB111E620D72936CA55B4F76045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439999, "uuid": "a02a47e0-0c84-4c4e-a381-80f83ab69687", "value": "6144:p3lOYoaja8xzx/0wsxzSiDSDP99zBa77oNsKqqfPqOJ:p1CG/jsxzXDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439999, "uuid": "533dd8f1-231c-4202-aef1-3b9b446d7aed", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439999, "uuid": "e282a17c-26d8-4cf2-a51e-492eb19c6a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439999, "uuid": "bdb8c17d-31b1-4766-8263-ce02a8e920f3", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f934d57-0c9f-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771401272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401272, "uuid": "ca52ee7e-5574-4068-8752-cc1a3efd5191", "comment": "Malware payload (Vidar)", "value": "abeb0ffaaa258842cf7d3e976f7541bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401272, "uuid": "39110dc5-ebb8-484d-b258-9473af67160f", "comment": "Malware payload (Vidar)", "value": "730fcc3ba3b9029eda9faf1a28fb107da62e10131a1248ad2e0dfc015cc9d75a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401272, "uuid": "4d17a31a-a2ba-496c-8f7d-0b2fa1759bf0", "comment": "Malware payload (Vidar)", "value": "12401a5accb426d85a8ad32dc95ad1ae46ef59f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401272, "uuid": "bc59db08-48d5-4b6b-ac05-e1df9ccb6238", "comment": "Malware payload (Vidar)", "value": "9230f4cfd08993d81de7aa8a3db6704481b9ece9f891ee5ee6586fe10ddb5b2c1e09b5a9770806331cc7734208d90688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401272, "uuid": "8156eaac-616c-4f89-aa32-27502b7bb375", "value": "T187E5E12E5ADDA1D3DC4932B085A1D7317B74FCE7DE92406EB8E8366B8C340065F3A919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401272, "uuid": "3f033115-9329-413c-963d-d7967ddb108b", "value": "49152:JpF+QOq4FqG8taAmCuXATNNXr4oZ7pC/T0ccwwK0KhPWEJsrkALi7k+l9:bF+HTb8sAmCTTnXrrc7ew0Mepi7Pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401272, "uuid": "5a838d2d-78d1-4d99-80de-19259e14d280", "value": 3300320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401272, "uuid": "35c47faf-06f4-489d-976b-091e54d28657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401272, "uuid": "74895930-878e-40e8-9f52-c8d80d249496", "value": "730fcc3ba3b9029eda9faf1a28fb107da62e10131a1248ad2e0dfc015cc9d75a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2555bf-0cec-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771434549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771434549, "uuid": "7f365f16-788a-4492-9779-a0820d7d189f", "comment": "Malware payload", "value": "d6665c7ce35b06211a26638b269878f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771434549, "uuid": "e147714d-c2b7-4b01-8b40-8a74d32bfd53", "comment": "Malware payload", "value": "740c32a2972761dc149d1e74546db6a0e57289bbcbff01e16b5969f0794be056", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771434549, "uuid": "50a5fee5-b309-4cbb-be86-afc7130d1cf5", "comment": "Malware payload", "value": "95c39e955feb9774b2e641e8113df2fd9054df76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771434549, "uuid": "b4d3b4f5-bf65-4b1e-9fc1-27d391e7d2b8", "comment": "Malware payload", "value": "38aebefb5914160c382acad0e35e61be5ae0818a3500fab5f3785dd9218b13b6c5db7e10cbbfeb8e771255aceff49279", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771434549, "uuid": "ff8ab689-a656-4de1-952b-7f6bc3ef41b6", "value": "T1FE945BD5D6D7E0F0F56704F0102FEBEF5932A1368012DDFAEA901966B471B816B4B22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771434549, "uuid": "7290f551-bf1a-4299-b608-a1a79ed28fc5", "value": "6144:eIYFlaV9TYxiegL+8uThpEvhYi80XUcwIx507cdy77cRLl+GYGU416G:eJaV9TaGQhp2h81cwIxO7CLaD416G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771434549, "uuid": "57c0c257-ef30-488c-ba55-dc1e541ee9cd", "value": 445686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771434549, "uuid": "cc7c8ca6-bb49-4daa-8962-893015d99522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771434549, "uuid": "45bd6e20-fa67-4dfb-b9f5-c38cc02756ae", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c603054-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771407065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407065, "uuid": "8925df85-f89b-4156-a0f7-3af314cb6404", "comment": "Malware payload (Mirai)", "value": "f186d507e46ba1e1561e0c3bfbdf2211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407065, "uuid": "04730d14-1fa9-4c9d-b5a7-e06ffaba367f", "comment": "Malware payload (Mirai)", "value": "745c5ab4b34f118ca62625d9da447b933d67f73feb66d0bc5a96edff1239d813", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407065, "uuid": "5d07fcfe-10e1-4a82-b1b3-70ad392dc5fe", "comment": "Malware payload (Mirai)", "value": "fb674b405b98e31e63c31eb4bb7293375fe22df5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407065, "uuid": "ec5d93a1-44ff-4f1e-8b56-6843087bcc31", "comment": "Malware payload (Mirai)", "value": "25a5facc79d78bad2c2fdcfa7b01cca783bca2fd21072c7503c4a8a5d71a654e01b06a0c68a9c4a413d1d9e6e3fbe030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407065, "uuid": "45817a96-4a3f-4e58-8ed0-28e42726994f", "value": "T199B3E816FBA10EF7D86FCD3742B9074528DC550A22E83B767974C528B14B24F8AE39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407065, "uuid": "a86b165b-91f1-41bf-91f5-e5ca51e24449", "value": "1536:SYyLIViIDh/qt20YTd7TKiTbF7V2SunT/eu82XXgk3ZUtyZ4l9yEWJ:S7LIVDDRlBd7u20Wu8U3+3yEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407065, "uuid": "f14b84f3-711e-449e-b6c4-526cc555f763", "value": 114068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407065, "uuid": "cd0d0805-9667-49e4-bb98-bc49f6dcfa96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407065, "uuid": "2eef986c-62c3-4a68-a0b0-3775d3732746", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9866266b-0c91-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771395489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395489, "uuid": "93e1826a-26a8-46ec-8924-22585088e9ee", "comment": "Malware payload (Mirai)", "value": "5bba9cecc2107d88f9ed2e550fce1f5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395489, "uuid": "9e21b540-31b0-46c7-8ba0-41796225f70e", "comment": "Malware payload (Mirai)", "value": "75414cacd178e034ab20095dac7973cb2b19f66b3af9f17d4663eb7e1413c569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395489, "uuid": "fc0fa467-483f-4629-b0e0-f059820bfd02", "comment": "Malware payload (Mirai)", "value": "b0e0baaf877507162ea0f81b6b486ffcf6a41dfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395489, "uuid": "964328ab-977e-4e3b-b100-279ff40e31ec", "comment": "Malware payload (Mirai)", "value": "f944ac35ad834b092a942d5ee627963cd828011bd37338dfe82abe8e3e3e268b9757940fd71eae3c70930ea60b921d9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395489, "uuid": "401926b0-035d-4d0e-a4a4-cadeb09cb121", "value": "T139B3F1D2D090A0BEC09FC3B8472AE71BB636F4803326376767A5F5702D16F501BAD692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395489, "uuid": "b8baab5b-bae2-4547-939a-bd600aa5ec1f", "value": "3072:Nov4QV8U0P2/4KE7ao8PlHd06clIoJQBv9GwH9G80t:Nov3OU0l7a3B+I8wEM9Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395489, "uuid": "5d90ba27-010d-4643-90f5-e009e991a8bd", "value": 115521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395489, "uuid": "e788442c-61f5-42ab-a654-0b73137c0234", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395489, "uuid": "521728ca-e75b-4c89-9b2b-cd79beb091d5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c804a087-0c9f-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1771401582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401582, "uuid": "d6c8d4a4-7452-495a-8912-a06e66547fef", "comment": "Malware payload (SantaStealer)", "value": "f8b49ed3d1a7ba6726c63830c5201316", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401582, "uuid": "ef9c3990-303f-4605-a34c-da4bb2ab1d64", "comment": "Malware payload (SantaStealer)", "value": "756bbdb069db144f16dd62dc9ddbe0ac0b4d62ca303d48f65e95e5265bdc9f45", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401582, "uuid": "eadbc452-f878-4a1a-b5a3-372e9d74d4fd", "comment": "Malware payload (SantaStealer)", "value": "74de7f5ab752f1f8c53a7df35de147c5e862364c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401582, "uuid": "5e13090e-3fc7-4e33-92d2-d08484f09f04", "comment": "Malware payload (SantaStealer)", "value": "a0d2157e3561f3ebf8dd139cb998e645353cd18a94e48e46b354ab4c2cdfbbe1529b7f92bcb57d11977fe40a9784af0e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401582, "uuid": "828fefb5-3ba4-402a-85da-7efc97f04977", "value": "T1C81633FA5FC2D571ED6940F883E9EE029B61AAB0C48CB33E15F706355E3345AA27D016", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401582, "uuid": "3fb6850b-5670-480e-94e5-9d0a903c4a11", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401582, "uuid": "2f2bf16b-102b-4b6f-87b8-01c859413192", "value": "98304:QT+8lBJPegOwwmMbScbjEHYvJ3yXR0edx/UNck/Ny6U7xoEz71v:QT+ITbM2vHvXR0edVU2kIlxRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401582, "uuid": "ad849180-85ea-44fd-8b2a-255d84a06f80", "value": 4106752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401582, "uuid": "bae65ee7-5f5f-4f41-b2b2-753ac927a55a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401582, "uuid": "85b13a5a-a007-43a4-9a9e-d73f65d4dc78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13ba225-0d23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771458344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771458344, "uuid": "2a0975f2-5c9a-4fd0-918b-00b6ba42ae98", "comment": "Malware payload (Mirai)", "value": "fd150fdeae4750129d573ae0b2ee4595", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771458344, "uuid": "e8fed060-8233-4931-bfaf-c8f1b94f3812", "comment": "Malware payload (Mirai)", "value": "75786c173e427e2924e95700da4d28e44369d5dccd1f3532ca2653d11c5e1644", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771458344, "uuid": "ffbe75cc-f46f-4254-b98a-9e268e95d838", "comment": "Malware payload (Mirai)", "value": "77ceae5f34d1bb19513f1fab7ea2ce2849eb81fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771458344, "uuid": "0a431a68-603f-44e1-9275-273ad15fc14b", "comment": "Malware payload (Mirai)", "value": "2b237833cb75aef36af71b9bd0030e52e8a273bd974f8e85d09db02a6f8b0e02ea0f70121781a2b5b6fa7b6cfdfbdf13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771458344, "uuid": "95a3a5b5-dffc-48b2-ab4b-b656883e4b75", "value": "T140D2E16DEB59374CF462573244AFC12F7496ECB3A36F42818BD84912283894D277DEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771458344, "uuid": "c2b45af5-dc24-40ae-a6ee-92c752983024", "value": "384:MpGclfUDwDsOAFImUQSAAHCw9TKcSLJY7eoayfsqxRFpDU7/2LuY1+rG0Nyq0:PcmROmIIAi8KpLJY7Pa6tpI7/e1+6Rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771458344, "uuid": "18c4c037-510c-48c0-a089-d52439ba3115", "value": 30008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771458344, "uuid": "dd09159d-e251-4ff0-a459-b267cb4f4549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771458344, "uuid": "d6f9594e-172f-4ba7-8893-086d43eb0a36", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324cac2d-0cd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771422376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422376, "uuid": "8ebb9c57-44c2-46f2-96a3-6ed47f46068e", "comment": "Malware payload", "value": "0eebdad82d8c1075e8da0c01e46cd777", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422376, "uuid": "e29f6584-08ae-4a13-8f17-1f7e3a31ab58", "comment": "Malware payload", "value": "75d9c9121217f1ffef50db1b1f9d815973e92c04f9755628cdf3e1b76c4cca3d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422376, "uuid": "96c1941e-8ff5-4845-a6ef-e842136883d5", "comment": "Malware payload", "value": "dcd38c13d7f51bc82ae88c963c8f4a335768dfc7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771422376, "uuid": "f4b36dcd-7bde-4c04-be74-f743b8c125b9", "comment": "Malware payload", "value": "195ececcc5bb5623e784f8b3da48ce0be9391fd8b624903d23154740ecc8706c377f04edc6c544345cba619c9f827182", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771422376, "uuid": "a61dd3a0-3cb8-46cb-aa3b-a3283388b0e6", "value": "T1645141CE13936438EC65592762B44106B69099B7B9C49DDCDCE87DEFE28CE0A38C1782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771422376, "uuid": "dec00c56-6ac6-4b39-8cc5-abca11b9cc0f", "value": "48:iqo9qqVqhpqTtTrpqflqVxqM5LqCZq55qwzqbRq8+8KquQubgq+Xqle:iqo9qqVqhpqTtTrpqflqVxqOLqCZq556", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771422376, "uuid": "b8272036-7c1e-47e7-9a80-0f7ed28f6503", "value": 2869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771422376, "uuid": "68058a1c-d446-4602-a28d-f42b9a01effd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771422376, "uuid": "99b91461-08b4-40be-882c-1597f02150e1", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250398fe-0ca9-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771405603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405603, "uuid": "fad932a3-3988-4e35-a3f5-dd6299956955", "comment": "Malware payload (VIPKeylogger)", "value": "c9340988e8d20856831a2e5c29c1264a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405603, "uuid": "84f6ef25-66ad-4c2c-8a03-6b99e687e324", "comment": "Malware payload (VIPKeylogger)", "value": "76b31fb1d41c7591bbc6d2810c7872c92404302989fa39a126fb15345b2c73e1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405603, "uuid": "e7a8b13d-f597-4191-8cb0-dd6a0876b606", "comment": "Malware payload (VIPKeylogger)", "value": "d23aad1089d65233d4453b5376ba108a96167792", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405603, "uuid": "d1734d82-e9a3-48aa-a056-502f2a783a7d", "comment": "Malware payload (VIPKeylogger)", "value": "8b3ccd6b8fd79e6b0d9d31847f2340c43dbd1f6cd09ece1445b2d5535f83d562082266e9491cce04dbd8771e05e80805", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405603, "uuid": "68a85c86-1fb5-48df-b5fe-e0fb1aea6c50", "value": "T19536D4ACFD84554408534EB3BA12F0D1A7B77D5B2C857D22E01B6AB1FDB72A1A921F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405603, "uuid": "00bbef60-0a26-4468-a951-1b03c4452258", "value": "98304:lCSruGNo2QoIDZvWuUPCAYhgTavupDyMUxmJ5BhgD5uplyUD6cQFNhT6b0r22Fx5:l4c7QlZvWdJwgTavAyMUcJtg4plyUDLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771405603, "uuid": "595e1ab6-237c-4965-a237-b80d16549441", "value": 5220592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771405603, "uuid": "dc0f8750-150a-4347-ac3b-6f80b4a16c60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405603, "uuid": "333618df-399a-4919-ad5a-8e7e4d0b9bf8", "value": "ProofOfPayment.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5396dc-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439435, "uuid": "b1d79583-0c6b-4f51-aa94-9206f1f051b0", "comment": "Malware payload (Mirai)", "value": "804a76cc3a833bb0202ba51f0309b39c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439435, "uuid": "ef92a018-2333-4307-985c-a819bf676581", "comment": "Malware payload (Mirai)", "value": "76fc5fa329f7fe311b7e6d74a2c1d6f1efee8c9d820a481e44b57760977a9e17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439435, "uuid": "c77f81c2-42df-4cdc-8acf-8e60a55c0930", "comment": "Malware payload (Mirai)", "value": "513817e2f8eff93606fe265994cfef7f67e71717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439435, "uuid": "eeaeeea2-1deb-431f-b070-43d738dbfd55", "comment": "Malware payload (Mirai)", "value": "e808a452088a316416c87e485b4828388f36f542b6bbb94ae2142fd6e4ed0ed27168843d717a5f335a2f6b4fc89da0a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439435, "uuid": "89ee9f88-cba1-44d2-a056-1f4c18a5ac01", "value": "T1AD13F15AA23C0B15D7FDBC3960EFA8561484870ED64588F5EE8277E16A12F08392D2E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439435, "uuid": "af38c7a3-849c-4187-aa9d-aa33f8ab74af", "value": "768:/zDT+5mfT/P0B42qES1B0R8yc+6yzEo3hAiZk6VnbcuyD7UHQRjH0:/a5E2lSYR8ZaPRS0nouy8HyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439435, "uuid": "b298b833-a74e-4a62-aed2-56497e89bdb4", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439435, "uuid": "1e95efac-b076-4d4e-a72f-f51cc7888a88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439435, "uuid": "00d4636a-6099-46a2-a62e-4ecc4c056702", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099d9ad8-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771406416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406416, "uuid": "1548a02d-40ff-4575-9848-c355cbe7989a", "comment": "Malware payload (AsyncRAT)", "value": "41074ab9a9057d7164ce9628659d55f0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406416, "uuid": "0967abfa-2699-4b35-b58c-4cb82c0ef444", "comment": "Malware payload (AsyncRAT)", "value": "772d021651692be9a9d716d6f4e94b9d6a620b80b3602ab6080fbaaf0a6ecc12", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406416, "uuid": "b61741b8-edbe-47ea-90ab-87e455abae0a", "comment": "Malware payload (AsyncRAT)", "value": "8b2cfb71ba5672af6e630979b52761b90d649365", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406416, "uuid": "124d2408-a784-4cce-8d1c-9f95054d6da7", "comment": "Malware payload (AsyncRAT)", "value": "77a19a9665327394921296bde25170bc017dd7d97b3fa3343fedd4d35a3440fac95c26798fe49a5235d9d029816a8fbc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406416, "uuid": "0dd7a645-8742-402c-8ca8-bf93841fe6f9", "value": "T19594F1090EC27E388FAA051D5CFEAADD92BC0F8911156089D76BFD46EFA330492D745B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406416, "uuid": "5ef086b0-648d-4a7d-892e-eb258d0d18b1", "value": "6144:3lf4eLUKaNA7h9RL8wzMJVOKgqL2T1+LjmBfQ7ug0QHRmnCYbLA/ZIG:2yUvKhDroJYkLiQmp+ug0QxICpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406416, "uuid": "5b746fc5-1fde-4682-b640-d56e41fe7242", "value": 448471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406416, "uuid": "cd2e603a-7b50-4e00-aea3-ede0935a30b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406416, "uuid": "5f23c5be-836b-4d10-b32e-8d6e05607428", "value": "US STOCK-XD_LAUNCH NEW_BATTERIES.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13153e9d-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771406432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406432, "uuid": "19b64649-d677-4f65-b491-2f67d1ac53bc", "comment": "Malware payload (AgentTesla)", "value": "d84a19eafe3fead82dd13ba1f0b6ad59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406432, "uuid": "d23150c0-0e0c-436c-bc2d-d05845657578", "comment": "Malware payload (AgentTesla)", "value": "7871189e0e052b0411d30f62a45f57d75f3db2c97d27904c87b118da7571c68d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406432, "uuid": "84f469c3-2b0e-4c43-a0da-9a662f0c8b80", "comment": "Malware payload (AgentTesla)", "value": "b8e4bb21a244996b0af8b6ecc392e6b15aa71cc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406432, "uuid": "66d8aae8-add6-44ad-95b9-244e14bc58c4", "comment": "Malware payload (AgentTesla)", "value": "b85deaec41828bf6570ceac7c4209e421c0a685bdfbc85842820ff7cbc929f86ffc33864adb781b10bcb09b94248dc3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406432, "uuid": "36044a49-6fc8-40ab-acc8-816308d22e1c", "value": "T1B465905C6B54B64C8EEA6507F1DC6701FF99841CA49E20C3A73EA968BF179C8700CE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406432, "uuid": "56f703e4-70c2-4ac4-a4fc-2054efcca065", "value": "24576:bo47K20uCswZXDjrBb3Chng65HH+fIO88LncEVxwrrAvjs:Pynzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406432, "uuid": "8d6aee4f-87f2-453b-a71e-f85ca046f98a", "value": 1442399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406432, "uuid": "2c19bb91-db0f-4137-aaf7-62fe56fe157e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406432, "uuid": "d3be1982-5966-4971-bb5a-510895aca715", "value": "PO-S260200008.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b355c8-0cb5-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771410911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410911, "uuid": "bfafc4e2-805e-479a-a6c0-b8186c4bb435", "comment": "Malware payload (VIPKeylogger)", "value": "94483e52fbed4fab7d907caab1627ed2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410911, "uuid": "d642bb32-771e-40a0-b90b-f5ea2456d411", "comment": "Malware payload (VIPKeylogger)", "value": "78a92b2a3ecd5d8f4516ae4b02bbaf6908ab2cdc79e351948e1a763c174e9b95", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410911, "uuid": "60d4997b-c8e8-45bf-a677-79fc28a27e85", "comment": "Malware payload (VIPKeylogger)", "value": "f5e205e44a9c27dac1e91597c83c883c420cf84c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410911, "uuid": "2f53953d-0393-4fa4-9e62-a3b485442ffb", "comment": "Malware payload (VIPKeylogger)", "value": "605767a665f758ad8bd9789cff1806606582622529bc8c042a2bb0c84a8f2e913229fd7397826963bc53879111523022", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410911, "uuid": "da0f9b95-33bb-4023-ab31-e81f48f9056c", "value": "T11861C6441FB588E387F040A2B0DD25B7D901B83934673E5F233E723625AEC9E675E899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410911, "uuid": "4548e29b-05ec-43e0-aac5-5ebc6111e268", "value": "96:b0NxzW/LLb7uiye1whAzmdAM8nCVdd8NSjDzv/tf:Yby/Hn//K6mdAxnMXtDztf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771410911, "uuid": "0f11dfcb-ff78-4eb9-bfd9-5f7cc22f321e", "value": 3323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771410911, "uuid": "37acee1e-eaf4-4e6c-a927-30d9704dbeea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410911, "uuid": "b433bed9-a146-458e-9a8e-fc43086f03e5", "value": "Stampa Ordini a Fornitore 1103 Ordine 14695000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b349c7-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433117, "uuid": "3883b7d5-48d7-4684-96a9-5c97650281f0", "comment": "Malware payload (Mirai)", "value": "cd5ca05ccd27f213181b9a5fc7b2fdd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433117, "uuid": "b7e27776-b77e-40d1-b58f-2a4e98bfdc3e", "comment": "Malware payload (Mirai)", "value": "7933b080c35d1edfb9016113a3b48b65cf7a1ce2c8ef73fe9889b32faeb3cf3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433117, "uuid": "de602325-14f5-44cf-a02e-463eda80e0ab", "comment": "Malware payload (Mirai)", "value": "7af96b256c41152d6a1fafae43b90d6e1d686085", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433117, "uuid": "1ee004f6-1abf-4923-ad4d-113d6db2baad", "comment": "Malware payload (Mirai)", "value": "208cc99a5275d520188fef5c41c451a76f0569251d448beef5d8d04aa134ce4ef750e35b4417c03eaed21db90d7f93a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433117, "uuid": "eb32a240-856d-4db1-8040-4a33d616b123", "value": "T1F914C70A9F510EFBD8BFDE3342E9070635CC650722A97B363674D924F64A94B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433117, "uuid": "c256d70d-278d-495b-8b96-d5db8e60b70b", "value": "1536:yFtyxWIoQqOWMDxRMCXRpvj5WmYgWGOJeYH+n9riu+VfojECb1qRZ1qzYz0II1zJ:XqQhpI7Kuf4bU9wFeXh/zV2Av86iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433117, "uuid": "0ec0ae98-ce0f-493d-aab6-a4a72ed3aaed", "value": 206360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433117, "uuid": "1cb437ce-0c1b-4356-8d05-8a3490c5613e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433117, "uuid": "997f8146-e583-4bda-be13-6d7412922d4a", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd41f0fa-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406744, "uuid": "f77d6282-fa46-42d8-8d6e-cda9bcb2a588", "comment": "Malware payload", "value": "e0782dbafdfc752ed25a26010222c153", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406744, "uuid": "5fb82b16-6f21-4f36-8f8d-a5664d89b658", "comment": "Malware payload", "value": "79ce081f7ed8b73eb58e53730316966a9a5888f9206012495cc37ed667395f58", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406744, "uuid": "49605baa-7766-41d6-ac2b-9c1aa43f236c", "comment": "Malware payload", "value": "125b89b7db9a90e1429f99761a94267f4ba48a16", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406744, "uuid": "b1de14ff-d7d2-4a18-a469-79be769f5de3", "comment": "Malware payload", "value": "cadc3dccf1b3da854f3b5c340b0157c6fc3266a5da32150041319dc5f67b05a0d5cb62e0910bf34437ada8d5593306a6", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406744, "uuid": "31f5cbb4-5677-46bb-86b8-9e1ace9610fe", "value": "T12393B574194C45EF2097EA74B084A7E3FE6C0A5C9FEC6A4F925487DA1A3EB8734C3581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406744, "uuid": "ebf05e4b-fd75-43c3-a8e4-c2ab717c0716", "value": "768:mZ6l/uUpa2mM0/5bkLI1eLu2hcr8OUtWXCHDFDORVmI/j:Lpxa2g/Ukedc0kyDFDOR4Ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406744, "uuid": "edb89cb6-8550-4e40-aa72-f26b62b633b3", "value": 94082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406744, "uuid": "30bf7117-80de-4437-86fe-0235bae927a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406744, "uuid": "ef19a3cf-127a-47fc-893b-66b055094d4b", "value": "PO 2025 SUPPLY REF.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4805194d-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771423271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423271, "uuid": "b181494c-eb59-400c-962c-26e6f9fabffd", "comment": "Malware payload (XWorm)", "value": "112da56fb93afd571c34db784b4f63a0", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423271, "uuid": "1271eff9-a8ce-4036-8014-3fc8c76e4dde", "comment": "Malware payload (XWorm)", "value": "79eb61d5ebdf8af6b24b7670050f2ed876a4cb8f4bde0b47ccb764db60fd66ac", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423271, "uuid": "3cc8ce61-1fc2-4719-a063-b1193582f623", "comment": "Malware payload (XWorm)", "value": "b15ea718fb17956d997ff6a02c0e0b16fffd8bd4", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423271, "uuid": "a517db02-56c0-4e47-bb4f-3336ede5f6e3", "comment": "Malware payload (XWorm)", "value": "ac502e99dfab05d084a9b0b7ae1101b573f57128837d5fd38cb074833aeb0147ff048abbf99242aaa58b7016be7f3932", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423271, "uuid": "67c71d90-25b1-4f81-87df-715d3ac43120", "value": "T1BBF4F1226E862A24DA790FBAC053109837F0D4872156EB6B6FFC01F4ADB3F45CD275A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423271, "uuid": "5ad3e637-af94-449e-80b8-3ba784d7f90a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423271, "uuid": "658de3e1-4c0d-4649-baa5-9715244ec17f", "value": "12288:QLcKIGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7lUd8qJblNB1:mhpLT/4PPH7caoc7BqJblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423271, "uuid": "61dcdd4f-8039-40c4-9054-caa3cc1c0c94", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423271, "uuid": "1c33fd3b-a677-49c2-a05b-8f7363486c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423271, "uuid": "7a286c14-8c3d-4a68-9a64-366ce00dc1de", "value": "79eb61d5ebdf8af6b24b7670050f2ed876a4cb8f4bde0b47ccb764db60fd66ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abe0c3d-0c9f-11f1-a129-42010a9c0007", "comment": "Malware payload (RatonRAT)", "timestamp": 1771401264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401264, "uuid": "aaff5bfc-70ac-45fa-9ecc-40ad5133b01c", "comment": "Malware payload (RatonRAT)", "value": "b87e9181ef2009d23e906aa713889587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401264, "uuid": "21f04826-b1b7-47d6-98be-32df1f874ccf", "comment": "Malware payload (RatonRAT)", "value": "7a7de01481722db7530391f19fffd16fa6fc7b358833aa1e86d22fbc99cce1a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401264, "uuid": "f1ee47ed-7a3e-41bd-83b3-6292de3507c4", "comment": "Malware payload (RatonRAT)", "value": "34e545b3ed1aa65600e1a2346e7bc38f846f73e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401264, "uuid": "44c881d3-9db2-4f4a-9599-78507e4a9f34", "comment": "Malware payload (RatonRAT)", "value": "17c29b21465431f47eb3049cab924280176150ff5f365e910fbd678ba4ff7acc25aada7a6ea23319985f1748f35bb925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401264, "uuid": "8139cb73-9a90-49bd-a4b8-8bff566bf0fc", "value": "T193835D0033EC1619EABF8FBD69B560410B72BA179E75E74D4D82609C0DB2B81DE24F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401264, "uuid": "7f5c00b4-2dcf-4d66-835a-8d442cfaeadc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401264, "uuid": "32da996d-40f8-4af6-a938-57db0e0a1dc7", "value": "1536:J1DV9rwbZuTsqa4tsi5+3kq4QkZaeqlbEQCdcwjo:J1DV9rUQAX4tn0kZQs/qlbELdcEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401264, "uuid": "6cc5ac39-182f-4ceb-b65f-20f361bfb213", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401264, "uuid": "5c039b11-f538-48c9-b0c6-19436730ef13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401264, "uuid": "03117c0d-d62f-4746-8ff1-eaf65305b29e", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3ccd43-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (NirCmd)", "timestamp": 1771407063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407063, "uuid": "c2772618-7271-4384-a537-b8e58469c0d7", "comment": "Malware payload (NirCmd)", "value": "9d12f85806ded70640c37728400dceb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407063, "uuid": "8b970d3f-d966-4e69-b0cd-4da4e6051c0a", "comment": "Malware payload (NirCmd)", "value": "7a9241382b9acd6b5279aa04a9b402bbae563225cc32b16c43df326b2721cce0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407063, "uuid": "175727d1-f670-4eaa-bc93-09d6280ca934", "comment": "Malware payload (NirCmd)", "value": "d6b21d7d5f2547f91f4a5ddbab29b6a1d8d84c25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407063, "uuid": "bda369b7-889f-4549-9ee4-cd81888632f4", "comment": "Malware payload (NirCmd)", "value": "13f087bc5dde510b97316a07746d2141a6da156121b8a22ef5bfa4399bafbe1bb79285fed45d562b1277ab44a85d3d51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407063, "uuid": "f62aa18a-94a2-4dff-8df1-c02fe83b0035", "value": "T1B2A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407063, "uuid": "1e9d6a11-23dc-4ea5-bafc-aaf6621ed151", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407063, "uuid": "126aa5d7-ca11-4707-876a-6dac7dd13944", "value": "49152:ABRUTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aCTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407063, "uuid": "622ea79c-8795-4a6d-9836-82ded14cf81d", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407063, "uuid": "5d081332-8b4e-4fd6-9501-47f07ed793d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407063, "uuid": "8119c13b-7958-4aaf-8575-986f6d974c6e", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f540336b-0c98-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771398651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398651, "uuid": "ca9917ae-c7f9-4fe7-a574-c933260524aa", "comment": "Malware payload (DarkTortilla)", "value": "89bea5df6a19ba10f884cbe165ff1143", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398651, "uuid": "2dd85184-0963-43aa-a1c4-3237de7681d1", "comment": "Malware payload (DarkTortilla)", "value": "7b7e9b1606c8d571c41d4f961b5be48515a57644ba1991f7e68a383c6dd0e704", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398651, "uuid": "ea7ac2b3-909f-4de0-a3e3-70e1150346cd", "comment": "Malware payload (DarkTortilla)", "value": "b2d2bc81cd07f026ff9eccad026e2f9fb5a171bf", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398651, "uuid": "87a2a45c-79d9-4f9f-a9c4-64c1270de7bf", "comment": "Malware payload (DarkTortilla)", "value": "4884b83458e3cfad13aabf3f2f1ae9c6e85c33577ab735b73a72aff67a72f3f5470f8e2f92bfe0d7fc4b01a595121ce2", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398651, "uuid": "e4e3383d-8423-4b0f-b208-3649f41a5f11", "value": "T158E4F0326E461A24DA390FB9C016209833F0D943525AEB6E6FFD44F46DB3F49CC276A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398651, "uuid": "14231645-5273-49c3-871c-859e5e6c98a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398651, "uuid": "3eef1387-9fcc-4da0-b7af-6980c18ff193", "value": "12288:V+tvr+rGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7QTA0UJmJblNB1/:iHhpLT/4PPH7caoc7KJblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771398651, "uuid": "9b3e384b-1dea-4385-8f87-4e00998791d7", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771398651, "uuid": "014f404b-9910-4d5e-b93e-401b8f3483d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398651, "uuid": "7c36dc34-3752-4cf1-8e49-6a3f8e3df75d", "value": "Ordine ALZM SRL_DDT N .453471275.PDF(72KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5edc17-0cea-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771433878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433878, "uuid": "e1e67755-b2a7-49e7-b4d0-64e9b2e45863", "comment": "Malware payload", "value": "d017e4c89938a895c6056403f7c6d0be", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433878, "uuid": "3a34261f-e2c9-4f8c-868e-1fd52c1235d0", "comment": "Malware payload", "value": "7c52e453f5b51592b8b9f6aa15a1b816d07d2882118bacf09e98922173491e53", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433878, "uuid": "4abb9f92-853f-4baf-846f-90bfed4dc999", "comment": "Malware payload", "value": "f85d9e90b834d24be6dc5c8e7ff29ea37643ee47", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433878, "uuid": "b1d4da2e-9ee6-4822-961f-3f35b58736e9", "comment": "Malware payload", "value": "5dd6ef8e0c9e4ca3013fa8ad3807d5e335d3e1d519fabe5a48a4bb4311675fb07c3ede44f3a6b171339719c65078fc39", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433878, "uuid": "455dac96-7533-41af-b0ad-e06bfd659e3c", "value": "T1D0652320DE1A1ED02B68B32660DADD0509D197D78C097504BF8DA4DE4F2E38F94BB4EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433878, "uuid": "79563778-480b-4b2d-9d8a-e8a7ccf1f306", "value": "24576:Vjigg5NN5KDgBqf0TtZ5BphNE3QzfggMCY/bVOd4PBKqXCK+x9+E:gLyWaAMcTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433878, "uuid": "f88e9697-79e5-4683-ae27-a3f573af7bfd", "value": 1505433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433878, "uuid": "3ff12db1-b10a-43b3-9088-a7720e312eea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433878, "uuid": "eba4230e-e4d2-4373-b5e1-0989a9ae760b", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecc8387-0cb6-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771411337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411337, "uuid": "353ef460-7c1d-425c-bfa1-81a6017bd238", "comment": "Malware payload (Formbook)", "value": "98710889cd69c93b9f54c7875e6d7ad2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411337, "uuid": "2c775a14-557a-44fd-962c-02e31a235f2b", "comment": "Malware payload (Formbook)", "value": "7c5cbaeb20361e8885e5cdb09526e75f1fc6c7e8fc2457c83418891feab4c9ee", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411337, "uuid": "0ea6fd28-8081-4637-9926-8c661307642f", "comment": "Malware payload (Formbook)", "value": "51b186f573c25c2f067b6314b88284c2d8b0fdde", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411337, "uuid": "091e31fe-67f3-4f32-bfe9-7396ce2ad622", "comment": "Malware payload (Formbook)", "value": "c6880ceeb0daabcd2ea43d67ae383afe0bf54f8b02fec55466b2b98987f762b98268f18fcb5a99ef06c4f1fd49f8c642", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411337, "uuid": "20f66d75-ae27-4222-8341-90b4980b3983", "value": "T164652361FD766CA503845234206E5E0846E19F874C0879AA3F8C99CF0F6EA8F85779DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411337, "uuid": "82aa2c52-c3d4-4980-bae9-be014580fe2b", "value": "24576:3j2xIvn78DMkIl4GJGGAK+jeHAW7M9icxsh4m+mJ5jCUUn7u5Zhaqaica:3SweMvF4u+05DgmT+ica", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771411337, "uuid": "e611539d-9305-4c11-abc0-1ee04ea2b34f", "value": 1523869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771411337, "uuid": "99e734a6-0ecf-462c-b9f6-2d1b703dba0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411337, "uuid": "c28df0e1-1c5b-41df-9ed8-0f5b988c5def", "value": "ENCRYPTED (4).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d2dd29-0c61-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771374890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771374890, "uuid": "1960105c-dd28-4d83-8565-6e482a5a3c46", "comment": "Malware payload", "value": "32bc86c8d4abe5c19d203211cea76635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Mikey.HNC!MTB", "colour": "#B6C878", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771374890, "uuid": "da5424ef-95ae-4e31-9a39-468f07545959", "comment": "Malware payload", "value": "7cb4dab5ab63a160849187ad0de3c926216fc0c3d5d08613ec88e244e1fc0f42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Mikey.HNC!MTB", "colour": "#B6C878", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771374890, "uuid": "2dbd2994-5810-4362-b41e-c1ba1812b8c0", "comment": "Malware payload", "value": "909b4aef401ffcd0bc125f46d897560f078cb335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Mikey.HNC!MTB", "colour": "#B6C878", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771374890, "uuid": "b5e5fb7f-46d2-4f1d-97a6-7d53dedd9c8d", "comment": "Malware payload", "value": "fe19296609897eef570197ddb7f2aa2df433d7f358fd9feef0682359c935575028174d36ab7100fc816e4155b9e8a126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Mikey.HNC!MTB", "colour": "#B6C878", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771374890, "uuid": "07ef8a0c-9a1b-4a28-9705-acee6d891c8b", "value": "T10FD36C57B3E630F8E0778239C9510A06E772B87517605BEF47A447662F232D18E3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771374890, "uuid": "81b6820a-9831-46f5-94fa-33732580a56c", "value": "58b91a93a5905f60a83830d1981e164f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771374890, "uuid": "4b035a0f-7f4f-4391-aaae-ba0c2371469f", "value": "3072:lkHxcNpVlsnVrHIbNq03z0FSwO52iqMrp4:aHMV68f3zouhp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771374890, "uuid": "cbd1aaf1-99e3-42c4-af0c-5f79ea9c524b", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771374890, "uuid": "bba626eb-d18e-4f85-a2d1-7e5693671968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771374890, "uuid": "933e1fd3-7d7d-4c1d-8038-a6bd21d26ac7", "value": "\u8fdc\u63a7_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6726c2f8-0d18-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771453388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453388, "uuid": "0a1973ad-926f-4e64-a75a-5d009c3320ee", "comment": "Malware payload", "value": "d4525cd7c597708c8290a2ff56ead5b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453388, "uuid": "961e8f2e-cce7-47b2-b31f-a656d7628e03", "comment": "Malware payload", "value": "7cf565cff13dcdd84cab3257d2f2909e1cc34920bebfd76af2d5bad755e51f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453388, "uuid": "2880dd9c-d013-49f2-ad8a-3db4547951eb", "comment": "Malware payload", "value": "001a95b51897f259bb94bfb61daf36540bcdff6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453388, "uuid": "5d959eef-ec4f-420d-8110-18c45542458d", "comment": "Malware payload", "value": "7142e330eea50b6e497eace7bb3d95c597deec152ed5cc826117e98240a81084777ac108cf3fef4ff471bdcd8e90033f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453388, "uuid": "d777fff0-a05c-4c11-943c-3908ae69d246", "value": "T1E8C76C03BA9B18D9D0AAC870C3D646638A617CCB1B35B5EF51C52B252F7BBE05B39314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453388, "uuid": "e72260d4-9471-4eb0-aa5f-ce23e451b227", "value": "7ce9ce8243710d2b144ab7c3559d3504", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453388, "uuid": "50433a29-b90a-40ba-9881-7380bd9023c8", "value": "393216:DR9rrXTRddSenbJGSLxDPcHGYjx9oKlQnAliXUxR0rHa93WhlU6tTsRQaoqk8Bbj:DTjTdSUxGHrxdwiHFk8Bbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771453388, "uuid": "a27c51a5-a165-440f-b198-994bdd0b8716", "value": 56716358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771453388, "uuid": "59718302-90e4-483f-a6f8-a37c030d28b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453388, "uuid": "037cf157-a4cf-4923-9d2b-0516a5d84b11", "value": "d4525cd7c597708c8290a2ff56ead5b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08539ab4-0c9f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771401260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401260, "uuid": "583ce84a-de85-4866-8af4-24a7332c9701", "comment": "Malware payload", "value": "6572a9e034c3dd05280cf62a91c3951f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401260, "uuid": "5d47aa48-1c5e-45ce-8247-7e7d96b9dbb6", "comment": "Malware payload", "value": "7da7034e44451497d95f76aacfb0a6a78ea8c7c4f20668e627e6a00375d2eae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401260, "uuid": "7ec13cbe-c2c4-4755-ba17-0072ecba52e0", "comment": "Malware payload", "value": "9246bc5ff64343b070a81d72551c30e461c0a6a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401260, "uuid": "ae0f880f-93b0-4747-b4d0-784ac2ba8951", "comment": "Malware payload", "value": "16636967dd2eea24d6c9945d5e6449790e9862c6e83f3ec50aec73157509e9f9e8c3584be75c2ba57f3441f87dc68f72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401260, "uuid": "c01a6990-9d9c-4d28-a586-b8296b351acb", "value": "T1D2C30806339CA20ADABE4B7A5DA1E0401AB17D276D20DAFFB9D1734C08727419E54F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401260, "uuid": "072d3efc-3a68-4293-afdd-c385c63df365", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401260, "uuid": "1fbd123a-90b3-472a-9b5f-f2520151bb77", "value": "1536:02hIfRNuTsqa4tsi5m3kq4QkZaeqlbEQCHcwrM:0wIfR4AX4tnMkZQs/qlbELHcUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401260, "uuid": "4485a53e-bd09-444f-9132-89051b6c0bf8", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401260, "uuid": "204cd7e1-6d77-4924-9b76-8c33d690b383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401260, "uuid": "4951589a-91bb-449e-ac50-a0a4807ab1b1", "value": "IDE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df52300b-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406775, "uuid": "be8e907e-6ab1-46f8-8451-6d80ba7ef934", "comment": "Malware payload", "value": "8a3c889007b41ba176cba5b3fb61c058", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406775, "uuid": "d081db51-a9cb-462a-9df0-57a7f6d18ca1", "comment": "Malware payload", "value": "7e194ba0193ee43bc6e1c0c56ab9a6517226460eaa5e80cd72e35065ec4da73b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406775, "uuid": "05e8e98a-e174-419e-b023-30513ecf390c", "comment": "Malware payload", "value": "ce115a68f7f538d00ed9a66f5d06a252da927f4d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406775, "uuid": "f986d067-c939-4fbd-90a8-6fe68e986755", "comment": "Malware payload", "value": "6cfb49abe4e89bfa597b0601905c36189e7d9867728be3413aeb9ec85f5fc485b4079f7ba4a7434944227bfb26f850d5", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406775, "uuid": "895b097e-79d8-4d42-aedb-134469a52511", "value": "T1CA82A527DE04AFF00D7EB3622597A816CA610211BA3579097A8EC5EC3F32654DFCC4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406775, "uuid": "9e818f41-655c-4f9c-835a-39283015bfc7", "value": "192:Kh0rLN8rjgp2cdXOXjMULe6MOd8+/Yvbk8KibnG4ltLYGmkcAJ/m8o4/s/8PkrIn:Ke/mrbc5Oc08u87bdltL7RNOF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406775, "uuid": "45f3e3f3-d0a3-484d-98fd-3ea6c9c96742", "value": 18907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406775, "uuid": "7a9141ac-63a4-40b9-a4a1-20400b955cec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406775, "uuid": "9ca4f913-e401-4de1-b714-1b1bfd095ec1", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda6f3e3-0d1c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771455359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455359, "uuid": "e6233cb1-a839-488b-86e5-bcabd86cfbae", "comment": "Malware payload", "value": "9ee4656ff8dd46bfa27f3a907d682c41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455359, "uuid": "b155adb8-cd76-4b15-9191-d7d4c059fe53", "comment": "Malware payload", "value": "7f3ef6378f3807d19e37ef70e98996dc3a4dd0edb91d9d00618c8cc0b0028b17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455359, "uuid": "89138247-c693-4822-9e10-9df5b63cd566", "comment": "Malware payload", "value": "174d457145d88b9fb3997277855fffa6b302b7c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455359, "uuid": "5392068d-3c69-43eb-bcbd-a53d8e5cf7ba", "comment": "Malware payload", "value": "30c45190d3fcec192b84cf0b31b756844dc318e8aad19b2813eb3d2ff6028ffd49b3fe5ff9aaced77007239fa80356c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455359, "uuid": "9633d7ed-ce09-49bf-8a6a-45e2bd33314e", "value": "T165E32856ED819F05D5D526BAFF1E928933231BBCE3EE7112DD209B21238A95F0F3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455359, "uuid": "83019b1d-508b-489e-9f13-0bb7a6db4bb4", "value": "3072:7dABuHqRP8KZW0CQqaGgbnRg+XwUpzNdqQOdgqQEKF/TF:aNRU4L5qaGcnRg+XwUVNdAd3QEK9TF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771455359, "uuid": "d488bb2e-b00f-4e34-b23a-238f30c63099", "value": 145244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771455359, "uuid": "804dfc5c-ae85-455a-b0f9-5d91cc9f8a70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455359, "uuid": "1ac7245b-088d-416e-9a1d-3c81ce498ecc", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08c0f5f-0cc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1771419178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419178, "uuid": "9c9147ac-5a31-4273-aa9b-832373526e2f", "comment": "Malware payload (Stealc)", "value": "e9744e424efd2e97a5b13c397314e637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419178, "uuid": "c6407362-05b8-4359-8aba-ac53fcccef80", "comment": "Malware payload (Stealc)", "value": "801d8900dfe1780f97b63dde42e1e0adc78b03f59ace6b873d404c4d153f7348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419178, "uuid": "f2d992e1-8f02-4f3f-91f5-b9e310d1cedb", "comment": "Malware payload (Stealc)", "value": "64e5275cc2f069247a47ee984274b33c77131878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771419178, "uuid": "4e218674-5e4e-4779-a4c3-bf66d855ed39", "comment": "Malware payload (Stealc)", "value": "d13390ccbb89ee0776cc9db5d236a34f9cc003d4362b0a8f70ae17057058111d26309a06cce5ec466c3ae3cf18d13b42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419178, "uuid": "9ea4d9e6-af7d-49be-841a-1a220470694e", "value": "T12CF48D5AE7A602F9D0BBC178CE424553E7B2B8155370978F03E15AA61F372A05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419178, "uuid": "82fd06b9-fc35-43f7-8dbc-6e93b3bee368", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419178, "uuid": "456e4192-01b1-4840-9e94-90e81045fca2", "value": "12288:1U8VHX4ZPBuvzkOkW7UE+YTRqwJ4gy6ALSQTbAK4lVA:lVH6BuvbkW7xXVVmgyzQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771419178, "uuid": "6664ed70-fa48-47dc-859b-7c198c0b2970", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771419178, "uuid": "f12eb7e4-eb3e-4cec-82da-e1280d82793f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771419178, "uuid": "09912954-2986-4d5b-a8b6-767cc5279481", "value": "x801d8900dfe1780f97b63dde42e1e0adc78b03f59ace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f24037-0cf9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439996, "uuid": "c470bd4d-231d-4a76-9f9c-7dce128ca2f0", "comment": "Malware payload (Mirai)", "value": "d64adf1cadf7950d6d98da4e07d16b80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439996, "uuid": "20aab572-ddcd-4016-a553-7e41d10cfe3d", "comment": "Malware payload (Mirai)", "value": "805de1192f408e21ded001d6f12f5728815bb7155b6fdf5e0e033a6fd290cc43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439996, "uuid": "d448be91-111d-4028-8182-7e0bfeaa7d1a", "comment": "Malware payload (Mirai)", "value": "058c8c05bf89d484a14974a150344aadb395a7b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439996, "uuid": "9578141a-0883-4801-b6b6-1be55d9ee29d", "comment": "Malware payload (Mirai)", "value": "69987fd913803c18f03ad868296f5e0731efd0fa3cf0432d67a8697ede60a79d59ac847190951771942f1857620dae31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439996, "uuid": "18dec0de-b9ad-4963-8287-d8c964505086", "value": "T1A6937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439996, "uuid": "a9ce8262-5769-413f-a09a-5e3776c6833c", "value": "1536:W/QCZaxGdvts3i5JPhoFsxPu++4HRsUIKqI4FrS4LSH:WYCZa8dvm3oJPhYsxP5lR+KfUmDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439996, "uuid": "91684741-9a09-4a72-b030-7f5beec70533", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439996, "uuid": "e731ec1d-a96d-4a3f-b532-bcd287108589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439996, "uuid": "6484c824-1ab2-406e-9772-e15e4d41ac7f", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8656ba12-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771407055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407055, "uuid": "771dcc2e-3e29-4b0b-b148-c124e1440ae0", "comment": "Malware payload (VIPKeylogger)", "value": "77d45f859fe355b13e84f59f698fdb6f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407055, "uuid": "6b5d55dc-729f-44bc-a575-2b5a68e83873", "comment": "Malware payload (VIPKeylogger)", "value": "81278323333366c9177d761e8bf94c4664d06447198af84cb45f0fa5796e523f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407055, "uuid": "b0ecdedb-8169-49af-a3d4-ccde42a5b651", "comment": "Malware payload (VIPKeylogger)", "value": "898a6f15a250868948eb8af9224865403c0652aa", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407055, "uuid": "2d9dd844-6389-4170-8ac1-de889f890e96", "comment": "Malware payload (VIPKeylogger)", "value": "e5ed5d2c48dd2abf97067f2783cb5cd8e9688e2fd87871cc400c4ea983ffc07b06549a0e9f3ac835dba7beebd02ed259", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407055, "uuid": "24898816-78be-4ba7-aa14-19e80ca4f4fe", "value": "T12A451221C952CCA6056C5019289A4E9B99500DBB0C10BB2A3F9F8F4D1F5FA4FD9763FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407055, "uuid": "b7e94e2f-6084-49c2-b20d-8cdfc8614370", "value": "24576:wZE3SY168dmRVJ1ISSFytUidNBb1IdRwtiplsQJPK52GmawFEJ:wm3SYo3jkidzSdatQxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407055, "uuid": "81c8bb49-0026-4cac-89f4-0c9c78091cfb", "value": 1194785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407055, "uuid": "a60a11fa-e708-4316-b660-87be57b90baa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407055, "uuid": "0ee74c8a-da6c-44ea-82c4-e670c87d2328", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa24aae7-0c98-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771398659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398659, "uuid": "b15803e1-de6d-46ec-9747-8e39b170869b", "comment": "Malware payload", "value": "da279f0b1883dbb693dd6db316ddb2ac", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398659, "uuid": "4ae20118-ee35-4fe4-8502-4c7131bfe13b", "comment": "Malware payload", "value": "8158e16a479dd569411404a22b6e91b5f2a03b256c53ce52925183047654a8f4", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398659, "uuid": "adab3d8f-431e-44d7-97c9-50d4c3527c27", "comment": "Malware payload", "value": "14f6dfd5f0486fc362aedaf1bf718fbae8b29987", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398659, "uuid": "0b46d64c-4d80-43e5-acb4-18e96a7c29f0", "comment": "Malware payload", "value": "bb6365808a4c1cc2fbd06e9f4fd8854f182a306decf2bb55282566d953ab163b081bdf8816009d35e06703d135e8f1eb", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398659, "uuid": "5aaa7712-4688-4ef3-8bf2-60c713c5531a", "value": "T1FE41CC3ED975FCC0875E36C44C263E0734E41623EBB4AE78F99104EA6E11688EF6914C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398659, "uuid": "acc6a206-5fae-44fd-b368-3efaab293b4a", "value": "48:xTvv0huiJCmxWqmO8XvHn6qmNtJYFuIWIs63KxdVSdksiJv5Qg619Bzx7Ia6JOqo:xT0huw3J0H/At2uhL66xTonwvK19FxEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771398659, "uuid": "5dcd2037-5abe-40d8-b2ac-8552e7c301f2", "value": 2202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771398659, "uuid": "e76ed035-274b-4e91-90e6-596af0f80420", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398659, "uuid": "daf8dc28-6e7a-4410-a8cf-5e98d933ff04", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2502c8-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402288, "uuid": "d22fca85-e082-4f71-af54-164860adef46", "comment": "Malware payload (Mirai)", "value": "4ff5c19b2427e241f85c494c588aa5e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402288, "uuid": "f38efd8e-b6ee-4372-994f-c6d3cfeaa33b", "comment": "Malware payload (Mirai)", "value": "8193e4a7a20d376c2d4fcd4e31eeed140017c68f133602bba43775ca6c2ed8ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402288, "uuid": "a86701dc-d8ff-408e-811f-d882a9a03d2f", "comment": "Malware payload (Mirai)", "value": "d638d28b6fcc31aa8db3b29e7a316ed11110dd09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402288, "uuid": "f73def45-9847-44fc-ae85-50f0037f1b8e", "comment": "Malware payload (Mirai)", "value": "1a2cdcdefbc12b46806f2daf37c1c7f9ca041cf3cb1f3fb01b835c5a91d1636537c716437ac817d69fc47f3ae0c63923", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402288, "uuid": "8a2830be-ef53-4c31-91dd-ff5e3f838e2e", "value": "T108737CC2AB47C4F4EC2605716077E7328773E13E1029EE43D769AD36ED52A41A62A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402288, "uuid": "86f5aca7-8c97-40db-a1df-ce380b69024f", "value": "1536:dbwcQ0p+cLBZFLKW7oGV23Pkvd8U755e1D+8:K0VZdKW73V238vu0PC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402288, "uuid": "8f2b77bc-8219-4f89-a5b3-7c12448ec33f", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402288, "uuid": "ba5dbc74-f686-4792-8ef8-b0beebdab47e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402288, "uuid": "0f9413b0-3c75-459d-95cd-71fc1fead908", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe3ab4b-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441558, "uuid": "1fe61af1-e96a-47a8-b404-bfc064804503", "comment": "Malware payload", "value": "8e58d9bb5a794a825d9a25d59ee279e1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441558, "uuid": "517e773b-3a07-400e-a4de-e19bd455b54b", "comment": "Malware payload", "value": "8448e3fd5748e618814b8531e9339473991a18afd4f70cd109489a54ccc3fcaf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441558, "uuid": "213408c0-57bc-4e74-b3b4-1299f26f9e79", "comment": "Malware payload", "value": "af6367a5c352ef086d2fea8245a286b9f7e0b776", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441558, "uuid": "438a5408-1ff5-4066-b368-c29a7dbae5ff", "comment": "Malware payload", "value": "185f51ab403b25fc13646d9c043742365029caebf3914562f175b17a077e61a16ed655a3b171d211bd29d1c11f6fec70", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441558, "uuid": "68e68bbf-3cc0-4432-b618-27b09a70b011", "value": "T108D012C510D7A5E031FC44B331B6D91551C98A8ECE408D28DCDA35B3545DF0470D3965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441558, "uuid": "9282377b-9121-4318-8539-c47942163f40", "value": "3:TKH4vWbDdQFRsfdQF5aS8dQFnvdIBFfQF5/u5dBdQFxvZzMNGTOtIWYpDeB+aKv7:hObaIuOA9yDB2/vuLrp2Nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441558, "uuid": "c9b5b9f4-4ace-4544-a001-504c1f04d3c5", "value": 203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441558, "uuid": "2c6b9566-6ce5-4c6e-b4a7-63f4a048983d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441558, "uuid": "3beb0ef4-067c-4117-9990-8fafaf0e5058", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59861fd9-0cc3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771416858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416858, "uuid": "b4468256-43d7-4338-97a3-d12fb8754a19", "comment": "Malware payload", "value": "24b08f966db9897bbc9df67c66771d8a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416858, "uuid": "18b09cee-3cf6-47f1-a8bf-225b247732ab", "comment": "Malware payload", "value": "84d470c48cb0fbca27513d3e2c2cf6330f68c0bfb635ef4c0fef45fb39a7be79", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416858, "uuid": "273ef195-223d-411a-8c29-ff6e9c944ecf", "comment": "Malware payload", "value": "99ed7c89611cc980b93d88d92d132cfe60cd9d42", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771416858, "uuid": "a1a3f41d-aae9-46a0-880a-0431e2bec46d", "comment": "Malware payload", "value": "d41c6bece0408a5010cfa166d8e644eaeef9c291b11fb319c477b0f65fbcd4783c11582548315de2162737177810fba0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416858, "uuid": "15e368cd-8ab7-4db1-81d0-31759fdcd672", "value": "T13E513FCF5E15CBB4AA2103ABE5573A0DFB7414499225B07439EE904493367BC93E22C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416858, "uuid": "d3a87f4f-13a5-47e8-b804-58b6e01f3cee", "value": "48:ObsS+W3mbUl8N6faaTzauZk+eaJU5RgrUvu0784OW7bArKa5S1/r4+6ZJlfJMDlh:0bbWbUDqLWUXT2S1Abv6s5cT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771416858, "uuid": "a6e8e805-779b-47b0-b3be-e5e4dc9073e1", "value": 3103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771416858, "uuid": "7a755ff4-2872-4d59-8407-ae343593c6ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771416858, "uuid": "fc89d84a-b012-419f-b1e6-921617f951b3", "value": "Docx_rqs_02.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1ebce1-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402261, "uuid": "2785475e-91bd-4498-a3b5-1458c46b7f84", "comment": "Malware payload (Mirai)", "value": "31e91a73d98c52a881348f4975794d63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402261, "uuid": "88495f87-0b65-4139-a3f9-3fa100b81519", "comment": "Malware payload (Mirai)", "value": "85c28783ac0c61bc4df8bbd82f017b4650117eb795652484f2f4dec65ace727a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402261, "uuid": "1456ae42-0f98-4528-a05e-9eceed270236", "comment": "Malware payload (Mirai)", "value": "da29e776c37aa81615a5f55fb8ab5488ae84fb55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402261, "uuid": "dd2b35bf-ef46-4e25-8e25-7288993775b8", "comment": "Malware payload (Mirai)", "value": "3688bb1e19997568785facfcce2a707ff419023d9ec5b1c723302b9a1c31a2c05f3fb44bf98a1a9a165293580093502d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402261, "uuid": "3997bf4d-390c-4e26-9615-16af43c55a08", "value": "T14AC35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402261, "uuid": "da370124-36c7-42a1-8a51-0ebe8a71d38f", "value": "1536:UjAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3E:UsFmSmviqS1Bs0+Nd6lAqktNMxSNbmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402261, "uuid": "52e638ac-e811-48e3-8ebe-101714ee0f4f", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402261, "uuid": "bc06ee13-9f56-46d8-b07b-4f1c49ec9847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402261, "uuid": "4d715ca9-0b7c-4db9-a27c-67434ad48510", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e43c9e-0cf4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771438161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438161, "uuid": "aeb83d2b-f666-4d18-baf7-35f90ddb3ea4", "comment": "Malware payload", "value": "4a5777f54aa6081cac8247438c30fa5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438161, "uuid": "f81990d7-06a9-4219-8f82-01337be2a784", "comment": "Malware payload", "value": "8677376173ccdd87787cffffb6290c2c623d1c2ad82b15e31a9a2bab9c03b383", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438161, "uuid": "64497a26-a3e1-4212-b910-26a6e05b0372", "comment": "Malware payload", "value": "6b2a579c43b5721e75a8d8996ca7c9f5d43c6f7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438161, "uuid": "32492083-d40e-42ca-a961-a5a9c5efa9a0", "comment": "Malware payload", "value": "8806d77fcae53c49990c706434c003c3a5bbd6faa57cdbcdd3b3c1b25347d2aa30bda5651f07a5e4116368d5bac698bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438161, "uuid": "df14002a-0dec-4c80-90b3-82f844b6c20b", "value": "T109463A40FADB54B7EA03163004A6A3BF27306D054B26DB97EA14BF6AE8777D10D32719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438161, "uuid": "ad4ba237-addf-456d-8154-6629247ced94", "value": "ef2950805cfd017c3b005284a639e584", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438161, "uuid": "d0eff0ed-32d5-4742-881d-62347c194422", "value": "98304:mXWzne9GfzQDckzseTgxsSGs9KvwcqVT4dbh1:CWbnWKs2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771438161, "uuid": "a37f6719-5bb1-4d26-a80f-81a2ff278778", "value": 5783744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771438161, "uuid": "d8112b8d-cb64-4134-8c75-7ae1e72018bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438161, "uuid": "dccf940e-38ab-4241-82fc-5e617f48fbb7", "value": "8677376173ccdd87787cffffb6290c2c623d1c2ad82b15e31a9a2bab9c03b383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f8df07-0d24-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771458379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771458379, "uuid": "d0316853-5285-46ac-b966-1da45f1a1465", "comment": "Malware payload (Mirai)", "value": "3217354245f3144a3c854a66426bcdc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771458379, "uuid": "a513e193-ebcc-4adb-8b75-f2562450bd63", "comment": "Malware payload (Mirai)", "value": "8684f610f97eb99f6b58d6f247d317bdf14114aac5df32c30a9eee9bbf1d1268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771458379, "uuid": "3db8230c-8797-4ec7-8771-ba88834eacbc", "comment": "Malware payload (Mirai)", "value": "dd880a23fb86381b710497fb2d76e3c3176eb89f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771458379, "uuid": "7b2e8ef6-46e8-4820-8a66-5ce9656e8047", "comment": "Malware payload (Mirai)", "value": "ed1de52a03cf1eab29b8aefa421e4d5814624b751d5b539b8c3bb9f4c20652629cbf5d2def708bd78cb543e24ebf12da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771458379, "uuid": "fca0f471-bcec-4458-ad6a-c88910c1ab10", "value": "T1E6533AC8A193E4F5EC141978307AABB26FB3E13F7075EA8BD3DA55339901702E10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771458379, "uuid": "c060df27-11fa-4c6c-8284-f4fb03c5c057", "value": "1536:CZBcKRTVIAAhCmn80ssK+nWSWuW/SNMfCwS6Q+Y4G:uBcKRRIA6CS1K+nWSWt/S6fCv69BG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771458379, "uuid": "81764ee7-c0a1-4d2e-b65a-8eb8609e2dcd", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771458379, "uuid": "16bbd552-cfae-45e9-ab47-ebc9a2b5d017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771458379, "uuid": "14959e8c-3814-412a-bee1-dabc9c1bfed7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5c2537-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771406449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406449, "uuid": "62e74551-466b-43d0-a898-7802a9c721b2", "comment": "Malware payload (Formbook)", "value": "e1f36222d04d6251eeba76e6a1e3af19", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406449, "uuid": "af5e008e-3893-458a-b169-54ae1a554a5a", "comment": "Malware payload (Formbook)", "value": "86f5eb0cc7db4c11588e079977d099139176009a976089469a55a49a6a1eb172", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406449, "uuid": "e3e18e5c-8d12-4edb-833c-0e82b5acbba9", "comment": "Malware payload (Formbook)", "value": "82e17d69700f49f4c8a9afa860550f1bde858f41", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406449, "uuid": "bfd87c9a-dfd5-4b00-9c92-c38a8b29c6d5", "comment": "Malware payload (Formbook)", "value": "6950623bbb6efe113b2023c72a05eed131c996625fe5eaefcdda95d2b9cbd8bff9155ae91690cef7a8ad0b2d878b3305", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406449, "uuid": "483729c6-1e2d-460c-a46b-54bab7d08b10", "value": "T12595C0905B843B8210183A3984FF2376DB69304B3295BC4EF9AD5E4ADFAD50C52D3B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406449, "uuid": "9c409857-0db2-4073-9f00-dec41ba3c245", "value": "24576:R4T4IZRP9pP0bn0mrgzM1n5mHWuatOUw5C8HNbLZvVbZfO1i8sbv3j5Dmi5j2M8A:CT4M+1JgCCbrJOG58hoMCA69pbMaSRpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406449, "uuid": "1db6cce4-fe62-42df-9a11-aa0e4515beb7", "value": 2055019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406449, "uuid": "80b9b9af-bc5a-470b-84ce-a8deadb698d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406449, "uuid": "a801ba0e-03c2-4239-ae86-0141bcd61d97", "value": "2570001638.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681adf43-0c69-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771378228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378228, "uuid": "722ebbea-7048-4330-b13b-f1e476c465af", "comment": "Malware payload (Mirai)", "value": "e96ef703187e8738d3e51aab78eb9314", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378228, "uuid": "7e1367d8-069d-4b31-b5c6-45257954252b", "comment": "Malware payload (Mirai)", "value": "8891fa5aa68c080e4febec374c0eafbe260f72092fc8ddc90067de5be414a242", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378228, "uuid": "339a8a74-dd1b-4a30-a3a5-f24165032422", "comment": "Malware payload (Mirai)", "value": "b3a108628083b3ee885f52397c893ffe8e9861ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378228, "uuid": "bc131f47-13ab-4840-96a2-f8ec4a59df14", "comment": "Malware payload (Mirai)", "value": "2c4aabef97c0c3c6ae1e3ae2143af2dcdc9389df50b569971270b48f1647c3c0e990423a03f9dc7957d5a5c448ea28c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771378228, "uuid": "7c377d70-d418-4dc9-b19c-257da0ea2fd2", "value": "T169D3E706AF610FB7DC6BDD7706F90B0235CCA85B25A43B757534E828B60A1CB59E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771378228, "uuid": "f1ebff4b-a885-4047-81dc-bf44ca21cfd0", "value": "1536:kPEmUFbpQa2vZfE0tHCrBmJ0oKk2OPIzWROjJ5I621Gur7qc0++ZlnBW73RcinIx:46oTBpQw+k2OZt1GA0++G+ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771378228, "uuid": "fbb5172d-052b-4699-aeba-b2c3cbac076a", "value": 136016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771378228, "uuid": "72164d7d-c2d3-4652-a060-98b38e22f22f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771378228, "uuid": "fb6312bd-721b-46f6-8e26-e3717e06d414", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026bbd32-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441193, "uuid": "df883ccb-6783-46dd-891c-cebf08e28c44", "comment": "Malware payload", "value": "d8caec741a54c86c99c8de0a97e81883", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441193, "uuid": "d14d690f-f4b0-455c-bf23-fa4d552a2af3", "comment": "Malware payload", "value": "88af04758c4631285be2ed2ddd220a27ac701130302f745449de89a85bdef6f0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441193, "uuid": "04160705-470a-49ea-9f7d-ac69202d425d", "comment": "Malware payload", "value": "319c840bf54d1161277d1f7b351fa595caf7409d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441193, "uuid": "f90dc424-e7bf-4343-ad79-de0a72111dce", "comment": "Malware payload", "value": "bf105021e6cd567fde1ee22fcd646c44a2949a3ca216ebcabb64b287abec106f224c4fc69cbf7b3c95a6ce3982a10d4f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441193, "uuid": "a067771d-de8a-4c85-89a3-14c3bfcbaff3", "value": "T18E51CFCD13F047B17D457A8FBAB488E07E4864E1A9C20E11B5C9BDA7A08DE9870176E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441193, "uuid": "5aa713e9-bcbd-4b4d-80aa-9ba92088cec7", "value": "24:UkfIJQkOKYEI9+COHIUkOY1I92O26Yzk/IugakpIw06zJkXIPSk/IQCckRIuDk//:UA+Z1YghH6zJEcEN9Ygin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441193, "uuid": "b3d152c5-24de-428b-bb57-6272a75b5d3b", "value": 2777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441193, "uuid": "072d9f27-f9c8-4267-bc57-81104bd50b4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441193, "uuid": "d01c1ac7-2981-4c66-9337-bf4d909d82bd", "value": "penis.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9c6081-0c69-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771378207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378207, "uuid": "c5948c60-ec6e-4565-8c9b-5a7cbdc2621c", "comment": "Malware payload (Formbook)", "value": "fd239b4c59b5d8b083c7ed1ec7444aed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378207, "uuid": "3df993dd-4bb0-4bc4-a09d-d92f6fdfee96", "comment": "Malware payload (Formbook)", "value": "892bc644461156b75443af62eb4b44e88b0ad36f9c19dad0bb6064be7a612db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378207, "uuid": "9dac1b1f-5b9a-4654-a9ff-d25b100dbe55", "comment": "Malware payload (Formbook)", "value": "21dd904fa52f7e15d471886b0b0f41482812a2df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771378207, "uuid": "71867ec3-57fb-497b-a514-dc11f133add5", "comment": "Malware payload (Formbook)", "value": "1207dd13d08f1de9f0f3446e471d3b985a9bc95b521d2b205f6bfc6b1ff5be9dca43c4aefd60839228cb8a8bc7da9749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771378207, "uuid": "65e3d9c0-05fc-470a-921e-4894e4ec6341", "value": "T10A45BE027391C062FFAB92334F5AF6115BBC79260123A62F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771378207, "uuid": "184d7ec8-ea7a-436b-933b-01a6324ceb5a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771378207, "uuid": "799c75fa-4adb-4040-80a2-518c4ee587ff", "value": "24576:e5EmXFtKaL4/oFe5T9yyXYfP1ijXda4YHIo5pA2G:ePVt/LZeJbInQRa4z0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771378207, "uuid": "05703070-93c8-44f5-bf35-9b8df13b4eaf", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771378207, "uuid": "b8a56507-381e-4af2-ad3a-45fcd8af40ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771378207, "uuid": "9eb53004-8cbd-47be-a64e-a238194fb67a", "value": "rFebOder-PO557_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc202ef7-0cf9-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771440243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440243, "uuid": "f629619d-11c2-47df-968b-c37922ee6bed", "comment": "Malware payload (AgentTesla)", "value": "f8431e2c08be682fe7200d84911a75cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440243, "uuid": "a504d80b-9a58-4dad-9315-71bd7ee2dfb5", "comment": "Malware payload (AgentTesla)", "value": "8a10b9b93bd811b2e39d1a6401ec12e8fb716e3d9ba313d2133d557e67006699", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440243, "uuid": "9205f3f8-2f02-4e59-9954-b25bb775bed1", "comment": "Malware payload (AgentTesla)", "value": "58f5d1fc999965c01146a771198439dfdb35298f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440243, "uuid": "9ffa8124-9338-4d09-851a-6bc39df288af", "comment": "Malware payload (AgentTesla)", "value": "1e7c243c3b024af8146e8f4231e20114ae00fe7e0f108a0947ecc363c4b516e0af56c2d3c6a757e2beea2a9eabab7358", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440243, "uuid": "4ca15714-2fe9-475f-b156-786fad362751", "value": "T1D7340E037E88EB15E1A83D3782EF6C2413B2B4C71633C60B6F49AF6528516865D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440243, "uuid": "4f58fced-3675-412a-89bc-0a73c7500597", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440243, "uuid": "9dee52ea-25b7-400f-8122-0928f8cf14d7", "value": "3072:iogxzVplR10/du5nNXbN5VudhBEe5TyCSMrG:iogxzVplR10/du5nFbN5wSVC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771440243, "uuid": "cd2953b1-e855-4759-915f-ac40e0b079b9", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771440243, "uuid": "a74cfcd6-46f3-4c38-a44c-d2abb76ea587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440243, "uuid": "6c12cc0e-13b3-4783-aa07-d00a44186965", "value": "e8ae4cc3-dac5-429a-ad46-d51bb0595a38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c4f6a6-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433097, "uuid": "26f9ad2d-6209-4605-aab4-f5a5958f1f28", "comment": "Malware payload (Mirai)", "value": "1c47ab86c484d844f38689f3b7e071a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433097, "uuid": "18b4136b-e7b2-4cb6-af6b-e8d95748e3b9", "comment": "Malware payload (Mirai)", "value": "8a8ae61eab18fffcd81e21096b264beb5f81b927c1702ceb2d5cf9d5047319ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433097, "uuid": "f549ca79-f04b-4ae1-b75d-28f733728029", "comment": "Malware payload (Mirai)", "value": "97062519fc24c7313e2b12fa056b4702730dd174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433097, "uuid": "a3b37bad-bd25-4341-a906-c4f47cb383ad", "comment": "Malware payload (Mirai)", "value": "db7d03e121dc253a6d9feec07f79316925f25b5df2cad05bb00ef574fe9a534fec63e85fd4bf08cd01e049fdfe05ecb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433097, "uuid": "34202672-166a-4223-b357-3821b1f4e457", "value": "T138042AC7F900DEBAF40AE33748530909B130B7A204925A777257396FED3A1D91977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433097, "uuid": "770fe2bf-3794-451d-94c8-a0656e3b55c0", "value": "3072:MyjKBqyGL2/aJmvVah14yccUVuS6nYR0tocbWuobHvHJtD7hJV3jbiZLoHb6YTyc:4y3oyclV16pt877hOL4KKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433097, "uuid": "528acf24-e0f0-4929-bcaa-c986b473fb14", "value": 177636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433097, "uuid": "8a54e1ed-395e-41f5-b15a-4fc6404546b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433097, "uuid": "e4c1d9bc-3dd7-4fed-b0dc-765d617c12f2", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b98258b-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771406500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406500, "uuid": "112cd2c8-4e19-47aa-8a91-b2a0f90b02d7", "comment": "Malware payload (PhantomStealer)", "value": "f82b4eb8554b7f342736edace36a5611", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406500, "uuid": "5cace100-6284-4389-85fc-4f10fa183d48", "comment": "Malware payload (PhantomStealer)", "value": "8adba28728f17175cb20c43e0770a801c35d8b10872e7b10a8541461c56eb57b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406500, "uuid": "11a56873-cedf-4e47-8054-23c3d2ae0666", "comment": "Malware payload (PhantomStealer)", "value": "3db25e1f0f814baeb8e55d897fdec6dabd8ea1f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406500, "uuid": "3cd7cded-c74f-495d-82a3-0a41365e5ccf", "comment": "Malware payload (PhantomStealer)", "value": "6ad4e4a28762056587c1f788b9e8f8a1f697a2057f0ec307021a7ddac6dab7a21705204036bcf3744ab97cce1e3738c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406500, "uuid": "41f9b624-875c-4747-b1a1-f8d65e8605f5", "value": "T127355A3E0B645A88CB5482D7269ADD889FCD1337623258989EF778FB950D4AC370B734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406500, "uuid": "59dbe4dd-22c9-42af-8937-1f959ca2d579", "value": "3072:CJQUrUgeZeESCivs5ZZg8Ud3cf9g9htFdbu843+fWNJpmooqHMW+v:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406500, "uuid": "31f8dfe5-7c9f-443f-9b61-201ba8a0ced6", "value": 1131976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406500, "uuid": "cedaccff-a795-4efb-94db-9b8cf7971a88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406500, "uuid": "bd25a3f3-442f-4629-91fd-bb5947ccc1ad", "value": "c56c7f14_2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8981a55f-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771407060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407060, "uuid": "d1957b37-cf02-4a5c-9551-e447ab572055", "comment": "Malware payload (VIPKeylogger)", "value": "0253090516c0b462d7cad394b307f8c2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407060, "uuid": "fdebe99c-7c84-4770-9591-f4b5e48ab74d", "comment": "Malware payload (VIPKeylogger)", "value": "8b35a602cf262271e128dc4a29ec82347b1ab5a377fa0b49e7a83bcd5976d720", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407060, "uuid": "151cbda9-be37-4989-a882-34767a8360f4", "comment": "Malware payload (VIPKeylogger)", "value": "eeed5b24fa7b6a8b7358fc42f418a7a06ed0180c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407060, "uuid": "4c5cee15-994c-4607-9c6a-614c2dd255be", "comment": "Malware payload (VIPKeylogger)", "value": "a970d2b9ee3263100de276ff0ceb21f5340730e38f71de4619e17d07e979621539a9e0ca3fabf02771ac8620a14cab96", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407060, "uuid": "d1c5cb26-a807-4f15-9643-05a5ebac2e14", "value": "T194550102D604DE910A6C6115504A9EC2A6510EB75C10B7B27F9E8F4E5F2F60FC2B9BFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407060, "uuid": "4aafae52-cd29-4fe8-bc75-4fc920d9ef1c", "value": "24576:bawKG0YwbqzUG0rrrpEd4SYBYLA4Am7HoEtk4iKFmD1oTMNq8ssNLmfLg+O9S:GXPmYVrl8YOI2c15S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407060, "uuid": "6ae5a831-f796-40d4-bddf-cd34f71e56d8", "value": 1367533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407060, "uuid": "296058ca-8a8a-4321-bf42-2aa3e95470d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407060, "uuid": "cbb74535-ca4d-4744-9675-3acaaf148543", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9d3e5f-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441207, "uuid": "30cc5880-063e-4d81-8d53-57414b7b591b", "comment": "Malware payload", "value": "3f46a58504106e61aa584a60679e2d38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441207, "uuid": "4b516898-fb21-4198-94be-0bbc1e54a1af", "comment": "Malware payload", "value": "8b7ecc712c2c293090dbde9641e565bd95dc3326d91960d87dda75528e88cb3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441207, "uuid": "8997cf56-916f-46ab-a284-8fe1689990f5", "comment": "Malware payload", "value": "6c8b034c4547d9bb1b5b8d34f1b3b7dde8c29fdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441207, "uuid": "d372312a-f123-4bd1-b2c9-77f2a7e6d4fa", "comment": "Malware payload", "value": "343ec0f8d10c3f6c1285e5056211090d6f30d7904c5f4b1cfe5a5aa5ddb5272e311e8200fa97107a4bf11ca0ba8e8e66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441207, "uuid": "fa55cec8-0c61-4830-a8a8-974a098e2f3f", "value": "T1DFE32942A652DAF3D9C31FB612A74B610633E82A1F2BDE45F32DBCB45E4518CF10A658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441207, "uuid": "2453014f-5646-41b4-a61c-26426dea68a2", "value": "3072:SJvJUbdM6rp4d/d3EATa45PVi+dMoZpmD6Cyq6wcYTC4UHgB+:SNJUbdql3xT75PVdDZpmD6Cyq6wcYTCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441207, "uuid": "e026eb2d-32a1-4463-bc40-cfaa80e3886c", "value": 157289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441207, "uuid": "0813edf8-71e4-41cb-bd03-f14cf25cc3a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441207, "uuid": "e64b557f-75ad-46f9-9088-079c6bc50efb", "value": "mynode.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e572ea-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441228, "uuid": "f78173d0-aadf-4cb2-8ba5-62e40b3a7074", "comment": "Malware payload", "value": "bd56365746eaabbb389884a8b1ba0d1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441228, "uuid": "fa845989-ee0e-456f-843a-bf64f2912cd6", "comment": "Malware payload", "value": "8d85cba88d213d3ae14cac784b323744a744279202ca2f7d02c3d932a54f8d95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441228, "uuid": "3360de72-7a5c-4721-a471-8dfc306ba086", "comment": "Malware payload", "value": "17972e8aeef7ff7504809a937787a6967405b01e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441228, "uuid": "111d5b32-abf5-494e-a173-d360c3a88ddc", "comment": "Malware payload", "value": "dbe56238445cafec262c9d7bf690d7f45b5ca46dd7eb57f4fc849e1fcb0907d4fdcec926686f12b760bb8f65fc736963", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441228, "uuid": "fd4b8f8b-a5fc-4d84-8c10-408bf388a420", "value": "T12B3408077B618EF7C89FDD3306F6860220CEF4572564772A7378DA6C7A0A64B4993CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441228, "uuid": "88437b93-815d-429f-b5d3-5979cc3a70d7", "value": "6144:4R02olOqHLpOhurpM8a9qmm00NCcZRscGVLkhWMD:43o0qHMurKm00NCcZRscGVLkhWMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441228, "uuid": "0503ec3b-5e00-4670-8a09-42ba7cd7f106", "value": 238026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441228, "uuid": "32236b31-ff5a-4745-abdc-953ff4337c16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441228, "uuid": "abfc4408-8f40-445b-875e-3eaeaa66c860", "value": "mynode.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11eb4f2e-0cf4-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771437783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771437783, "uuid": "e0fe51bd-3927-4fa9-91c5-037c89d6d4ae", "comment": "Malware payload (QuasarRAT)", "value": "f74bb47bdda7e7d715d8a579033c98a6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771437783, "uuid": "af72d9ba-b17f-4f46-8085-3a7a517f8237", "comment": "Malware payload (QuasarRAT)", "value": "90d5dca5a7c377d98eb2e739ec1309304432827633ca25b2fa8e031c2f271429", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771437783, "uuid": "34c47999-9b06-45ab-8240-dc53a2862b37", "comment": "Malware payload (QuasarRAT)", "value": "fb1a2e417475b138ce20ee701cd020cdb973fce4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771437783, "uuid": "e3470246-6401-4429-8d7d-f491ea2fded5", "comment": "Malware payload (QuasarRAT)", "value": "4ca2e4140f52d574b0d1e86bb42c055130fa285de378c776a251973f4f4e69bee661a9e41923d29be16418f04491bfe1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771437783, "uuid": "c26c05ae-67bc-40e1-bd46-0210abf04201", "value": "T19756220168C95AD9F439463598B142300235BC570F916BEF899CBF73B812BC59D2BBBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771437783, "uuid": "b059d9db-8e03-4051-b0f6-f9a03467c345", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771437783, "uuid": "18ce7305-2038-4eea-8219-cb74127115ba", "value": "98304:Aaffffffffff31LRaffffffffff31LcNffffffffhRgr0imalJPkoAMnv5dr6N3o:l6gaJsavvrcqxzFAsp1Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771437783, "uuid": "57cde904-2836-463c-a89c-2aaa36744e13", "value": 5915136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771437783, "uuid": "0d389d37-8f7e-4190-985c-e701a9df8511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771437783, "uuid": "e3809fb7-b248-4ca8-9865-54b155d13fff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d614ce0-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771407013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407013, "uuid": "8b3eb9a8-e348-4603-b0f1-253ed7b99247", "comment": "Malware payload (VIPKeylogger)", "value": "93190b7b3f6bee85eac5a8f0286cb90d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407013, "uuid": "83e46652-5939-4ed9-9eae-eaeaee77570d", "comment": "Malware payload (VIPKeylogger)", "value": "913c3cd8ea89f18055f6c83341936078db76472f8297708e5a0bbf147823a388", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407013, "uuid": "10aab427-3942-4f50-9d22-85d61cfd3035", "comment": "Malware payload (VIPKeylogger)", "value": "0069a4011c26fc77e6ac205717b43e37cc631320", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771407013, "uuid": "440468cb-3f4a-49c6-9b7d-87d247a18287", "comment": "Malware payload (VIPKeylogger)", "value": "726063538c81bfac0a8cb60112bb28f13500bd9ad3982ca0c0d0affdd351225cb3cdfcf5f132bcac74ecde160aefbe9c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407013, "uuid": "de35a636-ae74-4c60-a1f7-eda75914ba2f", "value": "T18C451211C94ACD29826C8125242A6CCB5A804E735C54BBA67FAF4B8D1F1F64FC5723FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407013, "uuid": "2484ce6c-6cd4-4ef4-9d00-cd30a14b0175", "value": "24576:W1Juf+1A7pQeyaNsdi/T8/Etcv294Kt1qA8ZRSDOyO:Wu2qKV/5Q1CSSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771407013, "uuid": "1e4024c1-6259-411b-bb5b-c2ae2c0dc711", "value": 1196653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771407013, "uuid": "7af36b1b-0085-4658-8bf9-dcc8ae08e491", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771407013, "uuid": "b18b0b4d-0f23-463c-9a11-9ba4d87b463e", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edae5a59-0c99-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771399068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399068, "uuid": "18d25dbf-a0bd-4f9a-8d4f-ddb590b2322b", "comment": "Malware payload (XWorm)", "value": "d336a3478cbd0a395a934a0fd1cea555", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399068, "uuid": "cb343329-adf2-45b6-95e7-9828a48e9a3c", "comment": "Malware payload (XWorm)", "value": "91d62b0bac32c47b1cae197a3fabe217a06f56837b5b9197d4a72a483ef5f0da", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399068, "uuid": "8a004c40-b238-496f-8a5e-e24ba428490c", "comment": "Malware payload (XWorm)", "value": "d1a3adecf07611f7eac8955e272d33af82421b42", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771399068, "uuid": "0b6611ad-4fbe-4c5c-b330-090cc32fd1e0", "comment": "Malware payload (XWorm)", "value": "99c85f296c0c28607c0b7564e70c9f84af261c944f4eca7369b30c10675c7631881b63d7974a9c915aae7f77e2cf5381", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399068, "uuid": "b79c4086-ec27-419f-8013-9dcb28391325", "value": "T1BAF17A116DEB10DEF33707B06BDAF6FB0666E8B5551E61B870019A948B70AD0CC61F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399068, "uuid": "076b2c2f-87e6-43dc-a65a-157324da0f72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399068, "uuid": "1ba49c1d-d15a-4cbf-8281-7b8e83f179e5", "value": "192:n9/3y6vk39Njy/aL1bp+dUqMavvs8g/bjINtUqoOCYhpvk0Ld9:n9Pk39NVL/q/lsKNt/1CYHk0Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771399068, "uuid": "b55add98-bc62-446b-b875-735238ed1d01", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771399068, "uuid": "b10030d5-4e15-436b-a27a-4d3a612ebbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771399068, "uuid": "340490f6-8fc6-4911-8cd7-7adce16c8860", "value": "91d62b0bac32c47b1cae197a3fabe217a06f56837b5b9197d4a72a483ef5f0da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cfbbe5-0cea-11f1-a129-42010a9c0007", "comment": "Malware payload (NirCmd)", "timestamp": 1771433874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433874, "uuid": "3b269405-5302-4db8-9396-d85bd07ef5e1", "comment": "Malware payload (NirCmd)", "value": "abf9fac17aa11fedb4c44a110627e103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433874, "uuid": "6cb78f94-d171-4a85-beda-1a5e942f488e", "comment": "Malware payload (NirCmd)", "value": "924a9a5ecb555547cea7997b34d2ec56bb47a104628e5a6661ef12d2cdd87c6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433874, "uuid": "b45fd0d0-f1af-4ff5-a128-201b0efb4f08", "comment": "Malware payload (NirCmd)", "value": "f0853579f9e9a7c4ec6e4d89c0a81a3d3397cf63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433874, "uuid": "8ba756ce-c96f-493f-bf86-5afb410514c8", "comment": "Malware payload (NirCmd)", "value": "ad79360ec3ebaae06a633c20e030a96296c547567d9352a5ec5468e14067b7958572cb4fb237daf81d0a544c5cd950cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433874, "uuid": "ab74992a-20f0-4788-9b67-e69c9380d334", "value": "T1C1A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433874, "uuid": "afd9ce8c-f5bc-45a3-8c73-04df537a2524", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433874, "uuid": "073c02a0-cd44-4b2c-9eec-222185c981e3", "value": "49152:ABR8Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aCTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433874, "uuid": "9aae9ff8-c7b4-4c8a-a4a6-e07c29384597", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433874, "uuid": "a6ed17fa-e682-48ba-86bc-10ed080ea04b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433874, "uuid": "b467fbe6-ee24-4b40-a688-0a0a151f6d9b", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23810094-0ca9-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771405600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405600, "uuid": "f6069e18-6fb3-4774-880f-8db64f534a07", "comment": "Malware payload (RemcosRAT)", "value": "01ca3fe54f01c0d479f64ae98bebafb1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405600, "uuid": "75bd990c-70f6-4303-b6fe-2e0f8e7893c5", "comment": "Malware payload (RemcosRAT)", "value": "931f6e514fa88fb48fdd51a700d181535b51a1fd5fe9b67b9f5881f108478967", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405600, "uuid": "b8fe7a31-1814-4d49-a22f-fb90c871cb67", "comment": "Malware payload (RemcosRAT)", "value": "351173584deeb4bb738e5a7eb2836241432a5317", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405600, "uuid": "e03469f0-48d5-490b-a253-31cfe5e625f0", "comment": "Malware payload (RemcosRAT)", "value": "7333858c7e4dd0062184c1accef1904548be9a1def8d4eab4977c7d52b3b7ca091cabfcc9ae18e0f1c239f74503ad1c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405600, "uuid": "e4495bb8-ad57-46ba-8ec2-91dee3924e70", "value": "T19556E7802384E872672B6BACD639E9B1ED1A441356C5DB0C319A7B44F199D07E36CFF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405600, "uuid": "f84d4b41-afc4-48de-a391-59e0e5579e3e", "value": "196608:qhnexPnlgENlPVHOUECtS8fol6WwBrkiohxv:qhnkPnlnPVHOUEh8fo3ioL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771405600, "uuid": "f32da742-a48e-4bd6-a759-ffb1f323c0a3", "value": 6340904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771405600, "uuid": "fa0028b4-a605-4bf2-8687-9cb9d99c048e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405600, "uuid": "05b5e402-0bae-4d1d-89af-bac69a87e388", "value": "UniCredit_Bonifico_SEPA.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf095187-0cda-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771426907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426907, "uuid": "60885682-3178-4ae8-84de-e24b6d4c0d97", "comment": "Malware payload", "value": "bcf59bf3134b5fd4aab1b657affdc615", "object_relation": "md5", "Tag": [ { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426907, "uuid": "e6ce09c0-e0a0-4206-9d32-f97c5677f8b8", "comment": "Malware payload", "value": "937cf5328ec09feed9cf07135a3f2cda1830f3e22ca1d62b3ba64f71c0a1bc79", "object_relation": "sha256", "Tag": [ { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426907, "uuid": "1f12e3ba-b9b5-4a7a-8ef5-e3ce291dfab6", "comment": "Malware payload", "value": "5d09816e810c028559d3c4cbf649d7a5639041b2", "object_relation": "sha1", "Tag": [ { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426907, "uuid": "6a1f5582-bc1f-4154-90da-fa14f7261243", "comment": "Malware payload", "value": "d8cfb3af162874375330d36aad7025a9beec631eeae065967243a2469d766f278f0647525c74ccbdd0eefc7edca140f7", "object_relation": "sha3-384", "Tag": [ { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771426907, "uuid": "33e5e5cc-025c-420b-a937-9d3f561717e1", "value": "T142E465C917BCFF23E2419DE189C1B61A2825813AC95366D6C0572EBDCD91FA2BD8F5C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771426907, "uuid": "4174cc3c-414b-4f2e-9537-f592aefc6e8c", "value": "384:fyacQHb65qoOE7kFP2H+kBfEilEiMftBa/6G9I7Tetyl3v+yGw9kDpo2Xnr6oNQz:NRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771426907, "uuid": "7e5db0df-4393-463d-8a0a-c6e61ed5132d", "value": 665017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771426907, "uuid": "7239b06c-904f-4065-a1ed-3a5951fe5e80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771426907, "uuid": "0bb4188c-1da8-4317-8092-a96e054743f8", "value": "3f4812-f6d45c86-ebc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400cceac-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771446021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446021, "uuid": "1db54128-563f-4564-a739-0a7bf6a8f10d", "comment": "Malware payload (Mirai)", "value": "42212f02789b767afed0e97e0db896b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446021, "uuid": "cb8eac1c-d66d-4b82-9ef6-7665ae9e7345", "comment": "Malware payload (Mirai)", "value": "9683f74078e52ffe9920fd2ddc4c943cffba98d713c1900a9f75230fbeec7777", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446021, "uuid": "ae2025c9-bb7b-48b8-a466-f1bd3a7024a0", "comment": "Malware payload (Mirai)", "value": "7d887fe2d31a5576bcd4d78b53fedd7e51d2bd54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771446021, "uuid": "d2f21265-cacc-48ee-957e-abe99b7b2bf6", "comment": "Malware payload (Mirai)", "value": "a8efe223454f2d4487efe433924bf03db5360ba80380663c82d3e4014e2d90ecaa0a5f162ef96d7a9a99ca6e02325cae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446021, "uuid": "825322f3-dffd-4ae7-9488-7b1111950cf2", "value": "T10A04D816AB550FFBDCABDD3706E9070139CCA51B22A43B363674D528F54E50B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446021, "uuid": "d38d90fb-f870-40e5-9deb-bfcf6c4e501a", "value": "1536:Yzeia+IuPF3gPS0QCQO6oYJQqczaN7RtJaF64iiTU58NaZ0zk/SQ1pMnEySHtKeQ:MeiaxFP1KnQ64hTRaO8pM3SSjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771446021, "uuid": "2d12b86d-0b33-4a8a-a4d2-099890f91760", "value": 181860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771446021, "uuid": "b806c1a0-bf80-4659-91e1-47903b9d9573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771446021, "uuid": "b17cc9b6-7223-4f97-93e6-2d2ff50d5a75", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a229ed-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406591, "uuid": "7fdce489-8c58-4fdf-b8ed-df231ef26dc7", "comment": "Malware payload", "value": "e75c930da02511da40723aff6849c3a1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406591, "uuid": "9a47807b-2478-40c8-a165-f2a4d40221f1", "comment": "Malware payload", "value": "96a36cdbfd4158f5a3dd062dcfe0fe8533e3dd63b5f375097b54c148e991f605", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406591, "uuid": "1b35300b-b4df-4f61-9275-eca13b054c51", "comment": "Malware payload", "value": "f617234b83531767ed2664f579846d1337603815", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406591, "uuid": "9f4bcbeb-b375-49fa-9816-3754082bfa1f", "comment": "Malware payload", "value": "351331beeb7b9c4f9dba25838bedf1102a667d204c7804cb41087e0fb945913a84ed32b148d772aee2894a37f9152995", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406591, "uuid": "39840e88-5242-4b3b-9432-3cf4a7c19299", "value": "T18721E20963C89F03E3F5C7F6C6B6A1D8EA2874306D52B90D51A4854C3462519EC3476B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406591, "uuid": "b7508965-a0d1-41bb-9376-5ab831a3e4d9", "value": "24:88qAnZ1DLKZqHQA3vCAq4I0QYfWX1WXxVLcUYmf:88bZ9e+fCQI7ZMxVLcnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406591, "uuid": "37101e9c-a5f5-4d99-91db-d589b73f0b5a", "value": 1205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406591, "uuid": "eded6000-b325-4dd0-b85c-3a9edcb93706", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406591, "uuid": "c00d80be-689b-4b08-9cb4-35054b8e3642", "value": "view receipt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32da2ae1-0cf9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439986, "uuid": "bd44d816-b218-4f5d-a6e9-d03a60b344f6", "comment": "Malware payload (Mirai)", "value": "6b6f2f0fc1a01d6ee9d3018d405efe0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439986, "uuid": "57fc96ec-e383-4840-9658-434eb7c95ad7", "comment": "Malware payload (Mirai)", "value": "9749c3c8f3ab808ddf5fc6a6ab620341ffb0c2e0982bac84535d3f609d4ce8e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439986, "uuid": "819400e2-221e-4a80-a97c-acd32cbe0ad7", "comment": "Malware payload (Mirai)", "value": "71655d5c5a58eaa5901cb3016865439cf8a6f67b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439986, "uuid": "28494c25-6941-420a-87ee-71749d1a1f15", "comment": "Malware payload (Mirai)", "value": "491635748300432d8e71f7c6d07489c3d268b2180ffb3b9ff5255b945e0c9b69ff8b5a746507bd76acc96c437fcf0b56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439986, "uuid": "c37b70f7-2ec7-4f15-bbce-3e0f49717ed2", "value": "T1A704B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439986, "uuid": "15aeb18c-0ae5-4227-b4f8-e6fe3bdd79df", "value": "3072:nKpzGeeNkSfcQqmav8SqaRVlnYz65wVt:nKYeeNYQqmeqavlg65w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439986, "uuid": "edd4c8fa-8b29-4654-b082-a622219c47ca", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439986, "uuid": "13b26ee1-3b7d-4a4e-8ea2-aeffb1f0473f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439986, "uuid": "e3cd6929-5393-4e2b-b2ec-1ab17d9c9687", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff853c28-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441188, "uuid": "0057f081-c039-4f5e-8637-d7f106d75bcb", "comment": "Malware payload (Mirai)", "value": "2fb02b818f043b6c291ba655bc806aab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441188, "uuid": "7174bb58-6ac6-45de-adc3-edf46a8697af", "comment": "Malware payload (Mirai)", "value": "97d00a82ac3ab1621eb41070c734bf144d64c2b1f6cdb162da631ffa1a6d0ffb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441188, "uuid": "2e55458d-5905-417a-a37f-ea8fb48144c9", "comment": "Malware payload (Mirai)", "value": "b6689ea2b3ec4aa758242a6069c86530d56c5562", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441188, "uuid": "8d411fd7-4b4d-4510-ae7b-80a951330053", "comment": "Malware payload (Mirai)", "value": "4c1e52390f7c0fbf1ff339ae5d6ed237216eb1dc15f18d5b2ec65c9d3df309ec0661295cb0c5ee147643da607a0e608d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441188, "uuid": "604b2b4e-5842-459e-a749-9f4703a9cc37", "value": "T119961862BF88DE1FD6A430358AA6C23833D93D0582A024379651F71D2EFE2B59D17DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441188, "uuid": "ea0326dd-3357-49e6-957d-8350d3d26c48", "value": "49152:H9r3SjD0FtmUMbooqiwXi1JoFrmMv68WYdt+2buZokHxft5Eo:1MOiwZd3LsokRfjEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441188, "uuid": "bf396633-5270-43f5-9706-928fb79576cc", "value": 9175188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441188, "uuid": "86d81166-0530-409b-85c8-9abb22267dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441188, "uuid": "e221ebd4-46ff-458e-8ef4-515419ade647", "value": "kintegrity0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d86c7a-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441573, "uuid": "2c9656c5-a212-4fd0-97d1-516b598ad0c0", "comment": "Malware payload", "value": "6198c6dc562abaa35cda0ac77fb39b9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441573, "uuid": "e9f47a98-c67b-4358-8595-f6daf202540b", "comment": "Malware payload", "value": "98812df45c44e4e29e41e22a573ab08bbdfcf70184ade3f419adbdc90d03843b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441573, "uuid": "29504dca-be40-4577-a088-9699b4d2ae1c", "comment": "Malware payload", "value": "7612e18da27d2ff3db90bd247e0e354c7776a98c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441573, "uuid": "88990808-c53d-4676-8230-9371a82b0b6a", "comment": "Malware payload", "value": "10e3ecf8c132bf70383f561787f7b3ec9d16baa215f7f9799233253425d27fabc57426cbb1e0f663be650344d2063fc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441573, "uuid": "ea347030-dacf-4c79-a982-b6eee7eb8f3d", "value": "T161B47C02BBD1587EC496C930874FD213EA75F099312275BB3696AF602B27E30DB2D791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441573, "uuid": "07c8b37a-a3d5-475f-9bbb-280c36568ed6", "value": "12288:N+VxtuT8A6SXJBucdeojrmzbfkyERHIu6kmU4pHjYTg:Neob62zfdfjKzboD6gIDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441573, "uuid": "e1579194-5e59-44ca-8aa6-730c54e77867", "value": 523008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441573, "uuid": "45870822-aca2-4813-adc1-969d82443e8d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441573, "uuid": "6a2936d8-d84d-4da9-8f98-af0d17c1375e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d7525f-0cb6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771411325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411325, "uuid": "2a6054a4-793a-46f7-80ac-1ad3be0e6447", "comment": "Malware payload", "value": "0e3a9442fb436e4a1b49b3c622904220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411325, "uuid": "52d6203d-7adb-455a-8d59-c3af276a4f62", "comment": "Malware payload", "value": "9963fed357cbd03e525d3bdb92fbb6f57167a2bc881befdbdd7107352f9ade15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411325, "uuid": "12bfca7f-def6-4c19-96d3-c566f515e371", "comment": "Malware payload", "value": "0b553c4927e7b2180fc6314f1129a1fb270a0714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411325, "uuid": "22ddd4eb-47bf-4eaa-9c66-231c6890c3d0", "comment": "Malware payload", "value": "5d72859451fb0ccc8e62c7325073b0a926860d8679975faffe9a5385b34dd54ad6b1808be7bb640f0604a3114740c5c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411325, "uuid": "75c60476-cb4d-42ff-9abb-27506c12355d", "value": "T148E34A5BB3A524F9E1B78279C9A20546F772787607209BDF03A443762F236D09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411325, "uuid": "aa2a5c5b-cae3-43de-8284-ad082129da76", "value": "5034f3b5a77b4e9b05822b7e12055b85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411325, "uuid": "30850e5c-0be3-4f15-8ad4-1c0d0304ddab", "value": "3072:qsjuHAZVOwQME4UZceDv5a7hSRbXX8zBcqOxKCj4WN:qiNZVOwQF7cShZzszPpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771411325, "uuid": "cf5a503f-0646-40fb-8716-5c2b43d7f47a", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771411325, "uuid": "20ddaf78-b6e2-484f-bfc3-8543e9097e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411325, "uuid": "70abe3c2-1617-465e-9e1b-b2e5d7981e85", "value": "0e3a9442fb436e4a1b49b3c622904220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe510b8-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441585, "uuid": "efaa3dd9-46bd-4c54-a9c7-afcf3709ab25", "comment": "Malware payload", "value": "2c76103830b2341456aadab757301b4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441585, "uuid": "d05180fd-325a-4e2c-ba55-0f8db2761603", "comment": "Malware payload", "value": "99752a194b98d7ff3b85fad553430c4ace0fcb80196fec94049439dd817143de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441585, "uuid": "6ddc1f69-aaf4-49a8-b536-518718f67f0f", "comment": "Malware payload", "value": "d6cf46facd958667c388d8d11a7194b1a16ad8bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441585, "uuid": "26d31e68-0a11-4540-9a49-5e4310ab44b3", "comment": "Malware payload", "value": "8bdd71267e429ed4d26dc8c4a1f6e4438b5bb265c413e4284e8b1076c8642be1f5d7b6d8f1781f3c23d18b6e9abee79c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441585, "uuid": "7787e7b2-d52c-4672-b18d-00ac0cb20c92", "value": "T107A43966F8509F92C6D02A7AFB5DC35C33131B78D3DE7112CC165B2563AB84B0E7A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441585, "uuid": "c483b93a-7545-4db4-905f-e31aa98ddbd3", "value": "12288:ut/erpM8ansHQ1nCgsvFLHiNPwQmrj/0iE0n017dgp2W0xtQhlTpnCmWrWGd2M8:SedZpLHiNPwQmrj9z8W0xqhdpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441585, "uuid": "6519c0f4-7a68-4779-8522-b5b5058d0e02", "value": 493300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441585, "uuid": "334d861c-6dad-48bb-aa4c-9a6eaadb2619", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441585, "uuid": "7fe601ae-b25a-4621-897a-6b93615955c7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b40760b-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402204, "uuid": "33c3197f-e8fd-4118-9945-e3de3575ac3b", "comment": "Malware payload (Mirai)", "value": "738c2f6b6d7516ab504217f2991d4f2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402204, "uuid": "2480016a-3eec-4a53-8082-b1fde82c527b", "comment": "Malware payload (Mirai)", "value": "9989c3049e0c5728cdf5d1ab5ec56feb172e1743ed720acb218649fc2d364fef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402204, "uuid": "2c14591e-6a8b-4b81-9420-c1f56692692c", "comment": "Malware payload (Mirai)", "value": "ab6faf02b938105cdc3f2da7f9142920650b3e31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402204, "uuid": "775fcb52-9fda-4125-8921-cfb2b07ff128", "comment": "Malware payload (Mirai)", "value": "c3e8ae8695b21e7eff456a4a1d0d0986150e26d7cd72a259bfe69bba0dab77b7a983f8da11f95299d64b99910b2c53c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402204, "uuid": "0af0b4ec-5c75-47e6-ac19-93617a25e241", "value": "T193B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402204, "uuid": "3d41a3ba-d711-4ea7-9ef3-5a1756634689", "value": "1536:TUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zvz:AixnUHz4Z+5ypkn3E8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402204, "uuid": "44eb231a-7e69-4fd2-b4d6-b0c243703aaf", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402204, "uuid": "e361aa87-ca94-4222-8cb8-3c8a0e61f1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402204, "uuid": "011cafa5-0dc9-47da-8e86-6c28a4ba1cbc", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bd37d1-0cb6-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771411340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411340, "uuid": "dffd130d-986a-40ad-97f1-6475efbb1822", "comment": "Malware payload (Formbook)", "value": "0d59c3e58875df30eb618f7cde7cc80d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411340, "uuid": "d4fae1d1-5d92-4449-9088-5b72b3d81c7a", "comment": "Malware payload (Formbook)", "value": "9c0a21132a4bb82e3a9cac55be46caaf7d2733b5bd215c89fee0852453bdc4a9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411340, "uuid": "5f984cbb-f324-4974-ab9a-561d9f4b4242", "comment": "Malware payload (Formbook)", "value": "90cdea8725525089017b3f535554a4458fd565c9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411340, "uuid": "541a43de-e3e1-4507-bdc2-e1dcf538d5e8", "comment": "Malware payload (Formbook)", "value": "ad7dabb93dd3fb528b07db1e2b2b5689440cbdedbd1e4ba8464458ab4e3d1f63e21a809880e00165776573d05d3d1351", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411340, "uuid": "0f772de9-6f6e-41ec-9007-0817504e5336", "value": "T10F652342EC685EF902941221A5EE9F4A670047676C84F6567F9E40CE0FAF78F45338EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411340, "uuid": "c252f0fd-312d-4895-b0b1-bb3246eaa2d7", "value": "24576:yRNSXzTq7l7tqJKoWPLYqOgPo5nDbervNiz6z2VFlUgR/APO5Q:Mmzu7aJKjPtIDirNRC+qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771411340, "uuid": "6456c08f-e8c5-4a53-82f5-469f4e201894", "value": 1523869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771411340, "uuid": "998dbd87-2708-4990-a6ae-2b7ef4d8896c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411340, "uuid": "e04e98ae-72a4-4375-9755-c249b36f25da", "value": "ENCRYPTED (5).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f310db11-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771406808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406808, "uuid": "3ffda472-e94b-45f5-beec-013979ea7ea0", "comment": "Malware payload (Formbook)", "value": "7d7115a9d8b59ef0ce7857cbea408829", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406808, "uuid": "0c592075-1875-4c75-ae79-8f12566e8e97", "comment": "Malware payload (Formbook)", "value": "9c934a7ccc793c16eb9fc3eb21bac7d6882be543b8c1b828889d01f902a4acea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406808, "uuid": "df7f6484-b9c9-41d0-a60c-1a68613a0f6a", "comment": "Malware payload (Formbook)", "value": "470bf105404eab64d469e2f2433b12962511e122", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406808, "uuid": "606f9345-789e-46e7-bbf2-c602ea8d1757", "comment": "Malware payload (Formbook)", "value": "749f5712cc6a5492a2cb0732a4bd77b070ccfa4e5a03893cdce253ce2e6e67e97dccc22ab8519333021c517d19f67c13", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406808, "uuid": "05be858f-0a29-44b1-97ce-7b9441dda63a", "value": "T19D4552C815834DB6E83037BBBE945CAD1405C72CF8977DAE0E903CE15E96E5EA7A09D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406808, "uuid": "555c15f4-13f0-4dfb-b226-20bd324106e6", "value": "6144:Ghhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhc:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406808, "uuid": "cf384725-47fc-4b32-b3c5-fc67da814ffa", "value": 1260715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406808, "uuid": "30972148-07d8-4fb8-8616-14c6373012f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406808, "uuid": "4615f757-3267-4d08-9b01-f5020f39b8c0", "value": "OC 86435.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdef46a0-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441186, "uuid": "3f052bf5-d4c6-46a9-95e5-f69aa0b491c5", "comment": "Malware payload (Mirai)", "value": "78588f0379082704af06313887afead7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441186, "uuid": "4a33653f-b429-410f-92d2-8d6b5f339343", "comment": "Malware payload (Mirai)", "value": "9cc243a0248aa603fc9f68b1a1c209a981f08e94ef770f4b2b43891a41c4474b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441186, "uuid": "e024f5e2-126d-45b2-ba0f-cafd17773805", "comment": "Malware payload (Mirai)", "value": "0d070e7783dfe4c418d77f70a6b70d3ad3fd7984", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441186, "uuid": "ef473faa-59f9-403f-abfb-fba24e1d3b11", "comment": "Malware payload (Mirai)", "value": "4a505618994d3d21a10a3ce42f073e2bc3590603c60a24b65e85539ee11ce6a0211fbc65304530a65cf85cfee1ca5d1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441186, "uuid": "dce8ac93-6483-4142-b556-01b4fe0c533b", "value": "T18A960951AEC22B66C1DC037440FD625A72A43F455B91472327A4FBE83E7773DAF4A888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441186, "uuid": "687a64ff-327d-45dd-ae1a-602e09a771b2", "value": "49152:KepbCGwGfitxT76WC4HJXi1JosS9w78lWYr6+3bfBVPKQukfWnm5Ei:K6mJEinT5JgrnaHukfnEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441186, "uuid": "9f10923f-3475-4c2e-90cc-b2b7853e2020", "value": 9175188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441186, "uuid": "e3638464-1d4c-4f4b-b6ed-f7f0b8a421ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441186, "uuid": "4b9db91f-a82b-4f84-80c7-097bfb418abe", "value": "biosd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828a7633-0d1a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771454293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771454293, "uuid": "694745c7-5d78-4f13-ba27-701eba9cac20", "comment": "Malware payload (Mirai)", "value": "28ee2e2ddae1f436b7ebeedd84a69199", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771454293, "uuid": "e22f6ffc-f8cd-4bb0-ba0e-8768f2936cfa", "comment": "Malware payload (Mirai)", "value": "9d1fa65d2d98be8d068e8f41ef8596aa941722d13552ec08c2a5e2bea0bd5174", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771454293, "uuid": "2cc340b5-e710-43e9-91c2-4f3cdbfdf860", "comment": "Malware payload (Mirai)", "value": "62d2c9f52732ef17d4c34b0a06a235b1ff574d42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771454293, "uuid": "aadf3357-e0af-4698-8f0d-a2c35d78d23d", "comment": "Malware payload (Mirai)", "value": "12895fe34b03fc93aef6e9ceb7c698a973394835abde3da9aaefaec6ad37718a559d0dec8f59218a944cfa19bb2b0383", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771454293, "uuid": "1ebb065d-ec37-44f2-9549-2444bd2bbe7d", "value": "T132333A35B6752A1BC8D8987D22F74328B2F4168E28F8CB1F7D720E4EBF6085025176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771454293, "uuid": "1ed727fe-9eaf-417f-ad24-dc70de4cb825", "value": "768:vj72UF999I26p/d1DNwm+Bc4HpX2KlNhdtBBYBhju/QJwO+351TSOj:v3pF1IDp/nNwDBc4HpmKlzB+BIQJa3e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771454293, "uuid": "8a91686c-7da2-4ada-997c-a683cdaf8dc1", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771454293, "uuid": "a53ef14c-fe8b-4efc-a129-1e624ce9aef3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771454293, "uuid": "2fb51ec4-ad5f-4bbf-8065-001a3bf0a801", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fc7da2-0caa-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771406385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406385, "uuid": "f30036fa-a369-4788-86e3-19b8947c65cf", "comment": "Malware payload (AsyncRAT)", "value": "a62b7419f74f9c6bb9cac3c67a80bdbe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406385, "uuid": "c3cf9c11-25b3-4a24-a2dc-5fdac274c618", "comment": "Malware payload (AsyncRAT)", "value": "9e455b20cb0730c2449f488167c251b140677782e153b635e28717a011545828", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406385, "uuid": "36cee2d3-dd66-4d88-8921-0b34a1bdb327", "comment": "Malware payload (AsyncRAT)", "value": "08f779cfb40856b5a6d66c125c2e240d6ccfd983", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406385, "uuid": "6f164abb-adc3-4de5-9656-a0c4ba080abe", "comment": "Malware payload (AsyncRAT)", "value": "db26f293d75878118a68558dd8001e991e719a809fe2864c778f4797dc7985d5b7a76ec14ba7d51416c4da1875eccf5e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406385, "uuid": "c3092918-46e4-48b5-a70b-b4d9599229ee", "value": "T10284D0EB6B8476D595984E3EF1BCB059AAF1041DCED224CCAD3B483CFAB199440785CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406385, "uuid": "8908352f-dd57-4607-8095-2c5e4ce1694c", "value": "12288:0vjNTHX0eqCaWdhYYV9sfZUDxZDD0XRKh:07xR47I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406385, "uuid": "a2b53adb-4722-4a76-a111-d5c88446a90c", "value": 405179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406385, "uuid": "f2c8f160-4cd1-44ed-bd8e-a29eeb980bed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406385, "uuid": "0b18f033-edef-4f69-8a28-4a7f49748446", "value": "MV HG HONGKONG BL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89a8515-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441579, "uuid": "a037c7fe-6f28-4a59-abc7-25e0b6bbc4f3", "comment": "Malware payload", "value": "7c7134d57c8716e11ad421ec1657e4b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441579, "uuid": "4149957a-ee03-4eda-a24f-6d103895086f", "comment": "Malware payload", "value": "9ea6ada08b81cba34c0e339f8f2ac9e4407aa4c8ce84aecfe838e05a0af521fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441579, "uuid": "e55b0459-da32-4b6f-ad56-e9d8afefeb00", "comment": "Malware payload", "value": "07926c6586220fdc727fbc8a410d9980b2aa7922", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441579, "uuid": "4846dca9-b5de-4ca6-83c3-97ef1d52eaf1", "comment": "Malware payload", "value": "09affe21bb15db9a588f24c3b20ad503868181a04b0fe1e4a2c808f1c86919b5642c372aded6275da4b5fc2b6f5e6220", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441579, "uuid": "1548e6c9-57bb-48ed-b588-90cad36b3802", "value": "T194B43966B8509FA2C6D02A7AFB5DC35C33131B78D3DE31129C155B2563FB84B0E7A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441579, "uuid": "5d97281b-f93b-4783-af20-0bb277a55e87", "value": "12288:FzrXr55PDYLepuFFntNbtcMpmcvztKH/4zvuXplvV77asXnmBYAZ3PqWM8:pXrKFtfcMpmcvztKovYJ7l3mEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441579, "uuid": "29ef13ce-a73d-4bee-8d4f-47ec97094a4b", "value": 501484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441579, "uuid": "289bf903-d25b-4020-a4f6-22e9251b05c4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441579, "uuid": "c093a2a8-d7b4-435b-841f-738f8c2a7f32", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf00f3c-0cea-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771433883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433883, "uuid": "601d4e72-6842-4e09-bb1d-18d2dccc2bec", "comment": "Malware payload", "value": "3ba68d135cce70ecc833ed2996d79979", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433883, "uuid": "f178e193-e4f7-46d4-a438-f17466664b80", "comment": "Malware payload", "value": "9ea92320907fb4ec21c444f263b340e4e2db1cb0887593dc20be5c52abb217d6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433883, "uuid": "b1d1c2b3-b0a1-48c1-bdf1-97f5b2133fd1", "comment": "Malware payload", "value": "691d0d18e62f24aedd7d1499c902586d4dd016b9", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433883, "uuid": "bc0fd44e-8aa1-401b-979f-11f530535f54", "comment": "Malware payload", "value": "913da872082a2a96527db315b73aa56ae007a156293923c58a31e6c025ab57ca432fd464837a01204a9f3cdc95167e5e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433883, "uuid": "71b9f256-32c7-4a24-8612-fa738234d62d", "value": "T1CAF51110D811DEA2025C8264246A5E872A504EB70C48776A7F8F8F9E1F5F61FD47A3FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433883, "uuid": "d990946e-7c1d-4f92-b023-796745464059", "value": "49152:aBYZ5+InKY22C2LBBMP0IaISF0Bl90HP+H1kdbN+yOL3pQDhJ4CcB5lZLWSL:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433883, "uuid": "8a6e278c-ca91-4ed8-9ec2-2aeba33709b4", "value": 3554709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433883, "uuid": "55c94057-f4c8-4e92-8ad0-da34fe1b2d8e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433883, "uuid": "dba0497f-0430-49ac-9999-5801270d980a", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0385ab8-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406722, "uuid": "b805b42a-5990-4722-a88f-508aade84b50", "comment": "Malware payload", "value": "817c5f4022833a7985480ae6c5936c2a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406722, "uuid": "d24ad5f2-d9fc-4ec4-b908-0bb2841a0541", "comment": "Malware payload", "value": "9ebfd26cee261ae156774b6cf2c98d9d4d4430159a86094072cc330064d1823a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406722, "uuid": "663c3294-8207-4e4a-870d-cc887b591f16", "comment": "Malware payload", "value": "94811b0a2ec0c2566cfc6603ebb177b59b0c1bc6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406722, "uuid": "357412df-a2ba-423f-b922-4c13c813ced1", "comment": "Malware payload", "value": "7f4603efb657419aec672092e2f23abc8bfa8be93a694a642ed60bab48f999fbabf3fff9a8c95f81e726f066439d38ef", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406722, "uuid": "0433deaa-e548-494b-9ae6-4d59338f8b75", "value": "T11C4633306FA90C5F03B4C735B05F1F27AF3E4D43854CA5A649C8A19A218FAE2557F8B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406722, "uuid": "472ca829-990a-46aa-8705-883cf2ee44da", "value": "49152:NhfDIK386H7GAmTYV+8IKhwXgz1BOi93cKV/gheTpD6Zg6GIc8yVGwIpADu4gpB+:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406722, "uuid": "db8ec31c-8be3-425e-8eda-25a4d20197c9", "value": 5593313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406722, "uuid": "ffdba94a-2f29-4b6c-9d1b-2d9e3bcfde37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406722, "uuid": "614e9d8c-eeeb-4177-90f0-26e5aaffb628", "value": "Cont0U1I88_Rato1155URKCZIQ86-Lgal9104.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93d43cc-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441178, "uuid": "7534d52b-c3eb-4f59-ba7a-80b511126719", "comment": "Malware payload (Mirai)", "value": "ec7bb0d2e90da3cdbaab6020d706e06a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441178, "uuid": "208f4acd-b0e5-4af6-898a-0e49066ce4df", "comment": "Malware payload (Mirai)", "value": "9ecddb78e303ba6a90cbbfc6c291ebe2257d8f140d467d51d354f6f062c56184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441178, "uuid": "634be42a-d624-4a0f-8656-6b7e7ae343dd", "comment": "Malware payload (Mirai)", "value": "15e85562928da6bfd17b953ce3d3bae76fa99700", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441178, "uuid": "90debc6e-ba1e-489c-8bbc-16c4fb3b1b35", "comment": "Malware payload (Mirai)", "value": "ef0a66de9e67853df6d3ca7a963e568241e1a17980aac5acb892a2a2c2b7e81149103f11fe22f2f1295f2f34c50395c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441178, "uuid": "fd4820b8-dd9e-4f60-9754-7eb307636563", "value": "T162A5339C46E39608E5DC162BF1527E4B26AD1F0D9C6069C600E74FABFECB48D28DF854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441178, "uuid": "a155c06e-f914-4a8b-a162-fdd635ad7a29", "value": "49152:qaer0wkZSetpKlADM0NC5GLJhABCZ5HgQlgLVYA5RDnZnE6l:L/8et4lgNRABCXlKJYk5ZE6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441178, "uuid": "1a314cf9-2e9f-45f1-b112-4c0385590831", "value": 2119320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441178, "uuid": "9e252662-33de-4915-8fa4-2df70104c7ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441178, "uuid": "5dc2ed22-98c2-40e6-b5ff-f8aad5a58940", "value": "kswapd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a890e675-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423433, "uuid": "2f590924-65cd-4eed-aaa8-fa0aef2e4162", "comment": "Malware payload (DarkTortilla)", "value": "50cd4564a6bbda15b7bcd68f4e292e9e", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423433, "uuid": "ba33da56-36ec-4ce6-bfdb-a6d91c1be195", "comment": "Malware payload (DarkTortilla)", "value": "9ef5a2a1b2db3a08f36b5abda6cd687805c7245903b64759c342c58bb7c679a2", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423433, "uuid": "753311b7-3a3c-42b3-974a-16ae40c8bcd7", "comment": "Malware payload (DarkTortilla)", "value": "b9630028ed131df1f7302b58a43d06ed1e0c608b", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423433, "uuid": "e9fb5181-3c2b-4aee-a667-1286798328b0", "comment": "Malware payload (DarkTortilla)", "value": "aa90a964e83cf63d304eb8ed83df21f08826646a877d71c71bac18fccaf8d5ad29e68006a6d8ef2044aafe67645215d0", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423433, "uuid": "6b08bb6d-4d2b-4d4d-aff6-2d99b098c367", "value": "T11E45E00627E85B50F1FE8F39A67400444BF4BA17DB32EBAE295405EE8C21B45DE62773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423433, "uuid": "34973493-b30b-470c-946d-e5996d6bff61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423433, "uuid": "4908948e-a972-409b-8bfe-60fe1af0966f", "value": "24576:W6MlDmYNCnRveYepqMKDmfC4KOSSn2R6H+Tw:pRveYkqM3fC41p2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423433, "uuid": "61bedc4f-8e02-43cb-8ed9-b6c7e1e17c8e", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423433, "uuid": "570eebbc-e743-4b79-8f88-a8b631744bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423433, "uuid": "7dbbc222-6106-44bf-bf1d-2b1195513a75", "value": "9ef5a2a1b2db3a08f36b5abda6cd687805c7245903b64759c342c58bb7c679a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e7d3c2-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441303, "uuid": "f544b7b0-c6cb-47ed-8f59-69e511f52d82", "comment": "Malware payload", "value": "2e89a36763a385412ba4e0d5c40f2333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441303, "uuid": "b4d141fb-e38e-4b56-bb4b-008bdadd986e", "comment": "Malware payload", "value": "a016ae8260ad5ba3a1beab945c741b04c999ca3e57a611e2bf82af64197e9a00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441303, "uuid": "616fa2a2-cd0e-457a-a784-0217cc7e0743", "comment": "Malware payload", "value": "d10e4f88808db72468ae5ba99c122b30552a808d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441303, "uuid": "8e5bde62-1724-4376-8c1f-fc1c085f8889", "comment": "Malware payload", "value": "6eb68ab59ac4d4811f870ee4ba52833d574d2031abbda0fe73464edbe85200220d32d187ffa149c45e73db50e1357c88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441303, "uuid": "cbe129be-6ca8-4794-94b9-654fdb8ac33d", "value": "T1F6863807EC6506E9C9ADD63089629222BA727C495B3123D33F50F7683F77BD06AB9350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441303, "uuid": "2e7a9783-4375-46dc-a760-56699031baf7", "value": "49152:jTmRKDKFOrZiutkhgk7fJSBkxl2soGz2VjJeVq8UeHn7myMHGw2WiX1PYI9JO+s5:jKtzdx72VjcVuow16PuHFaZZN2bSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441303, "uuid": "6087a6b9-a103-4b36-83d2-165686b39b36", "value": 8423400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441303, "uuid": "2ef11234-af47-4479-a427-afc8bda8124a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441303, "uuid": "c69ceb16-8c86-4dde-9251-d546a3ce746f", "value": "ethd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cb65c8-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433122, "uuid": "fdf246df-e3c8-4b1a-af93-7913be9ae674", "comment": "Malware payload (Mirai)", "value": "cbf3ab4031d35ba2a47d51ba08597bad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433122, "uuid": "05cbb297-3f22-4ebd-89ff-8bf9a1c29559", "comment": "Malware payload (Mirai)", "value": "a184e55ebf17d046a8fb9aa450d6475046f475d0c7da1545f33c3df58bb5dcce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433122, "uuid": "5d6a1f02-ca47-49b7-8d1c-b4b304a749c8", "comment": "Malware payload (Mirai)", "value": "12907f457002bea5c44b06ffb6872f5b5354c94c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433122, "uuid": "6900d546-c197-4df3-8b49-c57cc695777e", "comment": "Malware payload (Mirai)", "value": "670e50043f2b17413c558437be628ea664ff4cb6b70973bcb99c0b8d1c8c72b7d85647709f1aa90b0646fad09f28a74a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433122, "uuid": "3c1e904b-e1d9-4f0b-a6a6-7cbb0bc5a394", "value": "T1A4034B278976AB1BC6D4637701D783A1D0FF1B801244175FBD4B4C9EFEBA3406A6A386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433122, "uuid": "63a2a3cb-b2e6-4f2b-be4a-f60c581f162f", "value": "384:KvkjZr62tQqCTHkCjpTepGyppAWcIhRZjBtwZkr3+3OXJQpC2xJEP2/ojRjVicOQ:Pj2qCTEepSpDckckrOxC2wOwVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433122, "uuid": "9d3cd50f-7897-4c92-badd-2aeb827e2de1", "value": 38540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433122, "uuid": "76dec01e-d699-46cd-99cc-cffac6dfa060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433122, "uuid": "928a0521-b0ba-45bc-91a2-89f146a37377", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ccb3e1-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771433070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433070, "uuid": "d0812a9e-f855-480b-b58a-d98991bde2f5", "comment": "Malware payload", "value": "8b8a8edb8b9ea5d0a419110edb4792fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433070, "uuid": "2229f733-57d1-4ad0-8b20-33d527a0c606", "comment": "Malware payload", "value": "a1e305f93ca28b706def540d2e1e75c430117c61f30cb495fe5174d2ed19348a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433070, "uuid": "509740f6-bc95-4c55-901a-7824ca4c499f", "comment": "Malware payload", "value": "40cc2b46e7f13dd6c85ad278f4157f31991cd03c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433070, "uuid": "31d8afe4-3fc8-4400-b1af-72dd17e1d918", "comment": "Malware payload", "value": "ad4787817fa1f729e91cdcc8290b16a751afc7e8594b76511de816edb01a2bfc97303d722dc7cfa4a9ea4a9767e84746", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433070, "uuid": "7f4b3110-86dd-41df-828b-69651ee3a199", "value": "T1C0E31A45FC518B16CAC662BBFF4E428D772A5768D2FE3203DD256F20378B85A0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433070, "uuid": "4219e4d5-0bf2-41ec-9e4c-c2675d2f78ab", "value": "3072:/e4xyQkeipAxA6iSTsV5hfmr49ETEbOIcGoyJLTJ6n79jF:W4xyQOpAxHi9/Or4OTESIpoydT8n7hF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433070, "uuid": "d81bfc75-439b-4014-9c21-38cd558fe2a0", "value": 150200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433070, "uuid": "f4e73258-56d6-4546-b8b6-7aec0c66fded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433070, "uuid": "35d35650-faef-4b8d-80e9-899736f586c5", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399dc320-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771423247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423247, "uuid": "6b2af6c7-3dde-4e18-9a64-a1c9b5dc3731", "comment": "Malware payload", "value": "1229db9e75f186f239b1a88191d9e031", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423247, "uuid": "3c86fb6d-c31c-48b0-a5f5-3372549122bc", "comment": "Malware payload", "value": "a210a54b7179c15be2c2a0ec62c62eb1cf9a251fadc1afc8ccb86d00e5b0b781", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423247, "uuid": "991c9c8f-61bc-485c-a970-7a44325a0247", "comment": "Malware payload", "value": "b47297d2a2ad9e8e80ea3bff0176723d027bc0e2", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423247, "uuid": "f2f0c589-c198-4aa8-8092-77bbd59eac37", "comment": "Malware payload", "value": "ab7e34c0e8ae2b33900c62917d13ec49b38feb16c8b8e3e1a121e7a3acc2443477a10f2c1a6c59b5c1a00ea96f495345", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423247, "uuid": "eff83032-a1a3-4e00-bf6f-ff9380185a76", "value": "T1B9C4232A1ADC815CB6083BECC8FB7F765B762ABC892805F701111D6929A95D3B73CF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423247, "uuid": "2bcc86db-0cab-4e54-bfc3-88c6d53ca97a", "value": "12288:RgSW2gCnwlCsoKdAWHOveFRQl5zX02P+CoANI7s45CT:A2gZMspZHOveDQl5zE6ja5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423247, "uuid": "02e256d2-c860-43f8-b703-d4c7df26515c", "value": 545419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423247, "uuid": "8497cca0-5339-4bfa-a9b3-9aabb3140111", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423247, "uuid": "a3564a44-37d2-499b-b7db-5fe91c603123", "value": "a210a54b7179c15be2c2a0ec62c62eb1cf9a251fadc1afc8ccb86d00e5b0b781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37de9409-0d19-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771453738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453738, "uuid": "c7d5537e-59ab-4875-997f-a2e9e8fb1da6", "comment": "Malware payload (Mirai)", "value": "800f363c4f1c34a9940c991293bc7746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453738, "uuid": "1778f976-b4b4-4d89-87d6-69ad903415d9", "comment": "Malware payload (Mirai)", "value": "a2936f3a49fc4cc5e3ec96cb5f1bddd6f236bf2650b90fb327177ab91655dfba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453738, "uuid": "c6360190-9eeb-4fd8-a1b1-85ab0831233f", "comment": "Malware payload (Mirai)", "value": "94c6a116b262758b706d49233e874489956909d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453738, "uuid": "ff838dec-01ae-4699-a219-affb0113565e", "comment": "Malware payload (Mirai)", "value": "8668572be4995badd03730f8906838288b1d2d1f5e9a3e49ddecb5b03573a283b6e05d865f0e09fca1c2daf62c8ea992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453738, "uuid": "89d68311-c072-45f2-bebd-187f896dbcfa", "value": "T11C53941A2A258FADF76C873487B74E229799379727E1C644D15CEE001F7038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453738, "uuid": "26f83555-2719-403a-b955-c3f518a392e8", "value": "1536:dMBsSfxc6HdeKImzB1M1h6Bc2ueZqf3J3J9:afbHdeKFB1geZEZZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771453738, "uuid": "763e6b85-fc71-4acf-a886-fc529899ef66", "value": 63660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771453738, "uuid": "8169104a-2444-4a9c-ab51-c81548adfb35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453738, "uuid": "4e2838a5-ebe2-47c0-b1e7-080ce8cf3704", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f090ad-0cf6-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771438802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438802, "uuid": "40e9fa82-1c0a-46c3-a19d-fa3eae2aa1b9", "comment": "Malware payload (QuasarRAT)", "value": "87f7e71d1d1218c136f58a506f9b10da", "object_relation": "md5", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438802, "uuid": "39142885-890e-4412-8b85-ea48ccc5d253", "comment": "Malware payload (QuasarRAT)", "value": "a29c47c23e0a307573df263f717c7816f346fdd053076d904ef5d20106e384aa", "object_relation": "sha256", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438802, "uuid": "c8253795-1cbe-490d-8f75-39b2f96933d7", "comment": "Malware payload (QuasarRAT)", "value": "1a10b132a31062d951cd6d4598229d2ad8fe61c5", "object_relation": "sha1", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438802, "uuid": "8bce3982-128a-47c6-9b19-50757e1e9011", "comment": "Malware payload (QuasarRAT)", "value": "0ed045ed0dab7c57f4dc2f642d535d74a97fa389cffd364f5136cd2a151c89315af37d099caf8fe0cb5da4415c86c88b", "object_relation": "sha3-384", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438802, "uuid": "b5e6675f-5d06-4433-83e0-c2e656d0d4e7", "value": "T143556C27EA1DB046D71344302974AA6DBC265D380591ED0BF3D2BEA968B1583B4F933F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438802, "uuid": "00a26c9b-8c49-427a-827c-e3a9cd2d2531", "value": "a1e4185320596f7bf2a6f16a4117aef0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438802, "uuid": "28356dad-d7c4-4dca-b186-107b8d99bb7a", "value": "24576:bXVfFfO/oHzUtq1mRM5txh2LWTg+XZ9efP+5rfM19z9S:bFtRHzK3M5TTXZQfPEG9RS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771438802, "uuid": "70834fe0-392a-4622-88f0-cd18eeff083e", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771438802, "uuid": "b254dc38-e365-458f-bd1c-1b0d439cf150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438802, "uuid": "250c6806-1ef6-4899-8365-99dece13422b", "value": "a29c47c23e0a307573df263f717c7816f346fdd053076d904ef5d20106e384aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca12c4d4-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439381, "uuid": "177d7922-b7e6-4b90-95e1-3625fd23950c", "comment": "Malware payload (Mirai)", "value": "d3f777f7839081c621f06d2acdbae1d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439381, "uuid": "d1ed568d-448b-47cc-b8ee-784516f4bf35", "comment": "Malware payload (Mirai)", "value": "a3344fdea80d4978a5fe3ef2543dad8b14cdb2929a137ff5ce846a3f609d55fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439381, "uuid": "06db22e8-b367-42e6-9b11-79c3e94ff321", "comment": "Malware payload (Mirai)", "value": "72c77f74ef5e706b7af7e0f2c8e7c6f836ac97bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439381, "uuid": "81c7a77e-b2f0-47b0-a989-29d16758705a", "comment": "Malware payload (Mirai)", "value": "17c3a8f2a0f4ebafe16bef6491025b84643b9cf2b32c1230bf7c6da1c78df12d2dad07f72879361cb4cd3391a42f30d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439381, "uuid": "ea01093e-6829-48be-baf4-96a35ad764ba", "value": "T11EB2E12065579664CF604C3DF8B6EB023ADB0B7EC2E937033685012C96DA90558BDF6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439381, "uuid": "861b9805-cd7b-4f8c-8b82-6900888f7c5a", "value": "768:4OZD5qANHlLPWzt5suQeNg+6j+uwas3UozMs7:4OZD5qsHl4Dwem+6j+uwXzZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439381, "uuid": "67810e80-2033-4524-b5cb-03cb0304626e", "value": 25104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439381, "uuid": "19f6fa76-d8c9-424c-bce3-73857b3ce37f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439381, "uuid": "1068badf-bd31-4f06-89b9-c9de5a06635d", "value": "rizzx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f770ab-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441308, "uuid": "53aa4681-0bc0-4f06-86fd-3ef1cf9099c3", "comment": "Malware payload (Mirai)", "value": "9dfab6acbc53a7ea0bc0d90661f7e85a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441308, "uuid": "6f00b93b-7c3e-4ac9-98e9-4f4cbd24721a", "comment": "Malware payload (Mirai)", "value": "a37d7dcc86e5f39193d85115facebb5157b6cb2a7afbdd2f76babeacf4fc990c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441308, "uuid": "1a2872a3-921d-4928-bff2-f723f143d7f3", "comment": "Malware payload (Mirai)", "value": "219ac9c024c22c72e0b532f74cde42d418de81f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441308, "uuid": "a183ea78-0922-4cfe-a6ce-be194e89dbcd", "comment": "Malware payload (Mirai)", "value": "67f566e1959af2d44957aad432fb003b221d26cea55940077004c4cc66cc94b3d208d3ce22f3e1f4e82dd88de586f6c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441308, "uuid": "553ac642-ee78-4135-aa68-cc036175b025", "value": "T169962A136A1CEB0FC62461345DB5DA986B3A1C4645DB9417B381F309F9F20BC9AAEDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441308, "uuid": "2987e2d6-16da-4572-9dba-e56f022663ce", "value": "49152:PbxmGy4KWdxb0TdudDDIMpuh+nKHZAHdUEpKiI8of5CIk57oOKPYy1O1aGfR1fOW:XIhZgR1fR1fORfjEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441308, "uuid": "8438aac9-c47e-47bd-8011-c52faee9a46f", "value": 9044147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441308, "uuid": "89b70393-f0c0-406f-acca-2c02d863d96f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441308, "uuid": "5b7c42de-d36d-433d-b876-967a5051fd5b", "value": "deferwqd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8ce7b2-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433107, "uuid": "526c9cd1-9bf7-4601-9051-35457ed57555", "comment": "Malware payload (Mirai)", "value": "0ebcb75042b1b85cea10582979244695", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433107, "uuid": "404907ac-6cfe-4b25-9622-2298560cda2a", "comment": "Malware payload (Mirai)", "value": "a450de7063259b3892e4538020a0c4ff0203400ca522ad03d0a0732474b4808e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433107, "uuid": "8f3f2661-5cc3-4496-ad51-536134d39d57", "comment": "Malware payload (Mirai)", "value": "17d873313b3b3e03cb92af4ec0327bee9c9958c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433107, "uuid": "d9bed38a-527b-4bb7-bec5-b8613d3deb16", "comment": "Malware payload (Mirai)", "value": "8152af6f03027f543d01650468c4c93fa7ec60455ae9c6f8ab36c7bbde2997a031338567de56d1da78343c1739f8b7f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433107, "uuid": "f6d217f3-6e01-4255-a48d-c3f51275ca00", "value": "T1FFE33A02B30D0947E2632EF43B3B27D193EF9A8125F4EA44355FAE4991B1D32158ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433107, "uuid": "14549134-2215-4758-a974-1804e5092283", "value": "1536:2rLBS5yxpEfHAjQcqf3nxC5nMAZ9GxTTi75pbBEvWGfqb67cuN+L7URMzQGCW0de:2PBS5VfA2xFuRVFOvlFMzqWq5eG3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433107, "uuid": "d8bc0777-9303-41ed-8bc2-c442e9c60d3c", "value": 154348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433107, "uuid": "fb6215a6-f176-4cbb-8bec-286d4e1fe0ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433107, "uuid": "202cd807-2143-4b83-92ec-fbf931410ae3", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea71970-0c68-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771377943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377943, "uuid": "3acecd16-5ef7-4109-aa80-3f9790b25878", "comment": "Malware payload (Mirai)", "value": "4fc8886eae4cd246fab2b0a1f285c7d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377943, "uuid": "6a743da2-fb30-428e-961e-fb8e282ced43", "comment": "Malware payload (Mirai)", "value": "a48147174f4e0ce150b1af6b03b6a27393f122d21e73c5585c6ba04d22180bde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377943, "uuid": "b51bd92a-8058-46a8-b3fa-017c49ea0040", "comment": "Malware payload (Mirai)", "value": "3368abb561c7cc263882b5ef15ffb7eb25614838", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377943, "uuid": "1df31841-322c-4e93-b3ed-2a0bf0b0c6b5", "comment": "Malware payload (Mirai)", "value": "0d9b106cd7cca4b73ed1e4c68d3dd3acab06255af1ad8ca015ca40acd028ce0ef8484db8b9605d603c3dc6a9c5d30d72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377943, "uuid": "8fca4a08-7db1-47b3-ad99-91aa8ad66ba1", "value": "T143B32B16B992DB11D5C221BAFA9E514933136FBCE3ED3202DD206FA067874DB0E7B512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377943, "uuid": "29bf7d40-be23-474f-8281-0d7c232fa3e8", "value": "3072:fbEPBKdiInzipdr7160gaCYxJDF7cT2dXMPH:oPBKEIupdrZ6xaJJBcToMPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771377943, "uuid": "572f8d4b-2ad9-4e12-bfc6-923761899572", "value": 111292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771377943, "uuid": "6342f2a1-6d08-4e70-afae-5d754b880d6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377943, "uuid": "1689b696-4301-4410-bf14-75bd910f9f01", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8128bfd3-0ce3-11f1-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1771430668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430668, "uuid": "5abe1b19-59d6-4aab-9a35-78d5c7050101", "comment": "Malware payload (GenesisStealer)", "value": "ced92c01c9738ff1376c002c19d01561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430668, "uuid": "84aace03-af90-4207-b79f-729f4c86600d", "comment": "Malware payload (GenesisStealer)", "value": "a4a882c22c248f95d2e913b5f83badcb0cd247894ee996ccbc15c575785e4788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430668, "uuid": "d0c09bae-db99-4dc5-a551-d86f6f6b8b38", "comment": "Malware payload (GenesisStealer)", "value": "67ced026c326fd99cc738ca001fc090fc7961920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430668, "uuid": "785596fd-65b7-4075-8a9e-a75e72dce6ab", "comment": "Malware payload (GenesisStealer)", "value": "fd8dc8b287bbbd6efb6f483ea75a9bff700c2d5ecbaeb76632a39ba9765250ec9fde0b68de1719ccdf730341f0c1b5ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430668, "uuid": "af057cb1-52eb-431c-947e-3fc88161060a", "value": "T14218337A2FAAC50FC01675FB8AF63BB154A394521D25E06E7126C0FCB4B8E31D630597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430668, "uuid": "27b22637-6f9e-4e67-887f-ccb4efb73a79", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430668, "uuid": "9077d530-736b-4124-9d49-81b872c13395", "value": "1572864:Hh+BWMFDe45k82h2zFbTrJ6hDRVO3GyD1KWHsPKhwC8coHhdXmaXALwpD/N7Fs:HIBFle45jtFr8hDRVABKQ5wvS4pT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771430668, "uuid": "167e4296-f965-476a-b8b6-62f751c647d2", "value": 88024911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771430668, "uuid": "6243d185-201d-441b-ad2d-56c00939fe7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430668, "uuid": "315d38f8-e61a-4be8-8e85-50ac89b1c239", "value": "plugins.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e623bf41-0caa-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771406357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406357, "uuid": "e763dc0b-346d-4541-a0b4-270d6aa03cd0", "comment": "Malware payload (VIPKeylogger)", "value": "622f807d3dd856c9009aa0617e3e27c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406357, "uuid": "802bba5d-2cf8-4450-81f0-02d2dd3d5ead", "comment": "Malware payload (VIPKeylogger)", "value": "a54b357c1f877240b28d83a268de98c96aff1fa16d4dedb6188aadba3f93d340", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406357, "uuid": "5d42b930-2c35-41d0-8ce4-7bbe0adebb77", "comment": "Malware payload (VIPKeylogger)", "value": "157f7e9cf17a385f9bfcc32534f99565c0b638bb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406357, "uuid": "aaa3e26d-9cca-4d49-be34-1662371207c7", "comment": "Malware payload (VIPKeylogger)", "value": "3edbeba503ea27a0d128ed61f74970f0d2ab40f5988a4a3d9256a0db682bdabb24cb499e60d64e9b54c3467cb464744c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406357, "uuid": "a0bc28c3-4109-4c6b-a9ae-fb921c1ff6ff", "value": "T1A6351228A67B8EA61D5361D370D1D913FCA5FD2E14F3049636A0A2FE4C9F8C685A6390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406357, "uuid": "331c37f3-005b-41b7-b33e-23f02c245248", "value": "48:LooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooQ:WHGfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406357, "uuid": "8f32ab1b-938f-4af0-a95f-5a59abc73258", "value": 1066910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406357, "uuid": "91dff694-adb2-4926-877e-f71b6faa2289", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406357, "uuid": "31223f4d-cdda-4104-b2bc-9a4294373dff", "value": "edesbuild.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae51817-0c67-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771377508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377508, "uuid": "29cdc78c-4de7-4d7d-84d8-a2e0847fb8e8", "comment": "Malware payload (Mirai)", "value": "067709dfb61092606e3fd371ace27058", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377508, "uuid": "8b75f9b6-c3fa-4f2d-a352-e1bf92dc7ba9", "comment": "Malware payload (Mirai)", "value": "a5a22a0a67d8b05910e5209d6e35ae5c9f2f57841074f8389db732b0d6fcea0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377508, "uuid": "e5954baf-d7d6-425f-8b78-f2eb993e6242", "comment": "Malware payload (Mirai)", "value": "d3039603bdc33cb5e0dfb7011e6e0456c78546d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377508, "uuid": "e666dc29-aeac-4449-9176-1c421522ec0e", "comment": "Malware payload (Mirai)", "value": "e29a250a0ffb1ab515227e27ce1cd16d1a28a6b0a2c5b19647b24a68861e69a8a62619e70644c9febf9ba0e8e2833368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377508, "uuid": "5d25bb8b-617d-479a-85a0-e40cc8244c0f", "value": "T1CBD3971A7F228F6EF269877443F78E31A75937D61AE1D684E16CE5401F202CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377508, "uuid": "e9bf18e7-8c40-440d-be6f-bc0969d82b26", "value": "3072:L+Fa7x2n0nLon4PMgU/k9lgcjc6tb3rcw9LK+wyRMR:L+FoxgJnjHyt/AcLmyRMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771377508, "uuid": "e60ec61a-e81e-4d55-8840-c09e0a860a81", "value": 132848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771377508, "uuid": "9848763b-d56c-446f-8965-15e965811a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377508, "uuid": "a1a5b8cb-7bbd-4072-81f2-6dccc92f04ec", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d83f61f-0cb6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771411335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411335, "uuid": "d02b3fdb-69ff-4551-8123-f2a74a5e0161", "comment": "Malware payload (AgentTesla)", "value": "2381a3c51b46659e514d473acdc1af76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411335, "uuid": "68ca6cd4-e661-44e5-9c71-c9d7f6c7638b", "comment": "Malware payload (AgentTesla)", "value": "a5d62bc2eae1d3c2680043a5e8a586c11eda232195aabed9cdcee20169525a8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411335, "uuid": "74aa48f2-f9c6-455a-aa2d-0eafa33f2c45", "comment": "Malware payload (AgentTesla)", "value": "960ed5ba9128021571d1407c2f037d634720d3d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771411335, "uuid": "8b3ea7da-bd9a-44b7-affc-9509896c11dc", "comment": "Malware payload (AgentTesla)", "value": "6daf4044e6d94507f5b132dcd423852220b6906004a5ac4a4e9f2742580c75c595572805586b9fcd087115500f539ba0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411335, "uuid": "33febce9-8f58-47b9-b011-d561aade37c4", "value": "T1C8952321DF188EC106D0831934DDAA5429918BA34E99B18A3FDDB4CE0F2E75F2576CDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411335, "uuid": "97303254-08f2-4057-b6d1-7e45ba6659a0", "value": "24576:jMuut88jnt0JQTHTdCPiJcC6hoAqG3Ai2D53QUXtyYWMXp6YAlQ1y38BDri8fNRM:kHTdCP9rJ13WbWb0q8FJfj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771411335, "uuid": "2e3858ba-db83-4fad-920e-bd066bd13bb3", "value": 1921113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771411335, "uuid": "8d7a194b-0822-433f-8353-b4eac5c54a03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771411335, "uuid": "bd03efa1-0f49-42f2-b80e-47e9814e3bc8", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf09e2a-0caa-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771406365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406365, "uuid": "d381216e-e61d-4d9a-8760-9951f8109ea8", "comment": "Malware payload (PhantomStealer)", "value": "f59c1de7e10e7fa4d2ee383acdcb8984", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406365, "uuid": "da60699e-c4b6-45d3-8df1-483dd2c3016a", "comment": "Malware payload (PhantomStealer)", "value": "a658e6361c00f94960cbd27a39fb2f759c5e0b398f4f26a8f2e6ca29b6e2bda0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406365, "uuid": "028c8ee9-2a1a-4fd4-ac09-9b531a4fa283", "comment": "Malware payload (PhantomStealer)", "value": "8e9872c07f5711c0e506dd7f8da27b15710d8deb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406365, "uuid": "287f10b4-83d3-4fc6-8bf3-ae056bf5cb24", "comment": "Malware payload (PhantomStealer)", "value": "4a69f4773b5fa7c248fa5ea95f74206fafc9f0df63ca17b7deb3f040659d073b2b2de5764c7c83762a886258a8f9e86d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406365, "uuid": "76178587-8d5a-4467-8c6a-f75d24e82cd5", "value": "T1AC6628D6A5C488601A570E6BBA71FCD1958235DF3C8D4213E02767B3FEFB2B4A919231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406365, "uuid": "1998445a-9a2a-4fca-ad1f-4e06476b3ec0", "value": "196608:toXV/1495Bow618sQeLQjICBEgsLANu81XGY1azLDzik4cM6zDnQXp3ZMzu:tol949KbQeLQ8CagsLANm7HNM6PQXBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406365, "uuid": "f85e8a3f-cffd-4d87-96f0-c069536571de", "value": 7106802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406365, "uuid": "17e545d0-9c7b-42e1-91b3-1717aaf018fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406365, "uuid": "5df22631-655b-4864-aba8-3872acaa1f3a", "value": "Specs_QU180226.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733ce203-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (GORAT)", "timestamp": 1771406593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406593, "uuid": "ec8b9bb7-ebcb-48a1-be42-b671dc1dbabe", "comment": "Malware payload (GORAT)", "value": "73ba5d8f561c92c83a0571cef448b6a4", "object_relation": "md5", "Tag": [ { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406593, "uuid": "4b538891-2390-4562-87c4-a458b4d92615", "comment": "Malware payload (GORAT)", "value": "a6a37341db0b3747abc3c8a116fb59520372f6ee39c00191432988f12c9735cf", "object_relation": "sha256", "Tag": [ { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406593, "uuid": "c17d4261-b9c2-4807-ba88-e49b0afb6344", "comment": "Malware payload (GORAT)", "value": "df307301e906d249d04d8ebf1ccd2b738fc0b9fa", "object_relation": "sha1", "Tag": [ { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406593, "uuid": "8ab08927-28de-44bb-89ef-6843deebaefe", "comment": "Malware payload (GORAT)", "value": "2b00796f940674151c182cb159495f8ab4f89ed3b0d5aa53be10816cb4a00982a088edbd96f710e5eecdf79d6d0c9a5e", "object_relation": "sha3-384", "Tag": [ { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406593, "uuid": "1a9d8299-5325-4550-9415-583fd146b3e3", "value": "T11D5157100EE61258F2B78B715BF9B371897BB860DD394ABD004D82445773610E8B4F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406593, "uuid": "92bb096a-5403-457f-8c62-6de5fe8d5f9e", "value": "24:8Ayw/BHYVKVWO+/CW43GlswIJtsmaoghs5X4wJ5CWAcEf6Lkjm9dd79dsrabFI:8y5aFawIYag2GwJ5CdcEfnm9dJ9Aa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406593, "uuid": "11262b6e-d70b-4076-9dc5-bec8160ab727", "value": 2944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406593, "uuid": "47b5be90-f405-49bd-a3c8-20157f648a88", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406593, "uuid": "b72a59b9-e7b3-4e8f-a799-73365dd76a67", "value": "WF_eStatement_02_2026.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc04232-0ce1-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771429909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771429909, "uuid": "ba3487f6-d9ce-4025-a2e8-68e2f2e512aa", "comment": "Malware payload (Formbook)", "value": "21936235ee1c4bd07a35f1d46d78d1a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771429909, "uuid": "45029371-8d84-402e-932d-70f36d47d4fa", "comment": "Malware payload (Formbook)", "value": "a70e389336554845cf466e5e921232974e9910c2572a89bbfb82a6417a3c431d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771429909, "uuid": "9020692e-75c6-4ca7-abb8-cd61fb450a40", "comment": "Malware payload (Formbook)", "value": "e3ed5d0a7ad4f5b4f460860b2ac27a7fe0109dc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771429909, "uuid": "e5e621f1-53af-46ff-9a36-a760b624aeb8", "comment": "Malware payload (Formbook)", "value": "9807e68fc99a53bbbc25f0f81c83168726e34c12c1f6c7a918b71011a921cec97c411facfc616b91ee76fd69acce7d0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771429909, "uuid": "a8780f27-78bf-4809-8b83-8f5ff59877a7", "value": "T19C2512241745FF07D1651BB80A60E27903B46EDEE132D3068FEABDF7383B6A61954386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771429909, "uuid": "d6c03486-21de-4c61-874d-551085ca2e45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771429909, "uuid": "5f321885-a0a2-40ff-9075-144e08c6b44f", "value": "24576:L8dWknJLrPZg9yIuoxqOQPaMRWVDoa4p2HR/JoY17CmyxF/X:L8d5dFg9R6OQdWfXxBoWByP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771429909, "uuid": "cce13f6e-d855-45f8-ba35-303d7d8f0cf4", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771429909, "uuid": "72992ead-ad26-4518-8413-96aee6ffb78f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771429909, "uuid": "09be8cc1-6d66-4cf1-91b2-1949ec1c938a", "value": "PO 281803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958210e8-0cf6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771438863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438863, "uuid": "064ea149-3a5c-4028-abef-1a66f9cd54e4", "comment": "Malware payload", "value": "df5aacce826964337c2503ca36f1a03a", "object_relation": "md5", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438863, "uuid": "874ae2c6-b67d-42cf-8568-0f03ea8275bc", "comment": "Malware payload", "value": "a73a00345158164f291fbbc9b78e5ac3a43f7fb6d66549de0e2b379b00b59b73", "object_relation": "sha256", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438863, "uuid": "cdd299a0-0e9c-4cfc-974a-4c417dd846db", "comment": "Malware payload", "value": "c9147caa5924a062ca1a9737beec6aa4b8a44077", "object_relation": "sha1", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438863, "uuid": "4866b101-aa8b-4a51-b7e0-d7171d845455", "comment": "Malware payload", "value": "3fd1e4ff6d59f81e217453fcc665fcc26583094555faa64702311b03278c7ed3336cd33a81b7d222be95af06fe29e532", "object_relation": "sha3-384", "Tag": [ { "name": "alexisfargo425-myvnc-com", "colour": "#2B3A67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438863, "uuid": "9f51e963-5e0e-4cff-a1a2-f4fee995ee1d", "value": "T14496AE19A3E804A5E82BD738CA65C733CAB0BD524635D10F095DF7461F73AA28B2F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438863, "uuid": "5e21bbb4-5717-4d34-a25a-83ec32527b9c", "value": "269f5027a82651fc1ebe69edf4ce8696", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438863, "uuid": "bf93fb04-8949-434b-aac6-ceb528954c6a", "value": "98304:W7sEt8xP1F9VLiEh/u8tuQuLANQ7humQpH:usy8xP1F9VLZG8tDuLkNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771438863, "uuid": "4b868d6b-93d1-4bb7-9a39-1c321df88c5d", "value": 9375752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771438863, "uuid": "74957a37-57b1-4c46-b11a-c70d3aa10c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438863, "uuid": "551349cc-0574-46aa-9748-4a445fb00c14", "value": "a73a00345158164f291fbbc9b78e5ac3a43f7fb6d66549de0e2b379b00b59b73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea5c7a3-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402210, "uuid": "52c46dfe-e5db-448c-932a-301bae627764", "comment": "Malware payload (Mirai)", "value": "91a5064e4dde7d32a8789ca60313c5e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402210, "uuid": "0958c659-ef50-411e-b9c9-f929a466c9d5", "comment": "Malware payload (Mirai)", "value": "a77342953b19d227b0246218e03b861f48163616413cbd02abc0017cb134e09d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402210, "uuid": "e07087a4-4990-47a5-a04b-cd4dfb5bbec1", "comment": "Malware payload (Mirai)", "value": "29581f482ba802747155f5e692dfcebfffa278fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402210, "uuid": "af7a7615-1d68-4959-9286-cd92c5324be1", "comment": "Malware payload (Mirai)", "value": "7bd3ab3aacdaece0f20f78d3c1d01666e368b2fe43d1971cdc1af0c6aa5abe59c5843b6eef51951eda6f4684beaf1ebf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402210, "uuid": "c9d3c407-749c-43dd-ba56-c1ceed3bf9a9", "value": "T18FE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402210, "uuid": "4e6f19f8-ff0a-4290-8228-4f9353e54417", "value": "1536:p+fTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4Vx2dbK:pYlybKpzEOfGQ+vEubTt4ouftL4SdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402210, "uuid": "873fb8b2-74a9-44e3-aeb6-96f1062e8f52", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402210, "uuid": "fec92668-dc37-45d3-a1b0-c11b76abbc45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402210, "uuid": "763af9d4-82e2-47f1-a329-8031fef0e263", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73269da-0c5c-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1771372831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771372831, "uuid": "bcf4f82f-6812-480c-a325-53c624ad66e9", "comment": "Malware payload (Stealc)", "value": "6ce7e371683be5ede9dad0f80f369d5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771372831, "uuid": "163da121-32d1-4f77-9cc8-5c19d069cdab", "comment": "Malware payload (Stealc)", "value": "a7952fe2e29dc81b89f642d03e407b9eeec94456b7a66dd0992b9c89d121de27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771372831, "uuid": "bad3b550-e6a8-4b8b-834b-a30585ffe68d", "comment": "Malware payload (Stealc)", "value": "7148af1bda88dd64465c43b101c79382c270e2a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771372831, "uuid": "19cad9ef-3529-41d5-8c43-22658010b3a3", "comment": "Malware payload (Stealc)", "value": "134838f6b605d25e845978fcdc6f68bc2aec439f6e09cd36a2578f8e5da493a8b6be9e87c79f5dc13290e26c5044abf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771372831, "uuid": "9057e4e7-f429-4708-aa61-25fc1b44e31f", "value": "T10DF47C5AE7A602F9D0BBC178CE424553EBB2B8155770978F03E11AA61F372A05F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771372831, "uuid": "7c1bf1df-09e6-4eed-9216-ea6106986bd0", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771372831, "uuid": "d314f327-6093-4e54-99c8-009de685cad0", "value": "12288:nU8VHX4ZPBuvzkOkW7UE+YTRqwJ4BW6ALSQTbAK4lVA:rVH6BuvbkW7xXVVmBWzQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771372831, "uuid": "7819220d-b69a-46fa-9a47-f02f81b0ae16", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771372831, "uuid": "12a18de8-d616-4d46-9ead-d376bf940b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771372831, "uuid": "102abbcc-a13c-4ddc-868b-0c4616963f7b", "value": "xa7952fe2e29dc81b89f642d03e407b9eeec94456b7a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2400f851-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771433089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433089, "uuid": "ebfb3295-b650-45eb-aeeb-f109e788cd2f", "comment": "Malware payload", "value": "d22af06653662bea335a0b9a55a21820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433089, "uuid": "0ef1bf75-6f60-4d26-a184-6750ce8daf06", "comment": "Malware payload", "value": "a8a0e0913be2adfe2b39761cb252df0b25a99eac6f96359200ab452b51ba03d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433089, "uuid": "17565947-7f05-4f67-9cf1-b1ba1b3b3e50", "comment": "Malware payload", "value": "1960c48cc24dd5ca9785b05e166c052b69922136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433089, "uuid": "47323fe9-2227-4db9-a25a-9bbc3af1a50b", "comment": "Malware payload", "value": "8b04dd93c730432db97f73bdf996967d146370246894dffb921b4ef3fd14d3885928cc26b645f5220089500aa8290d1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433089, "uuid": "d2f0465b-9936-444d-8390-481e24b1a287", "value": "T1FEE31945FC519B16C6C662BBFF4E428D772B17A8D2EE31039D256F20378B95A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433089, "uuid": "2c81c2b9-e453-43b3-80f9-de55dd384391", "value": "3072:IzBs49tbMgxKZJ9LwjFNMrXlQ/4QP9EfSf4PTBkOZeq+bH1I7se:6Bd9xMggZJ9LqjMiLVi64bBkoebVI7se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433089, "uuid": "8e234d2b-4a60-4e7e-be9e-117e6e49a5de", "value": 154168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433089, "uuid": "76a3a1cc-39d7-4d80-8923-76604d039af1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433089, "uuid": "e1d08525-2a20-4c4c-96b2-95474ae12720", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355dae07-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402194, "uuid": "97685b31-7cbc-4f6d-b9a8-429a60190615", "comment": "Malware payload (Mirai)", "value": "a01146a7f970b248fa0f14f7ae4ab49a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402194, "uuid": "6856701e-db73-45b4-9073-fe0d6d7a5633", "comment": "Malware payload (Mirai)", "value": "a8ecf6c41a97c3cbad799cfa8df7a3c4c2662551cdcfd3c5c506e802197761da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402194, "uuid": "a7e9a9f4-4b52-4c5c-9c42-3f52a6d18ee3", "comment": "Malware payload (Mirai)", "value": "8b087d9baaba3bf5c9054cba8c836709b7111ad5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402194, "uuid": "784c9405-cd63-4974-9e02-254b814cdfe0", "comment": "Malware payload (Mirai)", "value": "7e330bbd710689a872557dd1caeda365f838f901830d13bdb5acedc7466c095b4eaeb0220ef671790bb6cb2027b47886", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402194, "uuid": "b247993a-53a5-4b3e-8f5d-1e6335b3b020", "value": "T17BC30956F8819B11D5C151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402194, "uuid": "b8d61b5b-4575-4bf6-beb8-b18d5da91005", "value": "3072:fWD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1j:fWD76aX9aKTcRQVnoiYq1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402194, "uuid": "919f62b7-e495-4e61-81d2-0e9c782b72e7", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402194, "uuid": "c2839fac-fc90-4be3-b3dd-bd517282b739", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402194, "uuid": "e1555e81-bddf-4238-bc98-484c51b1ec70", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a32f4f7-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771406981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406981, "uuid": "87a12974-38a7-4180-b1cb-e3b8b93dbd32", "comment": "Malware payload (AgentTesla)", "value": "2961bb968507a5823a6e52742af0a117", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406981, "uuid": "a98e1df4-2f18-455e-8fa3-7a09e03f844f", "comment": "Malware payload (AgentTesla)", "value": "a9210dd6a6d8394261407b64e53838f0e3e4305e68f477179de096d20e885406", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406981, "uuid": "75788a7a-cea6-4643-873b-a9aaa4baddee", "comment": "Malware payload (AgentTesla)", "value": "e22e5aece2e020739b146d6e4e9d26f3fd53165e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406981, "uuid": "7ae83394-8f8c-4e76-bdad-9f5c1bd73ba2", "comment": "Malware payload (AgentTesla)", "value": "1233a01166936e4bc453fe1589abf93ad2f27d8dd794395e2f3515b6b07be9c44270ad80f5cae94af867c11f4c8de906", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406981, "uuid": "c2e1d976-d4a6-4c0d-b2d1-c2d99541ead8", "value": "T159252350EDA9EC610368421630BF2A3569624B476C18B08E3F9D52DE0F9FB9F017E8DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406981, "uuid": "43606d02-f05d-46e9-bb46-41c5487690e6", "value": "24576:tniyl0KHX7w6wGsc4d4H10GupIVJsHfq3Sjzfrow:52YbwVijZmJvz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406981, "uuid": "dec8b20b-8cd3-4971-bc5a-240bbddce45c", "value": 1039133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406981, "uuid": "8a91d0fb-ff06-44f3-9b30-7d8e37fa327b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406981, "uuid": "8f440b9f-a3ca-4cd7-9838-04903e8744c2", "value": "VAL.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accb60dd-0cf6-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771438902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438902, "uuid": "e07d16c8-a283-4c3b-90de-c4fd11c9f89c", "comment": "Malware payload (Gafgyt)", "value": "4eb39761ad0f240ca2d3adc5e0ee1396", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438902, "uuid": "8db73a9c-b58d-4986-af3f-0576e7a91cd6", "comment": "Malware payload (Gafgyt)", "value": "a98a6c69ee74c4b89a7bfb0ed8a116b2dd5e60be7bca8983061cd2b8082bdc5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438902, "uuid": "6e40e929-e528-4732-98a5-0d1779bf2f9a", "comment": "Malware payload (Gafgyt)", "value": "40acdaf086e99938947df574836f3989a497478e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771438902, "uuid": "62b36265-64bc-4999-acf3-d73b87dade3f", "comment": "Malware payload (Gafgyt)", "value": "85c113d201fe9d487c5271e47aa7edab00a5ef907f03ba05321068b3d77df15a63cde63c5657dd530d0bc78edba1c2aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438902, "uuid": "388de262-5921-4627-94af-4be06ef174cd", "value": "T1EA357D5AF2F374BDC067C030839BCB626835F46511326D7B75C4D6342EA6EA01B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438902, "uuid": "5e455504-ff99-41d7-a37f-627ae914071e", "value": "24576:g91AGwVKYugBgq4HaRT+2ZYPphnXOzECa:gnFwVKYu3q4HaRT+4Ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771438902, "uuid": "4599471b-07c2-46ca-a21f-e0513ffecf84", "value": 1162952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771438902, "uuid": "82bb57e9-58ee-4d6a-b791-7fbec9b8699d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771438902, "uuid": "43804ff9-f7fe-4289-9392-ec2bfe3cb3a8", "value": "fuckjewishpeople.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b261f8c-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433074, "uuid": "de840884-dd19-490a-bcae-10f1e4f4a3c0", "comment": "Malware payload (Mirai)", "value": "e7058a3f74649a5124a9fe8c6f4e4310", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433074, "uuid": "ac85a283-d36b-453e-9956-694a8c9840c4", "comment": "Malware payload (Mirai)", "value": "a9d6bef8354c72cf77eb3b3aa6b444d33ad8c2dc5758270e493200b0aef3b359", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433074, "uuid": "d2ef308c-fb80-45e8-8d47-629929a8be6a", "comment": "Malware payload (Mirai)", "value": "22a02eb4dd8899eb4aabaad7f67eee077a3a2a47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433074, "uuid": "adc4751e-98b6-4dd8-9410-dcf5e61ecbc8", "comment": "Malware payload (Mirai)", "value": "4a673f96a67b32283f868d9db9b4f1679929888b4fd1b23f053661d021d23fb37458f1c3f5519e8060a0cd2ee056b5fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433074, "uuid": "ec4b9278-e502-4d54-b383-a4254de65842", "value": "T154F36C07B9C1D0FDC8DAC2B44BAFA126DA32F50E5134725F27C86E262E5DF216B2D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433074, "uuid": "1c991c3f-dbd4-4170-911a-c5b94c1a985b", "value": "3072:BL09YaD9dEou1RoM1t1kSKYpl+HpBbqPHCoNJzoSsE:W1UXJWJ6jmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433074, "uuid": "7b271478-af21-47a9-a000-3b26d3320c87", "value": 159792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433074, "uuid": "fac516d5-6671-415a-8a7d-cac797152a3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433074, "uuid": "640fc227-eb66-4c1e-9f95-ffd2055005ff", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30441c1c-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771423231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423231, "uuid": "b2489c03-0e81-4660-a06e-06f652c2af0a", "comment": "Malware payload (AsyncRAT)", "value": "55b2108c197da3d88c9072a34e4a5d88", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423231, "uuid": "56766bb7-99e1-4564-8783-24c97a84e549", "comment": "Malware payload (AsyncRAT)", "value": "aa23c7a817e7e7a30ce207e5f26fd3a7c020a3f92cd7d1233eda0046b975b367", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423231, "uuid": "93030c00-be0a-44d4-9017-7e1939e1a2af", "comment": "Malware payload (AsyncRAT)", "value": "8ce948130f1eea1323753bff97586b711229bcbf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423231, "uuid": "16b7db76-6579-4496-b873-ce6b883e2abf", "comment": "Malware payload (AsyncRAT)", "value": "d3ff7d56ff4a1d4c726738ffc9053dfe365484995fc57f6a937031db424a5c0f428fa69cd8ac489ec764cfeca56681f2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423231, "uuid": "8f3bceac-863c-4ac8-adbe-68422bc96048", "value": "T109033B08BBA44611D9FEAFB06A7261054275E617E813FB5E0CE495DA2F377C08E423B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423231, "uuid": "cadd617c-082a-43b6-82d0-8ad65443a109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423231, "uuid": "38ec8161-b4aa-4356-ab67-2c7d238ebc44", "value": "768:WzmdtUhlXO7wGDqyqOstjNQBFf9ZlO9hjh2:7dtUbehqOstjcFf9ZlO9n2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423231, "uuid": "2594d91f-f92b-4a1e-b88b-ca24c2a2372f", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423231, "uuid": "206035d9-9a52-4931-9329-a4c58d767876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423231, "uuid": "91a14298-f3da-4f47-98eb-b4d7cc05f2e8", "value": "aa23c7a817e7e7a30ce207e5f26fd3a7c020a3f92cd7d1233eda0046b975b367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca447abe-0cc6-11f1-a129-42010a9c0007", "comment": "Malware payload (PythonStealer)", "timestamp": 1771418336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418336, "uuid": "5567a6da-8caf-4da5-bdb6-eaf55c5ca2d8", "comment": "Malware payload (PythonStealer)", "value": "5581c8aba0c0e07908b43974964fce16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418336, "uuid": "ac0b0cfd-06e0-4034-ab68-7b0bbd808e09", "comment": "Malware payload (PythonStealer)", "value": "aae7e6c7ae3fd67dd9918c84211857bfb00f98b5f886b7dcfab88119c04cf2e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418336, "uuid": "d75f5d9e-9245-4c58-a373-417b3fb3edf5", "comment": "Malware payload (PythonStealer)", "value": "48cb5c695882562d2fdaa2c82c93e2bda9e1eb13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418336, "uuid": "9ae474e8-3e59-4d77-8948-62848f45cef6", "comment": "Malware payload (PythonStealer)", "value": "1ed1983c980db60cf18573b64e246684c5d3c0c68266ae6ae4e7c02cfccb4e028924f79d8f2e87c584b41b4fe50460ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418336, "uuid": "9114a029-ebc6-438c-812a-5fde24c37680", "value": "T166C73348158865E7F993207189676319A8FE7B916B81C78FCFD887A0DF830F9583BE11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418336, "uuid": "e3b95923-aa48-4261-8976-e20032b8c962", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418336, "uuid": "28353328-6262-489b-90e9-61e6d0947c6f", "value": "1572864:HozopLEWFdk2Y8cxRXFYaLJOeFQSmaeui:H++LEWYikbVFQSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771418336, "uuid": "17c07688-3545-41b3-bb32-9d79c64eba92", "value": 55070206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771418336, "uuid": "462e7268-76cc-445d-bf3a-5952753f7698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418336, "uuid": "eaeedd80-1c82-45cc-8eba-d13b613dfb4f", "value": "n3k8r1p0zu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6914f3-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439386, "uuid": "22826ae6-4598-4591-b4b5-03d2ab813011", "comment": "Malware payload (Mirai)", "value": "f9c1f683fe3036b43faa9a5b27609235", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439386, "uuid": "e8e5a7c4-fdd0-418d-9af2-6bae3439dd55", "comment": "Malware payload (Mirai)", "value": "ac28aa2fbe9ff0528536fce7aa701f01842149ec8a0a4c435d682f44de054160", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439386, "uuid": "766fd41a-2ff5-4320-8bdd-73ca57774173", "comment": "Malware payload (Mirai)", "value": "00133902b379fe8863083be8818d3c89d3d0f10b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439386, "uuid": "3ba958e8-55eb-4ad8-9e11-8ce0f1299443", "comment": "Malware payload (Mirai)", "value": "bfacb7532c547e1a9df97e4ea7a9f47b71b8d65ae4437139eca291be20b10a9b435b62cd1b529cff92728fbd801c7729", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439386, "uuid": "ce834836-1539-4160-951f-6dceb5847bad", "value": "T10C13F1A356187C31A5B4A4FAEB25CB425E7201F8D3F133352704DE25A8C82275AF57CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439386, "uuid": "645c7825-77ec-4bad-869e-bdeee7b4d6b3", "value": "768:SY6nZiLt5rvQHasMyyQO8QXUODxk+Fz00u58aTcNn9s3Uozd:fCcpvQHasuJ++FW5RcnAzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439386, "uuid": "8e3f141f-83fa-488c-8bd9-552ed5feca2a", "value": 41620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439386, "uuid": "5186116f-f680-4ae3-9a37-5fddf97f34b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439386, "uuid": "758b0a4c-b3e0-4a92-bacc-d4ff2c9e01b6", "value": "rizzx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e33d24-0c90-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1771395137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395137, "uuid": "1ae3ee34-b64c-47c7-86ae-7a0c2627b383", "comment": "Malware payload (SantaStealer)", "value": "a7990b2347a54b28409cc2b7bd1fbfa0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395137, "uuid": "b67b5f74-becd-4cff-86cb-90287a4e4d24", "comment": "Malware payload (SantaStealer)", "value": "ace0a0d6615f233f3c71781e59d6438bf3ca35ead4123cf4e02b97effd45a75c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395137, "uuid": "4242887b-2162-427a-90a1-2398ce9ca10d", "comment": "Malware payload (SantaStealer)", "value": "7005efcff1c5babd7981d1307e899307a0b558a7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395137, "uuid": "f3dc106a-07fd-4d75-8d16-f3a11eec5155", "comment": "Malware payload (SantaStealer)", "value": "b9f0c8be554ef963603c18388eb7e20806094ac52695375e023019e68f85791789037a5e30c291f6e8009251f6a7a5b1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395137, "uuid": "1864b6aa-76aa-4dfc-befe-d2d587a2ab12", "value": "T1CC1633F9A3DBA2F1EA0913F480E6A9570B7166B0FCE4663493F3BD322BC45908997511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395137, "uuid": "caa83f8f-a10e-404e-b64d-78a7cb223e80", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395137, "uuid": "6be6b447-4e54-48de-8ca1-a2d2d401f153", "value": "98304:Aai8Hy4JWIP7r1wW6KIGXk131Ig8q/8ApILrWZmX0:AaiuTr1wW6Kv835/VHe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395137, "uuid": "e5171721-fecf-485e-bb0e-495570ab6a45", "value": 4104704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395137, "uuid": "53af6e1a-2d1d-4088-96ca-226132690b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395137, "uuid": "5727e392-43a3-4484-9c69-f6bd10d67525", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f388722-0c9e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771401030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401030, "uuid": "53b19152-1715-4191-9b46-ce885715e135", "comment": "Malware payload", "value": "34e90568af4dcd40f4f04174ec326e2a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401030, "uuid": "4ce4bd94-6e8f-4007-a679-4c3c61de636f", "comment": "Malware payload", "value": "adc2f550e7ff2b707a070ffaa50fc367af6a01c037f1f5b347c444cca3c9a650", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401030, "uuid": "21ef9ad1-d069-458d-9644-401b9c0268b0", "comment": "Malware payload", "value": "aff537f1ab0f8b502691fc3a791de715af23b30b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401030, "uuid": "3efc1eaf-6472-4d26-8193-f1dd81deedb2", "comment": "Malware payload", "value": "fe0c2601a358d98bf55895daa0c97c8a8d77d74e30714cd62586ceceb31c2c3e444eb0c0b48c5deaa7b77583c1e0a7b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401030, "uuid": "8f97fb66-263b-40c2-8591-634ac77b80c7", "value": "T13F35536B71578120C7B0AB72E3DB4C50032BF943AF3ACB09A1DE679959B33698D21753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401030, "uuid": "fb89c686-a784-4bb4-9e97-f50cba3dbac7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401030, "uuid": "e88f2c83-6036-44a9-8ae3-656ea3d7782c", "value": "6144:QhGGc7TlhQeyJZPv0+R0r9X77TWIzPzRIvA3KcJ/TgXey7XWmk6WaJVYkZsuSbcj:3lCtv0GI6gavACL7XWmTJVoQLkexCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401030, "uuid": "2893bc7f-96f2-4a55-8f22-99f4f7e27e25", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401030, "uuid": "46a9e953-3a21-4a71-83a9-0ac276c92899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401030, "uuid": "74f55077-7ac7-4389-bf82-7aff9d6af3a4", "value": "Payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c186f03-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771406447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406447, "uuid": "c2841345-1e8c-4561-aac6-4eddc87cc6a3", "comment": "Malware payload (PhantomStealer)", "value": "52ef55d7ede7135854d0e742ebb0c39a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406447, "uuid": "0bda0ccc-cef4-453b-ad42-1417d3525bba", "comment": "Malware payload (PhantomStealer)", "value": "b0ae09d913aa458cee3b862fb1faf9dd0be0099e0d9291015f9ee8e504bb7020", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406447, "uuid": "f27d9375-e6ee-4215-80f5-9ed475bfe3a4", "comment": "Malware payload (PhantomStealer)", "value": "fd42836dcc72a9d260a450108615070ff2ef98ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406447, "uuid": "b1977961-f707-49c5-8e14-fb9e30874bbb", "comment": "Malware payload (PhantomStealer)", "value": "09af3064d828b12e49c0f5aac7dcaa9763ad9f6e47bbaca4544a4764a4442cc0b7fcb0c9af5310e971231ec640e2d68a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406447, "uuid": "7781648d-a66e-4e18-a6c2-82050b69144f", "value": "T15366187CADA4936418E30E63BA7377D2D59727B72CC75211E09A66F1FAF2243A911330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406447, "uuid": "59464e39-4705-454a-8781-e1a15bd0bf17", "value": "196608:JvF8R3IPVArXjQzOYRDqk0hHHelmHosmTNYFA/OZu24T1oJCoOCIYl9cnbqiEoqz:zyIPO3QFR0hHHAsmTNGA/Qu24TyJComG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406447, "uuid": "a67ce825-4d70-41c1-8654-40f5d035506d", "value": 7106802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406447, "uuid": "160e3c66-b3a5-497e-802e-55dda574d6df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406447, "uuid": "fe6a61a4-8f7f-4d7b-aa22-62d58a0120c1", "value": "Purchase Order_FMD2025_UNIVERSITY OF SHARJAH.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a818c735-0ca7-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771404964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404964, "uuid": "c4dcd528-881a-4a89-b622-d8c857fba9fd", "comment": "Malware payload (Formbook)", "value": "535543535e4089c8f6c0367de482c529", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404964, "uuid": "7b71fecf-bb5e-4d85-a89f-853dd98caba4", "comment": "Malware payload (Formbook)", "value": "b0bbaa5de842b4c3717f24c1fc74aa31be5f2291457e8ece3e3818711f8e165b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404964, "uuid": "9d02fe00-0bdb-409c-8321-229a2c573274", "comment": "Malware payload (Formbook)", "value": "5f017c54ed396e3e6f61a5da148fc6384f07ece6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404964, "uuid": "31adb1c3-34cc-4111-9795-789f2d6a8517", "comment": "Malware payload (Formbook)", "value": "b7d20ff28b78921c32106bdb136cf90c8dca991bf1a93f99ced1e4f001c9f699f61be56ad628917da124474232dcbea0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771404964, "uuid": "f665be8e-e685-4a91-92ee-c2499d38d0d7", "value": "T180460878164B4B048CEF1541BF057D682E46C927AE88E0937B079BA437D16AFE1DBD32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771404964, "uuid": "31e848ed-f586-478d-a79d-30cb742907af", "value": "98304:+B9ljnXV/qwJq9jY/yzsJXHonc+Tl6X2QAAySjQ2xeodISW1EPEhfu/TP3mfjK6Q:+B9BXVyqqCKeg6X2QLXlxe+s9Fu/Tfmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771404964, "uuid": "54d7f620-2e77-4667-8659-bc0387f54a43", "value": 5799913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771404964, "uuid": "f6de05d0-f056-4ebe-9fc5-2f5af37f6653", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771404964, "uuid": "a91dd96c-6b20-4da4-8145-2fb10dfc168f", "value": "Fattura scaduta.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2e082e-0ca8-11f1-a129-42010a9c0007", "comment": "Malware payload (Adwind)", "timestamp": 1771405511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405511, "uuid": "e72d8e9d-de01-4481-a60a-52c30a991367", "comment": "Malware payload (Adwind)", "value": "7fa312580c3c018d76dd7ccb90fe8824", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405511, "uuid": "7d7217f6-21d4-4464-b230-89de62d08ff2", "comment": "Malware payload (Adwind)", "value": "b0c19fb043afddb209e0a9fa6dc031946c6b7e38f16abba430125009744fd966", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405511, "uuid": "a65f3056-1e04-457f-82b2-5a40cf9df262", "comment": "Malware payload (Adwind)", "value": "f22b21a49c6970ff49311db887caf84f5aeb6c68", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771405511, "uuid": "9b32b0bb-8562-4d7c-8d69-2ab808ef79ae", "comment": "Malware payload (Adwind)", "value": "84f2ea33154aca00146c60245416553aabeded1dd6876f7ce4f27c5c248b799162278b081a11be248c0e4d1755c84054", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405511, "uuid": "d59f9e8b-f684-4b24-bc83-c1458172786d", "value": "T134D423EEE7AD3EEAB768795210933BB1D7EB0AC80E3C12D2981DA519E6F53300F54500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405511, "uuid": "9ebc435a-97e9-4629-9726-7264de6c4b99", "value": "12288:2c87rMhXetL36sWny/UN2sTfMpjOR3FEi0TtKmWYPg6YrRHKFdPccNL:B87rKXetL36bMi0paERpWipYrkFdka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771405511, "uuid": "b001ce21-0e9a-436a-a69f-307f88bf737c", "value": 646417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771405511, "uuid": "21f42bf4-4901-47cc-8aea-7640741a64cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771405511, "uuid": "b74154b8-c648-4446-a77f-ec7178ead2f4", "value": "NEW ORDER.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62efca3f-0cd5-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771424605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424605, "uuid": "8ba8c763-7df5-4533-837c-ee5322e402ac", "comment": "Malware payload (Vidar)", "value": "2cbc4869af00f878d89ee6bf3d47cc43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424605, "uuid": "cfe0e048-d786-488a-8b34-1399ca8d6566", "comment": "Malware payload (Vidar)", "value": "b1028e5b3b331b6fd7ff163865badc4e820b931441b4a5e5d99f8bef6c6f5724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424605, "uuid": "9d710ef7-bad9-487a-9dff-e78f1480f376", "comment": "Malware payload (Vidar)", "value": "58391d4239af90fd8af6a2b6703a5146804721b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424605, "uuid": "34d9e1b0-8776-4d08-8a8b-ef91995ae779", "comment": "Malware payload (Vidar)", "value": "94bafdaecbd3117815f5a82c75d50e188e1096c7373b3caf8dc9bcc8404226ef3e778d9dd21d9898970188b53053aed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424605, "uuid": "95119b56-c9af-498c-9e8b-5b72ad8e2e6c", "value": "T181F53A02BD4189E6D06BE2389CB292857B30BC19077173C31F2769B61DF6BD86D3A758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424605, "uuid": "e27ecb63-806b-4dab-b72a-6939e91666e9", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424605, "uuid": "ee5b82d2-fe30-4929-80e9-af1852b3fe92", "value": "49152:9pzNaI8Cn+ctrNfk/K1TEPG+oNZdSgn1PWG:gCVAPGJjWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771424605, "uuid": "f6018bdc-468f-4e5c-9e61-5fa1dd989caf", "value": 3495752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771424605, "uuid": "94240c89-eae0-43dd-b9a4-74573333ffb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424605, "uuid": "ca3c082d-2ecf-4b9d-a064-5312ae1c0d11", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbe976a-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423224, "uuid": "f5a4801e-edab-40be-9efb-968db5fbf505", "comment": "Malware payload (DarkTortilla)", "value": "662c66268e02709df95235b3395a9b58", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423224, "uuid": "c7d3fe4e-cc11-4654-8427-977db057a44a", "comment": "Malware payload (DarkTortilla)", "value": "b17c1605a8564b9772a2a90db59803ce70a2dbaeefcb3a7aedec732b87146b2f", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423224, "uuid": "f2b9e79d-1a12-4ecc-9f76-3d7d9721cd88", "comment": "Malware payload (DarkTortilla)", "value": "deeed6bbd2d6de238cca9a318d96288f3faa721b", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423224, "uuid": "20e3fe9f-928d-44ed-bc4c-5d9b3d5559e1", "comment": "Malware payload (DarkTortilla)", "value": "27c92e6ec0da18c3d53875feb8857d05a9e089495a77120a743e4750ff39c6aafb99cd500dc9142a3a3e1cb5f55acae6", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423224, "uuid": "5383840d-a038-4535-adcb-b8e113bde9f7", "value": "T1BC4623283B814928E97F877854398A816BF1F90FAB25C71D7B9D52DC4C01B4F9326727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423224, "uuid": "db8d4679-087e-404f-90ac-c1335851b0ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423224, "uuid": "f0c7ce91-1f7b-482e-b281-a8184917fd22", "value": "98304:CXH7nwNuAWm3GMvD+dHLRN9AdY3WkYSyCS:C375Nm7r+dRNWRyyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423224, "uuid": "9c4e3ab3-f731-41df-bdae-4e871a623fcb", "value": 5601280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423224, "uuid": "3b149cdd-2ed5-40b7-babc-ab07f19ddf31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423224, "uuid": "94e5f5bd-f40e-44c4-848c-1489cfdf36f7", "value": "b17c1605a8564b9772a2a90db59803ce70a2dbaeefcb3a7aedec732b87146b2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7192956b-0ca3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771403154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403154, "uuid": "7e4a9553-1e89-4850-af12-55778ce027a8", "comment": "Malware payload (Mirai)", "value": "34f909bff5a6747aa7676aad544a3459", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403154, "uuid": "8bdc685c-5b22-48b4-b89e-e4a184d34bb3", "comment": "Malware payload (Mirai)", "value": "b1c402737d03f75ceb3e31c55020393ebc7f0a68d4145dddcc6f2796139ee764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403154, "uuid": "33cdb0df-9103-4240-8035-6ce3cdbd861f", "comment": "Malware payload (Mirai)", "value": "90ac922a4065929e67516ca2d2a83400e1b16f77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403154, "uuid": "02412169-80ef-43b2-975a-88dab0974111", "comment": "Malware payload (Mirai)", "value": "fcd02b8936725d43b8971c3cd3ce1f4061100536af29631b07d59bcbcaba0df01136591887da508d77adc1f4fced68f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771403154, "uuid": "40b0f656-aca5-46cf-8a27-0c50b0ac2252", "value": "T110B3E816FBA10EF7D86FCD3742B9074524DC650A22E83B767974C528B14B24F8AE39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771403154, "uuid": "a9984397-47b1-4254-bd11-5703676a5055", "value": "1536:SYyLIViIDh/qt2qYndnZKiTbF7V2SunT/eu82XXgk3ZUtyZ4l9yEWJ:S7LIVDDRlvdng20Wu8U3+3yEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771403154, "uuid": "2897a1ad-3ae3-4104-94fd-47fa7a118efb", "value": 114068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771403154, "uuid": "a2d68fc4-2bd8-416d-9764-69e38c500d2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771403154, "uuid": "13251cb8-9566-4cd3-9ad8-f4357ea869d3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9d4d0e-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441180, "uuid": "608bbe50-adaf-4126-958d-57c90cd1965c", "comment": "Malware payload (Mirai)", "value": "e9adfb77b80973178ea5c092ba520667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441180, "uuid": "3fd2a5eb-789a-4cce-abd0-1f20dba5b71a", "comment": "Malware payload (Mirai)", "value": "b1f7f5383d0f7ba5aa3343096a0812a73ca4ca3f72eb29db736c00b045ffc677", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441180, "uuid": "fb8982ce-22a5-445c-ada1-fd51e92d0419", "comment": "Malware payload (Mirai)", "value": "f14444e2aa94f9b9dc1b3214eeaac90b5a52f97b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441180, "uuid": "da055904-9b64-4eac-b553-757195a256ee", "comment": "Malware payload (Mirai)", "value": "35758402d2e56310be10eaf3a6993b8c5e509714705975e1f590f2b28bb1f6e2f9dac425af424b0eed78cbf5198eece7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441180, "uuid": "53843650-07c9-4d4a-b936-d11c58444923", "value": "T15BA5332664DE2B633074A25CDEA2B74617CDF2BCA9DB030F9503765B2C4A0933D82DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441180, "uuid": "173a422e-ecd1-4074-a551-a68f99646980", "value": "49152:gN2ZH67EgLwjw5LSwaEqsXm/GF8RbY2j/1QIBsvudWeq7:gN4H6ggLwj4xa3vrpiImv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441180, "uuid": "b0329ef0-91d2-46c5-8702-977f2d6217b3", "value": 2116364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441180, "uuid": "d5121325-b55b-4b61-9838-82e88e12ff4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441180, "uuid": "ddef493a-84f9-4d37-8591-b6858f03de48", "value": "mdsync1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa72e58f-0d1c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771455353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455353, "uuid": "5715af82-ac41-4d97-bf9f-23326c13f3cf", "comment": "Malware payload", "value": "cb5a34e598baa687a98ac226722a9064", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455353, "uuid": "8ceac246-252a-4620-b7c7-06b50e5f1f96", "comment": "Malware payload", "value": "b2af46e22d1cf7597ba4b836534ffb672cbe8a68e8a2c8147398156ed10093b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455353, "uuid": "e2b574d9-d5a3-4ba2-8816-c6ef397bdded", "comment": "Malware payload", "value": "508ab8c9bb74971f856bd77ba642c7b411703a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455353, "uuid": "a6871032-f57a-471e-8fdc-c6c3ed663d91", "comment": "Malware payload", "value": "0266f4912e048a4bf31a6c9faccbe5af5622d208ef5d6e5dcbabc94cd2d58c1319ad3cdd07a4606159a15f7ed198220c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455353, "uuid": "9113614a-75ec-4136-b949-9e6237e80837", "value": "T1F0F30A09AF510EFBD8AFCE3701AC0B4635CDA55713A93F793578D918B60A64B4AD3C24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455353, "uuid": "001f30bc-8a7b-4201-8ba6-190a8e85bfde", "value": "3072:2+XhKfUkewYCtvIvdV/d7kJRNV3M9/YV2O0cG/:ho8kezXb7kP3M9/TOXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771455353, "uuid": "2f935017-d0c6-45dd-9685-bf4d87588eba", "value": 167836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771455353, "uuid": "06d05555-a09f-4544-acb1-d2f67715ef09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455353, "uuid": "38d0f461-ac4c-41a1-b733-5d34efa6f430", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc1155d-0c9f-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771401433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401433, "uuid": "0a83abee-c9cc-4714-96d9-b231172d2555", "comment": "Malware payload (DarkTortilla)", "value": "cc9879027d329167802ac0269efeb8fa", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "petro4prime-ydns-eu", "colour": "#82A845", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401433, "uuid": "193baa66-0ab8-4df6-aef4-8177d143b98a", "comment": "Malware payload (DarkTortilla)", "value": "b37cb0096aed7f10262a6fa8a510ae37406a0ed48eb42cf9e816d24f3369c9b4", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "petro4prime-ydns-eu", "colour": "#82A845", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401433, "uuid": "4e6615e5-46fd-4470-8b7e-3f046ca036c3", "comment": "Malware payload (DarkTortilla)", "value": "98b52dfd02099639db21ac06db5c6e0234eb25c4", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "petro4prime-ydns-eu", "colour": "#82A845", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401433, "uuid": "92c35ef2-3f87-4d91-8e2a-5270f7898237", "comment": "Malware payload (DarkTortilla)", "value": "666f4f9443e82b7fc7b479443acf126553567dffe9ae1b8a97b62b7cd61279e515b0ec1d3d17dac70fef6bc2e5dc1d19", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "petro4prime-ydns-eu", "colour": "#82A845", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401433, "uuid": "ca69fcea-8dd6-4347-ade8-003719affbfa", "value": "T169D423A1CAF8D45AE801BB23198D67BB18C8CEB1546E133992790F9DF8778D2D4463C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401433, "uuid": "143f7754-067b-4d47-900b-7f000dd6d58e", "value": "12288:mlOz9OSFEoFCzHnLoPag3L+wy4i7YQPZgNUDU/W0DSR9AnfZoGOVCkBfvilw:fZCoFCzEiWywFi7lgmIWmSRg+GOpvSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401433, "uuid": "77d11411-1af3-4e75-be89-ba11942983b6", "value": 632551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401433, "uuid": "6fac1963-a211-46f7-be51-b7c6d6872a64", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401433, "uuid": "859cd428-e1ab-4908-8c6c-84d5f4d0d62d", "value": "Solicitud de cotizaci_n________________________pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0011f769-0c9f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771401246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401246, "uuid": "b640ed03-f938-4cb7-9847-d14794a4e5ea", "comment": "Malware payload", "value": "4e078335669835b915ea6dc1fd436da6", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401246, "uuid": "8f207e2d-15f3-486f-bc2d-1706f8600285", "comment": "Malware payload", "value": "b43fd53e89c28a5d2cd3c9ba8bc2c5581d8d24063507632d5df1d79b77592fd9", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401246, "uuid": "731f06c0-ed98-4aa9-85b3-066d2f5d7f76", "comment": "Malware payload", "value": "43b4f7115d5c9f756775b65fcd9a7b4b406f3991", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401246, "uuid": "6bd2cafd-299c-4159-99b9-834f4bf514de", "comment": "Malware payload", "value": "e3232c8e952f1a8bf6ed410b1c41c806bdf3b76755833753d6242249b03ff006cbc98118ba2cc6f71ee31d7413c85186", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401246, "uuid": "c4004ed2-dbbf-43a2-89ed-a8ba85a74308", "value": "T119541266330AD1AEF1B21E794AE1915342C0FDB1CE83DB4BB6C1735FA8396C04B26359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401246, "uuid": "a6bb7bf4-dbf0-4761-b521-ef03f0930794", "value": "3072:bIsDLXK4Vqv+ntMdfyhmKwHuRn7L0Z2kuMhbCEF2ERh7GLW6sDI98v/TjUq+u68y:bpDj9ntfmKwc31ku22EGW6sVkuFajQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401246, "uuid": "8a7920ba-4d22-40b4-9732-8d5c3e7c437d", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401246, "uuid": "61465f09-e824-4d66-9813-2e1b97fd21c5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401246, "uuid": "4ffc605d-175a-4886-98b6-0e3867dbd6a2", "value": "Transfer_Advise_021726.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a7e5b4-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771406565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406565, "uuid": "4a41b964-d9f9-44cf-810f-9eac87023c38", "comment": "Malware payload (Formbook)", "value": "eba1646ee960767b1aea7236a3b6576e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406565, "uuid": "997eeab2-b54a-4134-8dec-6082e95e8163", "comment": "Malware payload (Formbook)", "value": "b462faa1a7a74d04b0110120ec3849019d9c251bbed07708095bed39ac2bee71", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406565, "uuid": "0aa5ca8c-1246-424e-8744-4dd2742a3de7", "comment": "Malware payload (Formbook)", "value": "bac5f6c3cbcfd8a5d0c05848f308abaf8208acc4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406565, "uuid": "adf459c0-f0d9-472b-9908-e8c911cca908", "comment": "Malware payload (Formbook)", "value": "82efd3b0b042ef8b84e5356660abf1bbf2a1e892fad1d638aec67899985eff0debd5a3bef40fd4885a2a9cba9cd195b1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406565, "uuid": "d882840c-9701-4d27-a2ed-394d1c6385dc", "value": "T183A275CD3DC2B166136A603B3A2FE46AF27B5C88F64CA594E9376554F494B08C863D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406565, "uuid": "ac18dd2e-4fea-4647-a3e8-5a1bb250d6b4", "value": "384:P8H3/ngpnvwpYy00aoJav6T5thFOmF2HxckCOFwNcr8CWEhY:a3Evw+UT32CG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406565, "uuid": "85af232b-00ea-432b-894f-589dbc1fc366", "value": 21932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406565, "uuid": "1d932f89-5321-47c8-8672-dd8e7cd30fae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406565, "uuid": "27c44ad1-1d0c-4e5f-8d48-cba464d68cd8", "value": "Order List.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d83f2db-0cd8-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771425857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771425857, "uuid": "0a64dca0-6ac7-434f-a4c8-7727b24b7116", "comment": "Malware payload (PhantomStealer)", "value": "590b8d6427c873e995a230bf7e086bed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771425857, "uuid": "11a6db64-ec72-4fd5-b3ac-07d7c9393b1e", "comment": "Malware payload (PhantomStealer)", "value": "b5688e630ded6c873e5680ebac79d2fde8882ff27795a4b2b809745c58cfd173", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771425857, "uuid": "14a57f91-213b-4141-a774-1b42d949bbe2", "comment": "Malware payload (PhantomStealer)", "value": "c95de6e5339bcf5c95b90026d614247985ff178e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771425857, "uuid": "144dc54c-d3d5-4d68-80eb-05cec2c6defe", "comment": "Malware payload (PhantomStealer)", "value": "0c746c6cc765d470ae9713a3d713578f1df177170071d48910748f3e6da787d34072ed4e149efe7693a89e28c05eae1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771425857, "uuid": "3eed37d1-4ac3-4147-afc7-1fb683d21f3d", "value": "T136652348224AEE03E5662B740E66F2B007751EC8E065E31BCFD5FDE7783A7D0585928B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771425857, "uuid": "0a21807d-d9f0-40f9-88d6-1295e2b7cb17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771425857, "uuid": "d4ca178d-1785-467e-8cfc-1b4c79e22a2e", "value": "24576:+/iEOLGGkjsgytBZ8MYQp2v2qbbIxvkn7aNPsDUg2q2lCQiwVruRCrpsdDSn/XO:+/iMHlytBZ3pCbevk7aNP+4VlCQ70e2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771425857, "uuid": "1db7f431-b771-4b9e-8855-6f0e14581e00", "value": 1517568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771425857, "uuid": "df0741ea-2aee-4d66-9206-bc10d74eb168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771425857, "uuid": "03956519-a4d7-4ba1-adbf-a6ce244d05b7", "value": "payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d1c490-0c97-11f1-a129-42010a9c0007", "comment": "Malware payload (XorDDoS)", "timestamp": 1771398175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398175, "uuid": "83681ed0-c3f9-4e41-a5d0-f21916327343", "comment": "Malware payload (XorDDoS)", "value": "deb5129de8e3749dd7bad82c22a0ce0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398175, "uuid": "0085fc33-71fc-47dd-acd9-f1ec636b2b70", "comment": "Malware payload (XorDDoS)", "value": "b62be5224f27f9438213215d0549319111ae87383cbf33fc0939869ac90f9b58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398175, "uuid": "c232403d-31cf-4c02-acb6-bff654874cd4", "comment": "Malware payload (XorDDoS)", "value": "5cd172e576dd0d6c14d890d78fbb2298839e7b25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398175, "uuid": "fa97faca-0cda-4efb-b023-92a78bc2be2d", "comment": "Malware payload (XorDDoS)", "value": "cfee156d8a533cc8b6497c2c28c0bd47e6d2ac40055f031f61bc96ff5d54fb162e3f377fe2b68b48a8cbf64b01a710cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398175, "uuid": "39c0d1ae-8916-4dd2-8a9e-805fdf7384cf", "value": "T119C45C06F283A2F7D42705B0124BF7BF8620F63594129D9BB7989D5AB9338F12A4D353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398175, "uuid": "704992b4-0d79-4e6f-bfba-bb673c5cce94", "value": "12288:VB2bw1CH/FwznbIU9sE8c8lqd49N94wT4JXALLp6yWrk3:VB2WCH/eMU9Uc8gd49N94BJXALL4ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771398175, "uuid": "3b8c0394-a545-4424-b0e5-e68a3782ac93", "value": 555272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771398175, "uuid": "354f706d-9a5e-4b84-a349-4285e6c2b5de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398175, "uuid": "cd7c87e3-cac7-4462-ab16-0d7065ebfa26", "value": "p.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27042403-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423216, "uuid": "13a58874-3099-4e6c-87cf-9ab7fea1b0a8", "comment": "Malware payload (DarkTortilla)", "value": "a8f12aaafba055a6ba649ff6f59bf585", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423216, "uuid": "da87c323-3ce2-48e0-a1cc-911c1f6cdd1d", "comment": "Malware payload (DarkTortilla)", "value": "b661d6a5c7a2f62d13e61c8c39623888918caafee8c67211248cc34568fea5f8", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423216, "uuid": "4c34b359-c777-45a4-b7b1-2c8f1f64ab81", "comment": "Malware payload (DarkTortilla)", "value": "b345b27beb62094b90193eb3951713c99cb94ed1", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423216, "uuid": "4b5fcd22-286f-4022-8ed9-d5e869191c6a", "comment": "Malware payload (DarkTortilla)", "value": "dab8c1013f293cc5aa4208f2806b6bcf0f45c980acc61163f9143f3a6a911a1ec7f2e778915ccc0c01c6711fb8059f18", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423216, "uuid": "c4c5696a-1597-4d74-a569-2b85a6305b2c", "value": "T1D85501272DC31664C9E54F75D2AA00E963F0C65B1215E77B6BFC02F5DE62B0AD9230B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423216, "uuid": "e674325b-bf62-42b6-a59a-032099e01b5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423216, "uuid": "548033df-f5f6-4f10-96c3-9e61178063c5", "value": "24576:ZsJhpLT/4PPH7caoc7uCnRveYepqMKDmfC4KOSSn2h6oJblNB1:2VLzswaoORveYkqM3fC41p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423216, "uuid": "d3808bcf-0b7f-4d72-a868-ff60915cc72e", "value": 1392128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423216, "uuid": "08646c13-ecdf-4337-80a5-85219f45c263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423216, "uuid": "bdd9d952-8c8e-49ef-9774-59e5ab4f1ea6", "value": "b661d6a5c7a2f62d13e61c8c39623888918caafee8c67211248cc34568fea5f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000006df-0c70-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771381060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771381060, "uuid": "8cdf32c9-0e4d-4408-961d-982aa847463a", "comment": "Malware payload (Mirai)", "value": "6410b69bd13940fa2fedceea08164f6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771381060, "uuid": "40b51d2f-8670-4ac3-9d5b-6584e724ddb4", "comment": "Malware payload (Mirai)", "value": "b823eeb737c32467cd191989d5320d13d5c5b82262a18164a7b84b88c8d1dbb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771381060, "uuid": "3178d812-d400-4429-8a86-44eb6dd46674", "comment": "Malware payload (Mirai)", "value": "6d0fd42da3f509c00de2bf44a789400ec116c4f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771381060, "uuid": "8cf8c0a6-a4fb-4923-a868-2fe3c90ad0a8", "comment": "Malware payload (Mirai)", "value": "119ced093e7ac0954ae5a5d2655e73803f97c0b21789c722cefcf3e47f4d3dcac1e99936ed4f3848a297a6edfcd55d6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771381060, "uuid": "697ea53e-fba8-42aa-8ad3-f521a0078b15", "value": "T13BA32B8ABC85C702C5E1A1F6FB1F51CD371643A8E3EA7147CD19AF29274B86B0A3B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771381060, "uuid": "07469218-3244-4532-b14f-4d5ca8ac1a48", "value": "1536:AjrAexK7sRRhwylK4/lZQKYPqr/JVkvqkeifNCG8vln4b+R:AjrAgzdwWNZQJPqr/JZhiffKln4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771381060, "uuid": "1e8bce51-01e1-4f77-8c9a-427167d97adb", "value": 103820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771381060, "uuid": "71302943-15d0-4203-a746-b97b619d0afb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771381060, "uuid": "9591352a-7ab7-489f-9e6f-6ecb4829d4f9", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e949c5d-0cb3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771409887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409887, "uuid": "4798b3fb-1f85-4e31-a90a-8dd22503badb", "comment": "Malware payload", "value": "417ba990cb178e330f69a3f7d7e97ddb", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409887, "uuid": "3a8fc032-2bf4-4a16-8796-617d971bb4b7", "comment": "Malware payload", "value": "b8e67f83f5c45c6d5d2a372bae0a20f94685c4410b757bcc16e9c257a5353cd2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409887, "uuid": "561e141c-fe1a-47fa-afbb-1f0674908014", "comment": "Malware payload", "value": "774745dcc05c04be9a667ec92cb9459262b29785", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409887, "uuid": "1eaa1acd-d034-4f41-9a47-6740f510d047", "comment": "Malware payload", "value": "e68addb57d10bf5ae9150308b3338860cf97f194af5da87bc451b2c2f04c13f34a27ad10b44a2810532feac52da379c5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771409887, "uuid": "d118bf2a-aa8e-438a-a5d0-400839188c45", "value": "T19081213CCE35FCC0037D328089A92C9B21A46A67DB715A3CE6060CEA3D65785DF3A64C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771409887, "uuid": "f913971f-d20d-424a-b529-874efcd993a2", "value": "96:WQQLY0dxEUrUspJDe3ySLn+fCM8ytl1Aq4svyEeRbtdN9PU:dQLndoEDUySLn+6M88fAq4nRbtdXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771409887, "uuid": "3433dc3a-9c2a-4120-b9e4-d6683ec9f7fb", "value": 3871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771409887, "uuid": "12557de8-8f13-428c-be23-15273f0fd85a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771409887, "uuid": "9c5a0e9a-cc51-4be9-b35b-272253ce7762", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224e1d6f-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771423208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423208, "uuid": "5191096a-ff70-40b1-8aab-431ca9d8155d", "comment": "Malware payload", "value": "4a849477967aef5eef9e04690da737d5", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423208, "uuid": "491ab701-a0e2-4a12-b06d-d54747f66375", "comment": "Malware payload", "value": "bc08c1f1cbe900591e690050e10dd450885aac98d0c7cc78ba01bd02b89cf7a1", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423208, "uuid": "13f73c27-47c9-4a8b-b4a5-b5ed7a9d6d94", "comment": "Malware payload", "value": "70639eb8bf236db1b8ef5663a6d3f6a9b43310f5", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423208, "uuid": "4de3d470-7fd1-435b-8f14-f59ffb7f56cb", "comment": "Malware payload", "value": "b582de77834fdf0984919bc5bad44eefcb881f3ce9a76207dc6b51b5ec26fe43d69b442ad1cec1204d5dc5c4186e6397", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423208, "uuid": "d5c7179c-9235-4f02-97da-727e92996fe1", "value": "T18015BE0223E85FA9F4BE97795976402547F8F906D722DB9E3D8884ED1932F40CA91B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423208, "uuid": "6ec93320-e423-46db-80a5-19d0ba4475dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423208, "uuid": "70c8089a-5bc8-4147-842b-f3d66d0dc773", "value": "24576:hVzetQbOVebkLKuxjBQcvT8C28jTGNxR:hV+AbkLTxjBQcvASj+xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423208, "uuid": "0512569d-251d-48ff-bd75-c359e7c30be1", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423208, "uuid": "97eb2a69-6d5e-474f-be07-b1ec7d16d904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423208, "uuid": "535c5587-69f2-4bde-b5e6-521554f90213", "value": "bc08c1f1cbe900591e690050e10dd450885aac98d0c7cc78ba01bd02b89cf7a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba578e3-0c9f-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1771401588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401588, "uuid": "83cfce9f-0430-46e7-a5fc-ed22c16b730c", "comment": "Malware payload (Socks5Systemz)", "value": "17644246ecea71c49bb8f84b756da21e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401588, "uuid": "dcb3f234-63c9-4271-9a5c-48d4ce147e33", "comment": "Malware payload (Socks5Systemz)", "value": "bc0c9c58f2886e83b8d035c81bc3100bb8d2afd87b67591130b88ff5027bf8b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401588, "uuid": "d19eb387-733c-43b5-a788-88bbc52f0afe", "comment": "Malware payload (Socks5Systemz)", "value": "8f00cc55eba56118db23e2bb8eee07da54aa4166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401588, "uuid": "d0c9dc18-2702-45a5-8f1d-780c071dd4bc", "comment": "Malware payload (Socks5Systemz)", "value": "75bf0d6bde47786e282ebc44c149afe619892b963fb5d0013a8a3e244147d6d457933b33563bcec0f171c4bba6f37d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401588, "uuid": "67c1b3dd-912b-48d3-b57f-cd63e3640bde", "value": "T12EC5B08277D6D0EFD0A32574EC3FC9A285397D67AE30D60FA648BE1D3E729805852712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401588, "uuid": "e3bcee2c-4f71-4358-8ff1-479123901e9f", "value": "1be36982bfb7827389751ee5bcf05073", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401588, "uuid": "a8cf1f63-16a6-4a09-957b-ce9d43dd2367", "value": "49152:m6whz2VNmKrGmomtdoS08bR/1gSG/rAaBx4Mn:W2VNdGItdJttgSksq4Mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401588, "uuid": "7b69c74d-066e-422d-b6ae-3c1e5f3fb6c7", "value": 2563837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401588, "uuid": "d76cc61e-4f17-4fc8-9d2e-e09ea189049a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401588, "uuid": "1621f5e7-3516-48aa-a75a-f8ee79b720ca", "value": "17644246ecea71c49bb8f84b756da21e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74c2ea7-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439457, "uuid": "443ade10-fc6f-48c2-9096-831e37d53464", "comment": "Malware payload (Mirai)", "value": "3ab8791fd67338eaa3177ec47a7df7ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439457, "uuid": "c37fed53-6af6-452e-b9da-78b6fdb39829", "comment": "Malware payload (Mirai)", "value": "bc9c9c728baac458f606c8901296cb7295b08f0f13818b4d89684d8fbf5e27c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439457, "uuid": "054b1830-d2e3-427a-ab2d-05345a77260a", "comment": "Malware payload (Mirai)", "value": "4544ba77d5bbaf06a47c162cb8395d9df314b336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439457, "uuid": "9fac5b65-3e45-4be8-bea8-9564bbe6a506", "comment": "Malware payload (Mirai)", "value": "3fd77c87731049ea6ec78308a9a15d6fca6d03085f680a1ce87104f4bcf41070804b356e836a2a61125ec91e4faeb8d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439457, "uuid": "0cb95d89-48c9-4d11-afc9-dbf1ce622a5f", "value": "T15E13F130F8D8EA7EE5B25433EC9645568BAF36F6A8D7EE1652B502800A478017BF5843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439457, "uuid": "e1e0903a-e019-44a8-8070-5af090bfc5e1", "value": "768:4rzD+G5vIf2SfshirzIho+CVNj82Q9xxj7gOL0qYEo1+9q3UEL8b:4vDLgfnfcirzIho+0NjW8XfLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439457, "uuid": "f990f5b0-e4c4-4389-8771-071c78553dff", "value": 44772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439457, "uuid": "b6c524e5-dc4f-49bd-a658-2a97ee2fd54e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439457, "uuid": "ff4e67a7-268f-4ed6-ba22-4fbdf5aa872d", "value": "rizzx.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a68105-0cf9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439991, "uuid": "e3d7878f-7b77-4046-8add-a6cbb461dae3", "comment": "Malware payload (Mirai)", "value": "2704347b60a4cf467aa0112805bc4530", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439991, "uuid": "1b7ee535-f7d1-40dc-a370-c1397d8fd8c0", "comment": "Malware payload (Mirai)", "value": "be509c83d2489e1ca1f90a5cd8ad50f651da9ddd16aac563c7c0f9fa5c1f75c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439991, "uuid": "6aac7917-cd79-4ceb-a6ba-f785d61be1d6", "comment": "Malware payload (Mirai)", "value": "978b68407d10fd1fee81d711f069b3aa025e72ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439991, "uuid": "56cdce0a-d4a4-41f1-b6ea-5ca1da77b5fe", "comment": "Malware payload (Mirai)", "value": "2ff149c3b13ead16d3c291e908768892347b4109d35ada7d2ddaf8d955fb55b71ebe2d2ac51ec54b4efb8c2d5f25edd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439991, "uuid": "cba7359f-1c6d-4e61-94b5-6f58323a8c69", "value": "T10AC31B45FC405B23C6C612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439991, "uuid": "7ee969f5-21d5-4ba2-9294-8b6d67b47eac", "value": "1536:p/Ka0rG5yC/cMChygtiOBdWFAcJX4VlgXTAXYFkWUGZrSo51WhrV1l3GwywEReQj:ZKaprMh7sOXWFh4UXcYFkWpZlvWNUmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439991, "uuid": "7bd91cbf-a275-451a-a6f3-5b53eab111a6", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439991, "uuid": "fa3890cd-8d91-4d7a-b3bd-70c34613cb53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439991, "uuid": "c5601314-a115-4b85-b8d9-43e4220084e4", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0991747a-0ce5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771431327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431327, "uuid": "eedbaecf-d76e-4d74-a89d-836aaa345fbf", "comment": "Malware payload", "value": "d48d856d812a598fc4f4c15c38dbca16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431327, "uuid": "b56429c5-65fa-4c73-aa50-411ebe4d32f9", "comment": "Malware payload", "value": "bea8ea012f08e4ec84959a5060e6ba425d67ec1ca4f62a2680f575eeafbe0e4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431327, "uuid": "1c7848cd-644c-4c13-9602-e8d10e27888e", "comment": "Malware payload", "value": "f5e121aaafc78a92ce5ac951837f1aab21c631b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431327, "uuid": "eb95caf6-7182-4a88-8ba8-87ae0d041ef1", "comment": "Malware payload", "value": "f0fe2459a39cacc3c3eba56c6376929e411a669b2d002ab392655d38efb6cf88e434d7403c2a84d4d26810fd3b5458f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431327, "uuid": "1a5ee044-087d-4449-9bb4-2251b8e88a5e", "value": "T13E6722137684C02DE16A06319D6F6EA0A6A97C335B2141D7F690FE592CF01D2BE33B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431327, "uuid": "9749f80c-457b-4e90-9203-461d6b6badf3", "value": "a5a0f941862df8e0d01359e62a3aaaf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431327, "uuid": "725586ae-cf8c-493e-9b93-791ea64f1ef6", "value": "786432:dKBUNLfS34PVLKg+2NMqVdlEGl1UH22jB4Eig2VmPmj:fNiod9Gu1UWQr2Vmuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771431327, "uuid": "24df5b8b-dc86-4843-a779-abc71d2d367e", "value": 32679400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771431327, "uuid": "34faa343-b6cf-465a-85ad-d417b90b317e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431327, "uuid": "fbc89784-8f9f-4fc0-9cfa-81ff1de38624", "value": "ZoomWorkspace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e99dcc8-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771406988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406988, "uuid": "dc818aa9-0160-455a-83c1-d32fdae7b229", "comment": "Malware payload (XWorm)", "value": "e8eec7b8202c4d785ad19f52feb4d5b8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406988, "uuid": "c130654a-508b-4c21-ae40-017cb8dfd6c1", "comment": "Malware payload (XWorm)", "value": "bed57cf6b8badbbe6fc12d1591b5adb723a0152dd31d037ac2d93331c295dcc2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406988, "uuid": "5c8041a0-9e96-4c8e-9664-ddb7dae725f3", "comment": "Malware payload (XWorm)", "value": "50dc5ee415dd28c7ed3941716b0f47b4a5320ab2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406988, "uuid": "08b0122a-98e8-4b8c-8998-38f8030264f3", "comment": "Malware payload (XWorm)", "value": "ab5d4be88b2c663e444d74acdd0597c3e90b30354d5712d650f70bf336e6372d32378c1661b8961ccaa4c36619004c10", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406988, "uuid": "c1db4da2-bb83-49e2-81b8-8413607442e4", "value": "T1C9441200ED699ED1427AAA36747E1908AB3367C74D547A103F5D818DAF7E20F42B6CCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406988, "uuid": "8a5827f0-49dc-44c8-bd87-8fac1b2c0e4d", "value": "6144:flILOkMmO13QvWGvMhcDSggeSgz2GvjShDs4EaJ:fljkM0vScDSxeZFX4EaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406988, "uuid": "cd4b945d-fcc9-425a-b00a-403bf4c9e0a0", "value": 275053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406988, "uuid": "0ef0df94-f593-4356-8cae-182bf6211219", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406988, "uuid": "d27a03f0-ced6-4a4b-9cc5-e5e8e9b44927", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67739e07-0ccb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771420317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420317, "uuid": "09fb93d2-ba5e-411b-8eaa-edbc0bcbb5b7", "comment": "Malware payload", "value": "c753774a46f9331481622319d260fcef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420317, "uuid": "187f92f3-cb09-4445-8a66-83705eee6690", "comment": "Malware payload", "value": "c0b8cb19505b5e346e7ebfa6a5d9a888251e3897a1e1d59e56c0c5eded7adfc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420317, "uuid": "df696dff-b2c4-449d-810a-a74ef73a9243", "comment": "Malware payload", "value": "b7193a54d2dfceecdbafb437dcd7cae3e5a5ab22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420317, "uuid": "729d2975-65d0-4df1-aeb8-46b70c16ad0d", "comment": "Malware payload", "value": "7dea94c779268d50693e364b97d912c8f19cf30bc69990ac57bcee99b6caa282a16f1ae794a7b3ccc50ad83e6c39768b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420317, "uuid": "00618e9f-6de6-4366-996a-0cef2631b761", "value": "T17B187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420317, "uuid": "f1a69d9d-f219-409d-a5b5-5c9838f243f4", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420317, "uuid": "63b5b565-6883-42eb-9334-f2af71707961", "value": "786432:GAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:GAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771420317, "uuid": "89f70b48-1078-45b4-8882-f0ea96e2f31b", "value": 90435584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771420317, "uuid": "fb035de4-93d8-4b45-919b-9e14375e9bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420317, "uuid": "3d648a77-2f10-495b-8702-525969283933", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af424eff-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423444, "uuid": "d73cf74b-fa61-423d-b9cf-45375d03504c", "comment": "Malware payload (DarkTortilla)", "value": "7415f550c8b97602f0a38575108c21f8", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423444, "uuid": "5ca64818-5af7-4196-b300-fecb8fa46421", "comment": "Malware payload (DarkTortilla)", "value": "c0ca98d9661d8a7851f97d65d2f8935465975480c70d3d0732b35bb05026759a", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423444, "uuid": "2fa5203e-8067-423a-9ee5-e5bbda3b921f", "comment": "Malware payload (DarkTortilla)", "value": "c6aa3509ff2731e3e024141fed8e2e8fa6125027", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423444, "uuid": "3c00a378-c191-45a8-97c0-cbc2e4c53d02", "comment": "Malware payload (DarkTortilla)", "value": "5e05058ddc2719dbdcb9d680068df69eb56d17b0a4bab7d4858d7a5d6d6a968d79a83588d3e123f0b92fb282c1474773", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423444, "uuid": "df0b5cce-95a7-455c-ba16-b95ca9958575", "value": "T1EE4612B23AC51518C6BFA7744C744A5D5BFBFC5BEB20C35D384332998E10B8A6A15B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423444, "uuid": "afdc84a3-25d4-4871-a698-d81825f04ab1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423444, "uuid": "eda29e84-b666-4aaf-8d78-043455b36eaf", "value": "98304:2eiZQ/2vgBxhOk+6vjV3Axc1oQq32yeDGWJ:2TvuxhOk+6LqS1oQwnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423444, "uuid": "3ac63fec-08ce-473c-b79a-e6576fcda82b", "value": 5527040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423444, "uuid": "00d07849-c6de-436e-9853-73dc21773182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423444, "uuid": "d57584d7-bbe6-4a9f-8007-61b00bc03bf6", "value": "c0ca98d9661d8a7851f97d65d2f8935465975480c70d3d0732b35bb05026759a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a362c65-0caa-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771406202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406202, "uuid": "5a322f53-daea-4f7d-9bf7-438ff25ebbed", "comment": "Malware payload (Vidar)", "value": "cbca0050696cb8857396a52511bf8a42", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406202, "uuid": "406899df-ae8d-4537-9eda-9a473949c53c", "comment": "Malware payload (Vidar)", "value": "c13f29931483df94a3207c28938b1c035beb74c38c4225531689dadd28ddda3f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406202, "uuid": "7793cc1e-dfd1-4b62-ad46-073741ddb087", "comment": "Malware payload (Vidar)", "value": "cb9c26444462df4ded52f4bd1ed46a95b942139e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406202, "uuid": "16d8e71b-cac5-4811-beb0-02bbf25ebeac", "comment": "Malware payload (Vidar)", "value": "8782d9ce1a89368c613707aca0854d3a3c62f8444d864acb2b31a9658472d7d4d62fcfafd4f86b26699ad408350c802e", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gor-megaexdistribuidora-com-br", "colour": "#C45F30", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406202, "uuid": "c020ea3f-04c3-4e0a-bdde-b05ae8c65f4b", "value": "T1419533105BFDF0ABF2E1997790D0FF34C79C967000A6069B9158B079B5532ECAFB21A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406202, "uuid": "3e176ffc-f964-463b-9f8d-201a8c7ef289", "value": "24576:b0ECF1kEECu8Dc9+QO8ZV9lFWdbgyE0wCZAQ2ojZ:bjIaEu8oFlyJgyE0wCSpot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406202, "uuid": "3866e1b0-a78a-47f3-b14b-1f8d13b3154e", "value": 1880528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406202, "uuid": "0737bb2c-c278-4267-a008-d5a34453cb9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406202, "uuid": "3b811d98-a157-4edd-a017-898b70623c86", "value": "c13f29931483df94a3207c28938b1c035beb74c38c4225531689dadd28ddda3f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112cb26d-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441218, "uuid": "ac8480d1-9655-4257-8b96-c6bb9798810b", "comment": "Malware payload", "value": "8f612173d8ed8da2fb2c0f30bd567702", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441218, "uuid": "036fa3a4-a276-42af-8d66-a5cb41ba6dd9", "comment": "Malware payload", "value": "c39965d85c5a26ea6a825f19f970c3dc8cdf8ea040d411b2547e1dfb13b1c44d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441218, "uuid": "adaeb1ea-e2c8-48a2-aaa8-36e166894067", "comment": "Malware payload", "value": "a06b0fc30027e97e8cadf7fc4843f577823db986", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441218, "uuid": "fbc09a82-9a6d-413a-982f-e91a3b5a79f1", "comment": "Malware payload", "value": "39fcaaf6b76686a395a081cb240a5990221e8020973e9b3cc2174e13ab198fe55fadf708655945b46c2022ce1e4c5d35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441218, "uuid": "52cb46d2-dc04-43ee-b8ed-40fe641e820f", "value": "T1C74113CE03912361B001BE1ABFB456E4BE09D6E5A6DD5235FE48F96EC18CE0930265DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441218, "uuid": "53f19b2a-7803-437f-8d88-dc3dd40f83cf", "value": "24:l5Iy/tMKYEI9+FMy/XfZIuTMQjIDR9AhIQt5IQFTzIBKJI4hvIzgYUlI3pYfYOqq:lb/tBFlvDTMQePAvtRTMKThegQuoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441218, "uuid": "f085ef02-78d6-483e-a011-ae25af20c5f0", "value": 1887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441218, "uuid": "dba0ff0f-f498-45f0-b270-3527f07ccd86", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441218, "uuid": "0575704f-7277-421e-aebf-d43c87171481", "value": "peniss.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb15fd1c-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771406741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406741, "uuid": "9d215c93-c357-43ef-a070-1c94151a7e39", "comment": "Malware payload (QuasarRAT)", "value": "66e7a3b0a4e9acb6340d9cab0e1ac5a3", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406741, "uuid": "9be3ccb7-c4d4-49f8-bc99-e1211187e474", "comment": "Malware payload (QuasarRAT)", "value": "c3a1146bf6e791105fdbd64cc28f99a7ff82f356ff8c5c155755bdc0b549c826", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406741, "uuid": "a8f1706e-3c3b-4004-a6c5-68a79d1bd428", "comment": "Malware payload (QuasarRAT)", "value": "84db78f6af0e919d1456cb17c1759588bd546bff", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406741, "uuid": "b4dc5d1c-9c84-4869-b15a-9c898679e392", "comment": "Malware payload (QuasarRAT)", "value": "3e7b00509eded992f3080bd0bd72531894198c44add049d1a13beaa4feb124737e50bcbc4b97cc7b7f918ba5682da610", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406741, "uuid": "5ac45794-3443-4087-a2cd-7ee79edf04ce", "value": "T1FE751271867BBEBF09686D8A54133EC11C3CA3A3844CD1B3F6C569BBB2A55D0CD09A64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406741, "uuid": "499a02f6-f622-43a7-9811-8b85d2fae96c", "value": "24576:MudUOW7qRmyemfXBTAxvguObSl6GQkn11s50055n4c2B6:Mui7qbheG5kQBpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406741, "uuid": "e6646954-44e4-4258-b3da-7ef79df12d7d", "value": 1610233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406741, "uuid": "55d0f46d-2b38-49f1-8e4e-aba29e22f12e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406741, "uuid": "2dae996f-e4d7-4a54-8cf9-c69a8dec9ab5", "value": "E-sign Payment confirmation and Agreement.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5e3f75-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771406582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406582, "uuid": "854fd2db-2034-4d22-b0fb-59e56c938c6d", "comment": "Malware payload (Formbook)", "value": "df7a026bbcede9598b51284f62cd761f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406582, "uuid": "ca3b7952-efdd-4438-bf88-6e11ee227330", "comment": "Malware payload (Formbook)", "value": "c44d11668e558427cabdb15cfc64cd02968282de2e22e09b0a2230a05e47f031", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406582, "uuid": "d7a30398-f08a-4ee7-bbc9-06b3d34f16d6", "comment": "Malware payload (Formbook)", "value": "59dedea3abf59da2d847c23de9c7d456fd41dcc7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406582, "uuid": "57bdf8e7-e1ad-4adf-81b6-fbe5a21636ef", "comment": "Malware payload (Formbook)", "value": "b4a3c7648201b5cf3720332f8e7235bfbf392bdd165f8edc1c95c729681f17004a72ae055270b5919762e955468826b8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406582, "uuid": "f79d2fd9-6a04-48d9-8ef5-18e3321ca6d6", "value": "T1844513637BC261F88A03592C9011FDE99BD2DC2B4598DF3BB810E9CB3FA579819150A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406582, "uuid": "8b7ccc32-1021-48d9-a246-6e6f02881dec", "value": "48:EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAy:z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406582, "uuid": "58b4f0e0-84b4-440e-bf36-3b670113fb01", "value": 1207108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406582, "uuid": "29325e65-2ccb-481b-b30b-c512393177cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406582, "uuid": "5e4d2718-6ce7-465c-847d-1d811c0afef2", "value": "Solicitud de cotizaci\u00f3n_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef1c758-0cbc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771414022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414022, "uuid": "54221c17-6dfa-46f4-a452-863d53e3c7bb", "comment": "Malware payload", "value": "5e30054bd680b9f28e8fad82a9b4076c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414022, "uuid": "72726a1a-ec49-4af6-a0c6-79440e3373af", "comment": "Malware payload", "value": "c52be6c430af5af99dd11fd2dd7e854b49b201ddae555b4325ee4a5961e088e6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414022, "uuid": "d031d56a-a39a-4569-993b-967f08462583", "comment": "Malware payload", "value": "5d453985be0f3a3ec5c9e77bef860ba6ced0b273", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771414022, "uuid": "2df3c46f-a6d2-44e8-8e3c-47d894ae5133", "comment": "Malware payload", "value": "dfd18a2afb37ab637e557220946714a5875d6f65dd7fa3c040148ba32f9fcb7714ac29215d9bade37ec98fb176e9899c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tryfonov---vkasis-com", "colour": "#E523E2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771414022, "uuid": "56b7749e-0127-484a-ab57-d68090a1d382", "value": "T12461C7041FB588E387F440A2B0D925B7D901B43934673E5F233E723625AEC9E674D899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771414022, "uuid": "00cd26b1-0bca-485d-baf3-89fe0abc3a87", "value": "96:30NxzW/cLb7uiye1lAzmdAM8nCVdd8NSjDzv/tf:kby/+n//MmdAxnMXtDztf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771414022, "uuid": "6529cb9d-f6b8-4133-b6ee-bd11b47c712c", "value": 3320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771414022, "uuid": "ee8f7e44-4628-47e4-95c8-77742f1daa63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771414022, "uuid": "042ecb1f-573c-4eb7-a212-f6fa2807596e", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2136664-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439421, "uuid": "f4350c30-b49c-408d-b967-bcf2cf5384a3", "comment": "Malware payload (Mirai)", "value": "48194c71f924ab6eb1272026fac9e797", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439421, "uuid": "6dc67403-77f8-4bbd-bb12-9aece37a5377", "comment": "Malware payload (Mirai)", "value": "c612ce7b5788adcc74e1fbf45a31d416152a520c5d6d7f04e7297f6ecc96b049", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439421, "uuid": "ee0f19a3-2ecb-4fc3-a6b2-adc560e900ef", "comment": "Malware payload (Mirai)", "value": "22833f17e5b320856d5dbad34a061fec80933ad4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439421, "uuid": "8f8986bb-63fa-4094-8b0c-e53da438560a", "comment": "Malware payload (Mirai)", "value": "bc15ba808f0117c2c387ec83c0fec8461937604e1ccf3f73b0069d49c3eec7cecb588942da3c912bd228e6becb49bf15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439421, "uuid": "584e5465-49c0-452a-b1f4-75146244c199", "value": "T190C3BE97F78B24A1C86146F007C77B8E2EA361119E6BE9E76C0E653B193A0DB19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439421, "uuid": "bde557e2-0dc5-4502-8dd0-bde208c4c557", "value": "3072:h35sfcq8rU8sZ2ZWL+tupAByFC0Pg5/q:h31q8nHWZpJg/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439421, "uuid": "9f712d3d-2c5c-4067-920a-51941d947eaa", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439421, "uuid": "fd972d9d-45ff-46f6-bdb5-99d52c50b5a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439421, "uuid": "3308db64-4b84-40e6-bec0-dab8915123e4", "value": "rizzx.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd7a77a-0c94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771396758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771396758, "uuid": "751a9ebc-f892-4025-9fb0-d04a3861a50b", "comment": "Malware payload (Mirai)", "value": "8778ebac85fafcb6f5eea111404d821d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771396758, "uuid": "e00a04cc-8a16-4d91-866f-84ba05eb8840", "comment": "Malware payload (Mirai)", "value": "c683da4652816c79cac0079f46542e9fe47e3ce523de9c1558694c4be4ead4ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771396758, "uuid": "be909bda-e82b-4738-a03e-9978ab68b85e", "comment": "Malware payload (Mirai)", "value": "e5d20262a2086b1cb52c3f6b7bb08d9994b3c187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771396758, "uuid": "25fa6260-0166-4714-9aea-1ca3d761b024", "comment": "Malware payload (Mirai)", "value": "e768f82bd492fa89162dff6f599ff319d8ea18ceb36b933cf8c01fbfa8de57c0f572ce312887bc98f3dc7c8aab097d12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771396758, "uuid": "bda86cf1-3d11-4243-9fda-c6c4caefbd6a", "value": "T1FF862850FECB14F2E9031D3155ABA22F23315D058B24EBD7EB44BF2AF97B6911932249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771396758, "uuid": "8129b97b-16ec-4b3d-b189-8c4a482ccd97", "value": "49152:5lco1fij/J1BiEB2Xdqb9EHmlTefOa9rThVCYipz7GKbYLqfoF8m26uabsp4FVi/:j1fij/J/MdO9PqT+Nm2lavymJHXqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771396758, "uuid": "3bd8ba9d-3d6d-4464-956d-d0d6020d51c3", "value": 7944224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771396758, "uuid": "7e9659f3-186f-472b-8286-bb7cf681c165", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771396758, "uuid": "ce1ddbf4-54fa-4656-bef7-c86af6e0d486", "value": "kworkerd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55a0381-0c6e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771380478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771380478, "uuid": "c8fa19f2-5396-428b-83f3-3a07fecb28f1", "comment": "Malware payload", "value": "5342e53a45f3dfd9f85cd1a5b6bb7e5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771380478, "uuid": "20266155-c25a-4da5-b6c4-6332f942fa27", "comment": "Malware payload", "value": "c6b4c1c3ff5d93c3fdf967923fa7b4689a948411b48a39eec2796758068a57a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771380478, "uuid": "f3534e18-7c34-4b0d-b916-9332fb5ecdac", "comment": "Malware payload", "value": "b4bf3571b59fd2b34e459d7e43062125215e34ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771380478, "uuid": "01da3fd0-538b-4574-be5a-4c0557c99953", "comment": "Malware payload", "value": "53c6236202f41f8c99b33a414f1f93a86ebb56ca45e7a8713b25577a905780938da6a919c4bb1013955d2fd02f40876d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771380478, "uuid": "7df258ac-ddae-4bf5-9cdd-93faeb43c38d", "value": "T170E3D74F6E228F7DF278C7358BF74A34E39923D623E19A45D1ACD6101E6028E541F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771380478, "uuid": "ca801648-48e9-47f5-86ce-7c35eafc162d", "value": "1536:wd2ZbPAUJBnRTqUsahhrGHhFpuFaVykDWSvxyB1fF6ugrL5ne1/B+0pyT/VEXL8t:noUtDrsjzt5vEkugRKByhE78t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771380478, "uuid": "4f07e039-d003-4f9e-a702-b55bd905e9be", "value": 147200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771380478, "uuid": "ef2dfc82-d2c0-4281-a749-a54beb95677d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771380478, "uuid": "3a326c2e-6292-41c1-8a50-afeb113d57a6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f024ca-0d17-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771453017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453017, "uuid": "74a68c78-8a7e-4019-88dd-c8135ef94806", "comment": "Malware payload (RemcosRAT)", "value": "667877996f0ef09f210c3287e90a47a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453017, "uuid": "e6f40845-8fc6-4035-a06d-b877b007b6e1", "comment": "Malware payload (RemcosRAT)", "value": "c71e7135b7b1398ec8e265eb23ccb19d955d7eb93c8fd302f621b1709083d071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453017, "uuid": "ca740cec-e0e4-4db4-ba25-c917ed1fda27", "comment": "Malware payload (RemcosRAT)", "value": "a1cd3a9f8c199bac2d474bf2364e6811c58d5a2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771453017, "uuid": "10a2af2d-b8bf-40c2-b818-396214355a4c", "comment": "Malware payload (RemcosRAT)", "value": "35e3a62ebd6eca555a4331d6c5cb6d18bdb18bd65fb1e6334d5c2faef50bc4b0e822fc066510784309caef113ae5c132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453017, "uuid": "150eee64-04a2-4139-ade9-36da03ea6cb4", "value": "T18BA66B2AB76B35BCC7AB927882576B317921F45401B4AC7F9590DBB07E31E10136BEB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453017, "uuid": "5177c5e1-df0b-40fa-a44e-61c5d5a5bd53", "value": "ef17684364f3e18833f47a9da6237541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453017, "uuid": "9dc77350-2556-4c9d-a284-4bc6c5c59e6b", "value": "98304:ZSbx2dLG3o34pLgxeUxX4yU3t+ORyu3Z9yt95n5tC6xr08SaYSGlu3U0qnRyNS2i:Zex2OPlNneLt5tJGfSGw3ayNSHLDwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771453017, "uuid": "35c4fdea-44eb-4dfe-9777-3363cb0dde12", "value": 9798656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771453017, "uuid": "a1834fb2-e965-468a-a563-63448e8fb5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771453017, "uuid": "f24b3a26-0941-465a-9307-06b16a0814e4", "value": "uxtheme.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb8c44c-0c91-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771395333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395333, "uuid": "2ea1b547-930b-4b8e-b967-a5c560767b16", "comment": "Malware payload", "value": "6a9aaf8325de630ed1fed82539027d64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395333, "uuid": "c2c9ecde-e38d-45e0-816e-8e2b45ac7c03", "comment": "Malware payload", "value": "c7a6a0114ac7cd30f3ae726605f7ccfcd5992d400b4911865a9d1fa3797bafa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395333, "uuid": "a6bde3c9-bf2a-4d8b-9041-ceee5515822e", "comment": "Malware payload", "value": "4d30912e57d3b77ecc0f90350ada7f9e7b682d62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395333, "uuid": "341ad35d-28db-455e-803d-e3ee76d7e2f1", "comment": "Malware payload", "value": "b1240f22a5043e6b663057b312b1e1e935172ab0ff1609a4d6dc393e736508ecd66ef6258e92a0b5b31a54f0c1d1795f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395333, "uuid": "a3fafa79-12ee-4069-ace5-d96d6fed6a73", "value": "T1AC04F24377006F62C738993004F38642AAF717E52EE26566AB9CDC00BBA575C652FEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395333, "uuid": "b2ad2e32-5406-4f0a-9c65-038a065a5288", "value": "3072:kgfKVeEOH4lcgjJywf9WM8NL5bJxUK4lJSXuZZfDjplw5S3hS2wQ4ApSYNMK13aj:kbNR18kWMILLulJSX0fDN25SxS2RPp18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395333, "uuid": "5863d812-4c1a-41ee-806b-ff06833580c9", "value": 180676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395333, "uuid": "1062a550-e71c-4e94-ada2-84108fca2b36", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395333, "uuid": "0eeb9dad-b1f0-40cd-a828-990329d94d6d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca6ccce-0cb2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771409481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409481, "uuid": "88841a18-c551-4bde-87ac-7e32c6d891ec", "comment": "Malware payload", "value": "d6fbca9574820dc247bcde36de318297", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409481, "uuid": "d8d6afd0-f0d2-4537-9d81-7b4e5d8a14d6", "comment": "Malware payload", "value": "c87fd54ff4eb61c9358b37e6099541d2ed3800765af774e4371ba4aa53fb3512", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409481, "uuid": "cb733513-72d9-4741-9cf8-8ba94b8b3ac3", "comment": "Malware payload", "value": "9b40e8c02a1e9064c341e3421640d65c2b4502cc", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771409481, "uuid": "7bfa3b23-d395-4ae5-b375-9acb6eface9f", "comment": "Malware payload", "value": "6c53d07b428d991b2be0b66a4570ad1271184984acb7f1d7d4c99d39cd415bc40452e87fcdf700b7d258337eaaf65dfe", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771409481, "uuid": "e661d555-a030-4948-a09e-fb660bfebc7a", "value": "T1BE718D32C0E44AAC604B9AC28CEC5901E58FC3AD39A07EB870083C85F28779E1E3D011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771409481, "uuid": "d9d0f978-e3df-468c-afc6-b765aa9e9bcc", "value": "96:ZSSpsDaYkGvpu4ZDjDzb1QJryHM1ZHSxwpL8a2VHA0kmOKtG9p:NpsDaYFvvDH1QJrys1xYpa2V1v1tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771409481, "uuid": "28de6e21-c316-4e18-83f4-b21a432b0782", "value": 3484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771409481, "uuid": "57b3e54c-91b9-42be-b2c6-7b2937f4128b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771409481, "uuid": "14ad8852-1a73-4189-be95-93c37ecc8885", "value": "Sars Letter.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c61e650-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423198, "uuid": "63cb9698-e6fc-4594-8dd4-0afc28c18e6c", "comment": "Malware payload (DarkTortilla)", "value": "0fcbda90255ea6f156c904593e3d9cc0", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423198, "uuid": "8e62ed4b-c601-4e3b-bd7c-dce30c050653", "comment": "Malware payload (DarkTortilla)", "value": "c9674446e0b7ab1518cd8c425643a81918b6f45e01f4dbdd326d702d97d04815", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423198, "uuid": "fb653f9c-4dd8-4554-b3c5-38ccf4176bed", "comment": "Malware payload (DarkTortilla)", "value": "c232380b4a5e84b3c199c1f816777fdf2d1f3e2a", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423198, "uuid": "8caab0ee-dfed-431d-9b4e-377b6c4eac3c", "comment": "Malware payload (DarkTortilla)", "value": "a36f5a9c981b86c7d08e88b8725a5ec80d911b1b5b2a41747dea065e7846b64431f14317529c9ca35bca52274c061dd4", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423198, "uuid": "c6e9aff3-180e-412e-b1b1-690ef8754025", "value": "T1F045018A17C456B0E4FE8F78A6B8045947F8F61B9721E76E2D4842FEDE00B4596133B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423198, "uuid": "ffdea570-572c-4245-950c-1bcbc3d91f5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423198, "uuid": "0fd1fadd-1a6d-4222-a41a-39dfe3fee6a7", "value": "24576:Y9EPL0gEcyEBEuec4UuBYCnRveYepqMKDmfC4KOSSn2t6Ag3XV:Y9S7WTuec4UuLRveYkqM3fC41p2neX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423198, "uuid": "f9c34a8a-07fb-4839-bf47-d062d99884bd", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423198, "uuid": "3ac340c1-685f-40cb-a3e5-20287326bf4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423198, "uuid": "78bf0928-b0e3-4e91-a919-fdc8292d34d9", "value": "c9674446e0b7ab1518cd8c425643a81918b6f45e01f4dbdd326d702d97d04815", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b09b9b0-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771439275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439275, "uuid": "ffe657fc-a658-4d7a-a757-4ee6eefb6de6", "comment": "Malware payload", "value": "0a7892c3bd45e578b574b6f141895559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439275, "uuid": "bfbf9f4c-2b9a-4c27-be66-2fb2dc7a5152", "comment": "Malware payload", "value": "ca96f9eb80ddc0300f7b6e5642d829fa540eee19e3df714282b96deb7ecf43d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439275, "uuid": "89a1bf6d-8040-4284-b356-297d8c867e8f", "comment": "Malware payload", "value": "237425274209837a96173891b2390b74e1a1a91a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439275, "uuid": "0f73accc-a89d-467d-83bb-3529691457f3", "comment": "Malware payload", "value": "4490b4c17b9a48f7a157346f1b4715927b9a08bc8fb0e792616fe916cff2728753469d22447e8a476a3f31fe164ddb7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439275, "uuid": "4051c3ff-98b7-45e7-a64b-6a6e69637131", "value": "T15AF54B07B89189A1C15AE2389DB662843730B498037573E31B676BF91DF7BD80E37729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439275, "uuid": "aaeba9a7-7cc2-40e3-989e-650682c01068", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439275, "uuid": "54cf47bb-41ee-4483-8822-cc8dc6569991", "value": "49152:Hb+5fHSlpn8xomKmosPK1ejV7JsJdSgnZ8L+Z:Fn8U+sC+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439275, "uuid": "e1c49a63-c86c-402b-9155-5e57cffb61af", "value": 3540316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439275, "uuid": "d2bfd1d7-8a4e-4e8a-b008-de508b6d506a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439275, "uuid": "553fe0b6-5e94-4029-8088-aa53c9ad3279", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ad7086-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423408, "uuid": "fae8cdd7-c0ee-4507-b8d9-75916beba14e", "comment": "Malware payload (DarkTortilla)", "value": "64446d7b6cdc0c69f3de0f33ac5a1b74", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423408, "uuid": "b7942ba0-eea4-495e-b2f4-d6599d147ced", "comment": "Malware payload (DarkTortilla)", "value": "cb0ec38a9f46e87a445d3ae13fe20fad30a585c9c25078f1ff5edbaa674bc55c", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423408, "uuid": "5fcd6918-85ec-4bad-9ea6-b6e8f39c4200", "comment": "Malware payload (DarkTortilla)", "value": "43e9ad8bde3cf75c3d42fbf9c0bbb134656a54f1", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423408, "uuid": "333d4c40-f2a5-4449-99ef-5a28e7ac55b8", "comment": "Malware payload (DarkTortilla)", "value": "c46d9215a31bce7b4e86baa4721f66a76f17cf84beba3c05171f262110392c394ea5177a2b75e3d17b07f0bc2c72fdbd", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423408, "uuid": "46c540a5-1640-498a-a625-35d6ca93db72", "value": "T17945F11623EA1A54F4FF8F38AAB4405447F1FD2BDA31E35E1A4011E98E71B81DA62773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423408, "uuid": "65067f8c-556e-4d6a-ba05-eb576c5e3c77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423408, "uuid": "f3252b2f-8918-4512-b15a-6a172e8143bc", "value": "24576:IJTMSmFzUbNDHxtZCnRveYepqMKDmfC4KOSSn2s6CLX:yTpmsRiRveYkqM3fC41p2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423408, "uuid": "c34cd8ee-cfa2-4ca5-b5e3-68ae7a8944cb", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423408, "uuid": "61f18c26-2d8f-4dff-aafb-9c052d9fce7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423408, "uuid": "ead8be73-7792-4afe-81f7-1adb09c8f6f8", "value": "cb0ec38a9f46e87a445d3ae13fe20fad30a585c9c25078f1ff5edbaa674bc55c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0285cb-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771406452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406452, "uuid": "add314ff-dee5-4102-993d-cd376e091271", "comment": "Malware payload (VIPKeylogger)", "value": "6fd6f43e81c040b1f20a3b8fd943f18b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406452, "uuid": "83283647-a4df-499c-adbd-31dd7c32c675", "comment": "Malware payload (VIPKeylogger)", "value": "cc30f623b23d30d4843b57d78c71326c1ba9243bed4960bae9383bd7a0dd622e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406452, "uuid": "a0a74e94-d98e-43ef-a500-c63a85c40e12", "comment": "Malware payload (VIPKeylogger)", "value": "e513efa4f86a943c8fc27d0f78bd610b3b5bb1ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406452, "uuid": "eeea5de6-5900-4e32-be97-f0857b539bc7", "comment": "Malware payload (VIPKeylogger)", "value": "cfe8199cc62b61433e481d1bc6e4e8caa438db42b52cdb315fa715e34822aace0e022eaeed10758ee295630227a8103c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406452, "uuid": "63bfd3d7-0ec7-43de-a7dc-d319a05394ef", "value": "T14F35F582F1E109875F2B6A8D4636BEA4CD274338A9F1CC7C763AE8FE5041385C16577A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406452, "uuid": "0f5e49aa-a905-4675-be16-a4965d1ffe82", "value": "384:V931BBcbYt+vi3Py2HSsAIyIXyly9i0r16eaf733IbJyL7TV9xgl6tSa9/QWMqoW:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406452, "uuid": "8478c628-dbf5-41a9-aea4-75266205d0f5", "value": 1108105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406452, "uuid": "3d59cc31-e176-48f7-865c-b8069eb040a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406452, "uuid": "cafdf3fc-b7d2-427f-aad8-303924b2ff23", "value": "Payment confirmation_Bank_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d137ec-0ce3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771430542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430542, "uuid": "baf6d73d-06a4-4c2d-95ca-4fdc604a7c8d", "comment": "Malware payload", "value": "1341facabfecde18b431be8c15908052", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430542, "uuid": "8a837b1f-0d0c-4d0a-9101-56bd400dc25b", "comment": "Malware payload", "value": "ccd0e82bc10644678c1435274e5d9eb002b31e0808a411ed6fbf34eb012da04a", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430542, "uuid": "c85fb301-db3b-4e15-8c74-5ccb746fb0a6", "comment": "Malware payload", "value": "bcc17bd018648f41aa8a2c3fa1c731d5b47abc58", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430542, "uuid": "20a76620-ee42-4a20-b245-cb3e9bf0cf4e", "comment": "Malware payload", "value": "9dadca6656c72a2d1e7141aab50e5e510cae9438ce346f3aa7484252d39dc851465dc45df22e30804f22d640fc980ec0", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430542, "uuid": "0e3b6c33-fd06-45db-a59a-76f39fc962e4", "value": "T1E3E4F1531EAD65413342D76B137F6949DAA06F4CDB028E7B3AF3F58EA024923B0475CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430542, "uuid": "5695c61e-8734-4228-a704-72d5f0891709", "value": "12288:uvb6v/XESLZVBxrI3z6KBnFrFmo/m0NbxetYnVKsnotICsIdX50loo6xf:uvbGXELrnFrFm40IVPno2Cs85Aoo6xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771430542, "uuid": "220c1acf-af65-4053-94b1-d8870ea0bd68", "value": 720645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771430542, "uuid": "dedbaac2-1b21-44f3-b8c6-31e1cf5f6817", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430542, "uuid": "25b97c88-e8f6-42bb-b3ef-29554642dbc8", "value": "cb8a586294e36d4d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55cbc71-0d06-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771445815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445815, "uuid": "01cba9f7-6927-4074-8795-bc14e3f7c702", "comment": "Malware payload", "value": "bc4811b294c50dee367fc10a5b4efaeb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445815, "uuid": "163fb40f-cbd8-47ca-9e22-41433fa77190", "comment": "Malware payload", "value": "cd0c263a8c3c9580e03641b368e79f446768172bbf5ae2742a5d16cd508c5901", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445815, "uuid": "c453637e-8d89-46de-94ce-7344f650f30a", "comment": "Malware payload", "value": "08976b56f49e500061824f51bf0e20a4c39f9cab", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445815, "uuid": "c2926baf-2b30-4401-910d-a604446e844e", "comment": "Malware payload", "value": "67ea4777f55c2fe3681260e7cc51cfe0cb918c755d819975578ab9033a46cc9137b6ae5fa8402d7e635267935f2c48a7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445815, "uuid": "b9a69819-bfe1-4850-b7c3-789de4c6cc12", "value": "T1A2C2880279211A3FFDA40434767E5D16236C793B3B0C60E7F7802964B176AF279BB989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445815, "uuid": "dc60dac3-53b5-46ef-bf7e-0487574d12d0", "value": "d0f945da54f20d8bcaf079f2d6ea9f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445815, "uuid": "2bbae551-8ffb-45e6-9f65-4ae0fd7aeec5", "value": "384:xu1OuP/oADDmd/30PQFYhJ4JVB0WNUnwnR:xNuP/oAHA0PqY+xN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445815, "uuid": "b1f96da1-0bcc-4816-83b9-216aa48dff5d", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445815, "uuid": "370e2e98-d2ea-44fb-9763-d35caa023e34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445815, "uuid": "3f1c3b4e-2d67-4455-97c1-4c61392693a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3949a175-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771402201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402201, "uuid": "5d48b3c6-7526-4580-8d8a-99ec3d249644", "comment": "Malware payload", "value": "f062256a728938037f48e484fbe39e2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402201, "uuid": "031de73a-9bea-418a-a181-81dfedfd1710", "comment": "Malware payload", "value": "cdf6274b285a878c90ab83043f151754e46b957db39631e598f34b1d6b99424d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402201, "uuid": "772928cb-4321-4343-8a0a-cdb9f0ea2ef7", "comment": "Malware payload", "value": "138dc89a0c4fbf0199262342f86b6408af0b787d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402201, "uuid": "0a9ae502-3cf5-41b5-8209-ed5ead367cf2", "comment": "Malware payload", "value": "91b1577f7267ad9d8a8d7e6a374796922b224e8303dbe386277c64dfe8dac0aaf075daf3fa4af23470b1b457b243a134", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402201, "uuid": "b0c12e78-db0b-48b2-b028-710509a08de5", "value": "T16B32C517A7BBAE1BC4D037770193072162E95F916124472FBD0D1C8E6E9A3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402201, "uuid": "df9271f2-4a3a-44d9-80e3-6367c107d5eb", "value": "192:xvrOR1CQOsz1NxfAz+OH9iG0GhWaDpU/O7Q89AGSyb4qeif:xvrbCzfap2GwIU/kwGSvUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402201, "uuid": "a48dd30e-201f-4ef9-989e-69c36ab0459b", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402201, "uuid": "d1e00b3b-84da-4e47-9ffc-98f8019b0b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402201, "uuid": "b1e08175-ccf6-428f-b095-4676e9bb424e", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d270e2-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771402214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402214, "uuid": "03f48b30-bdbe-47e0-9138-8844bb2a4bb1", "comment": "Malware payload", "value": "605ad704eb7e52d7d038edde889fbd17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402214, "uuid": "a06f16df-9655-4806-9794-b9f95f0d58ed", "comment": "Malware payload", "value": "ceff501f84a07e94e7d0a9b2732457aefc736159c9a73f2a8c80d3745f269887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402214, "uuid": "25f27646-6bf7-4409-a4a4-857320cfdf5b", "comment": "Malware payload", "value": "f6ee413d7d66c02cd70ef85b56073ed14082a5b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402214, "uuid": "c513ff2d-811e-4b24-a083-80e1e87a4b08", "comment": "Malware payload", "value": "703fa085a702d6ac6e6df5f3ff3587f61da42e116af866cfa350bfe6bc90f16b513891a55dd7a1950904c46289053744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402214, "uuid": "02d5ea5f-74be-4414-a564-746288b0e1fc", "value": "T1C7C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402214, "uuid": "2d7dea86-cf5d-4828-8cd4-2480841ebb8a", "value": "1536:68B72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dmJ:6eB4exMF7oZKJnCNYaUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402214, "uuid": "ac7fa19d-8cfd-405e-af58-d91021eaf3f6", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402214, "uuid": "4aac020f-5ba6-4963-98e3-1af1dbb379de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402214, "uuid": "773db9bb-2c9e-4ec4-8f6e-42a0671512f4", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac7c976-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441368, "uuid": "16a8f927-adb4-4a58-bbef-cedb89cf00f7", "comment": "Malware payload (Mirai)", "value": "ca3733f2e64bcfb0edde74ed7d925f96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441368, "uuid": "e26c1b2f-2896-4e76-adf5-f4e0dbfb98e0", "comment": "Malware payload (Mirai)", "value": "cf17c5aba9f7f5ecd9bdcba6a9ffd3493173f0d178e839854d50e5d57ecf9602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441368, "uuid": "0aee5ebb-5bf0-46d3-90f8-40135ee54e55", "comment": "Malware payload (Mirai)", "value": "230f22066a8a095a02cde72b8861ce2241cefbae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441368, "uuid": "7e5fd868-c7fd-42c3-92c5-5ac92801eef3", "comment": "Malware payload (Mirai)", "value": "36f5480188bf65831573c43ea9194e90d374f16003416b825c6bcb28cce40d3b87205ba889a28a3a9d7abfac06aaf986", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441368, "uuid": "fcd8b42d-5dbf-4e61-b838-4c1b0c2bb624", "value": "T1C086085BB8924942C5E83A37B8BD80C433631EB98B8756576D05FE383EBE5D90E34364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441368, "uuid": "f0a2fcc1-2e63-4eb2-85c5-1147bb2f3922", "value": "49152:TnU7ksOT2+R0p9g+it0UUubgSi0JyR/hih9MUsXRNwJXDD7+L09723G5En:TnnWg+duJSGlD7+L09qsEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441368, "uuid": "5e1f591e-9ba3-4653-8be5-94048cdd99b1", "value": 7995540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441368, "uuid": "347c7480-b469-4efb-92e7-f4d10673812d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441368, "uuid": "0b331927-daf8-4a13-b584-169bf12bc1ac", "value": "mdsync1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93bc671-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1771406764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406764, "uuid": "62af5209-e5c5-452a-aa53-5134337165f1", "comment": "Malware payload (MassLogger)", "value": "5460054248bd1cd5a3091dd5490c6dc6", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406764, "uuid": "567d8206-fe63-40b8-97d0-aceceef969c1", "comment": "Malware payload (MassLogger)", "value": "d139f12bc1d4c56ec47f2e9eebe25b381a51eab9c62575dd96e56b6f23390be4", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406764, "uuid": "f0067308-6520-4a87-a19d-f18fe0bd1bcd", "comment": "Malware payload (MassLogger)", "value": "f46d8a908c3f9f8e937c090051b37ef9630bc7ca", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406764, "uuid": "6edde6b1-b415-4248-982e-fff31774bef1", "comment": "Malware payload (MassLogger)", "value": "9023fe41fd58d16dd5e5d9a91e6907eba41dac2c1c6f494449a8539b3351428427ba41889e31131c78a3647217461704", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406764, "uuid": "403da7db-45a1-4ac1-a3ab-6e4187d09d85", "value": "T18C45C2D6E71F1FFCBC91AFB4BDA943360826B0A5B1695C069DC81180E96D5F8C322D6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406764, "uuid": "681403e8-712d-47cc-95b0-8f36fae1f22f", "value": "384:3EXLevg6ubZTnOHowE655FPH6ZYAcFVxLLxlvD3:f3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406764, "uuid": "d3f5761b-e2ce-422a-8eb9-0105fd5c24ba", "value": 1259076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406764, "uuid": "cb43bdab-deb4-4001-8b9b-277727b9e325", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406764, "uuid": "76d40c23-ca50-4655-a4f9-e44ba21e7855", "value": "PO MSKU#00133618.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8372f4-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441215, "uuid": "69d81ab5-cdb2-4da1-83cb-cba876346fce", "comment": "Malware payload", "value": "c665512a3897ca06ca346610064b5d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441215, "uuid": "a9395a6b-af38-4966-8ebb-39e6d12f5714", "comment": "Malware payload", "value": "d170f20b959f2de136ad1a8d97019b3014d8c9a09a547ccb476eee054663242e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441215, "uuid": "168c7aa6-ce14-4dde-8a5b-d3ec834e54f9", "comment": "Malware payload", "value": "f696dc6f456275b8801634f31379e2d0708e41e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441215, "uuid": "dbdfe5b8-c4eb-47fd-b999-9b79acd6e10a", "comment": "Malware payload", "value": "eb724b1920722acabd3c45a8a0de117e063c2ddad26e1d77498545fdf5ecdc8a3f34a044600be843e6b089e9f870f60e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441215, "uuid": "6be8dc2d-7045-4f60-a0f6-93c43664fe68", "value": "T144042A02770D4A43D15B2EF026F757F183A7AD0129A7E540F21EFE886771BB0A51AF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441215, "uuid": "a889ca19-7710-460d-8f94-f07b717f0985", "value": "3072:JrEf5ZXxHiCrCpWBetxerQloP2dcimG6JQp6F882/4lH0RA:QjXxBrCpWotx0QlMTimG6JQp6F882/4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441215, "uuid": "f047f1d4-9304-40e1-a85f-0291347da162", "value": 178075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441215, "uuid": "e1aafeb5-223b-4d9b-8ff4-50a7dd6d86ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441215, "uuid": "fa3d0442-8622-4c30-ae0b-f187956baecb", "value": "mynode.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f222fb76-0ce2-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1771430428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430428, "uuid": "f013185a-7a22-4421-9370-96971ee2abfd", "comment": "Malware payload (NetSupport)", "value": "01f08139b1c65b272e65401f1227d50b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430428, "uuid": "99a1c8e5-1855-487f-b349-a885f2ac6982", "comment": "Malware payload (NetSupport)", "value": "d20c3790d2050951537140a12c5f0217ef222ae1f412140fd500f3c702621b7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430428, "uuid": "5a8ed3f6-5680-4fd8-b282-6ad40bc7e1b9", "comment": "Malware payload (NetSupport)", "value": "29f9f49c29e6359d52589e41b375440a77d936dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771430428, "uuid": "10441e97-bbef-4a8b-89c1-15d692aed653", "comment": "Malware payload (NetSupport)", "value": "95f6e946508586bcff249883e5c2f667ba664ca6d25e0715dcbfd51e8ca9380a93f9df1d2ee6a580db4c3cda4ad3876f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430428, "uuid": "eebc0a1b-aea0-43b3-aac8-5a7a7fe27547", "value": "T10ED633A0A6E821FBF9EA933DC9528591C896756A3B4AC1C3C3F8D1A13C733C4657E705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430428, "uuid": "7ebaeb11-2d70-4683-87f8-b935a7a942bc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430428, "uuid": "aa1554b9-ce0f-4bb1-8587-c6c620165e28", "value": "196608:X14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorEDurH/P/XRLSq2KKeF:X14FSsFl7dCR1C99/LkuJuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771430428, "uuid": "9b4f6804-ffaf-4cd1-a77b-876c1c88901b", "value": 13413258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771430428, "uuid": "8b2a2ced-f10d-4754-a4ec-7f5177be7db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771430428, "uuid": "7816af80-fea3-4408-a97e-3c7d50a968e3", "value": "01f08139b1c65b272e65401f1227d50b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b65566-0c91-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771395488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395488, "uuid": "9fe49114-9ded-4f71-a25d-319aaaf13866", "comment": "Malware payload (Mirai)", "value": "20e20ef18fea81b513566f820719c743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395488, "uuid": "7b17b6d9-08a7-46a7-9db9-56c9bad6886e", "comment": "Malware payload (Mirai)", "value": "d3e0982498f40e230c983601a01c987caaf3b543d8b324b8f36fad51784d4e18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395488, "uuid": "ac6f823a-e5ca-435c-bbd9-24bebd32f905", "comment": "Malware payload (Mirai)", "value": "87a0410143d6c69c6a62687c2d2850a9d64d6d49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395488, "uuid": "964a387e-a7bc-4c1d-bd1e-8ba17f8b0142", "comment": "Malware payload (Mirai)", "value": "781abe72f4925b1f42ba7fb0e4903874e92945890fbf26e357a7516a974bc21cd3eff364c723e51d4dd27999974d4b3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395488, "uuid": "96f3adb1-9ffa-47ac-a4c7-6a70d9235957", "value": "T199D3F189F440DE61C6D526BEFA8E5288B3234378E2ED7305DD118AB137E7A578F3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395488, "uuid": "f4c2512f-c6f3-45fa-a461-5995aa95125d", "value": "3072:rponhnSMawukeZGZTUkcoIhsXRLmcn4Jk/KE8er9C:rUhSjwukeIZo5/sXRLmI/KE8A9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395488, "uuid": "50d8e122-f2de-4ad0-9cf2-0a61262bf47c", "value": 141438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395488, "uuid": "90daad4b-46dc-4a22-ada6-08ce573b8de6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395488, "uuid": "16564c46-efc2-4813-bb18-1bf73c53afb8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7502c197-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771406596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406596, "uuid": "de6d4749-f359-4f59-8a3c-c19d5952d824", "comment": "Malware payload", "value": "aec9e01de666e5da03e6f85a60367a97", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406596, "uuid": "edac7b62-a4e5-47e8-8961-d80a1992cc56", "comment": "Malware payload", "value": "d3fda3c213ef17d254a5ae552d08d8ef96e7217a79695146fc04e341c5cbd05c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406596, "uuid": "226f84ed-0417-456b-a218-159d84779b94", "comment": "Malware payload", "value": "06d55c2741754e9569b70a90aab6b343e12fead6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406596, "uuid": "6a9fb44c-b4c3-42d2-b74f-52478cc46d11", "comment": "Malware payload", "value": "7dd5db089140916335a2ecf32bc3b43fc3d9f9f96515158c40ba191f2086ab3f7fc05316fe1474784799e6eb0c5a2cc0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406596, "uuid": "4434cb28-c549-4f6f-8873-ee59b94c0c3b", "value": "T1A051104022F65314E6B79F7AAC3EA2218535BD25DD23CF5F0256508A48E0610E877F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406596, "uuid": "fdc5fed0-b766-44a9-b1e9-47d40eb3edaa", "value": "48:8Wx/NUbY61sZ2AYcW8hW8bw/KfMIgaRB:8a/NuI2AY8k/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406596, "uuid": "8d19156a-90f2-46c1-892b-ef9fcf4828b2", "value": 3077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406596, "uuid": "34d77d20-fe98-4cc0-8feb-34279a419a78", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406596, "uuid": "f4a05a92-2a77-47f3-a6ad-abd141c2639b", "value": "Invoice_0291.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060105de-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441199, "uuid": "8344a304-7e48-4c49-a8ac-bfdc73721cd5", "comment": "Malware payload", "value": "9b2f53d3cd013848db5ef79dbc427b89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441199, "uuid": "bcc873e4-3146-413a-bb33-1ca687d6628b", "comment": "Malware payload", "value": "d40cf9c95dcedf4f19e4a5f5bb744c8e98af87eb5703c850e6fda3b613668c28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441199, "uuid": "347f226d-c58b-42f0-87ff-52d0d88f1ad8", "comment": "Malware payload", "value": "20955ff91579e42dd8646b6e705bf27cab1eddb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441199, "uuid": "ab3971b3-1605-46e2-beca-194b4fba8311", "comment": "Malware payload", "value": "2a09ede0c1a4b82e99bc1b7786edfc0889811917fcab9956b70bfd50a0ab6e45304badca88680fe7933bb51bfee4c740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441199, "uuid": "b1ed51f0-8fef-4cb7-9aa1-7594cf37d729", "value": "T10E143B0374D189FBC4D69FB91BD795228923F8391B23620AB798FD961F0DED86E1D600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441199, "uuid": "2cf66bef-e428-4b55-a727-71eac205351b", "value": "3072:+22vGP2vQN32sif171EIy4Hqanz3Q2kDeWOomBgwmP6CiFzwPnfl+AHRBj:+22ydEVKanWO+wmP6CiFzwPnfl+AHRBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441199, "uuid": "0ec54617-707f-4ca1-90f8-041d1253ae91", "value": 192113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441199, "uuid": "6718a1b6-e50d-48e2-a012-808f01a69aa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441199, "uuid": "15055b9d-a8a0-441f-8fb5-b41b0b03cf50", "value": "mynode.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f14d5f-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439458, "uuid": "7caeb112-08ec-4fa5-85f3-bf2552776082", "comment": "Malware payload (Mirai)", "value": "25165f6399ef910096caf2cbb4a6d28d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439458, "uuid": "7d18b485-89dd-4ca5-ac38-f25040bf4620", "comment": "Malware payload (Mirai)", "value": "d4397f83b15c867e046b825e45a289fcd8136706f46d2ddfb20bd1d3ba71bee5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439458, "uuid": "09d8a526-b616-4a25-9fd2-0ce81e434171", "comment": "Malware payload (Mirai)", "value": "94bf4f4e6afaa8906a6a98674d0dc97263fb9eb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439458, "uuid": "5bee44ab-460f-4f95-ad23-1e48ccb0767f", "comment": "Malware payload (Mirai)", "value": "210ac298580408100ce92a270b7081efecb0ea45493466ec047c04d1f9149c58b1903db7356dd034ffc174d991463134", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439458, "uuid": "186eb14c-0e44-4d81-90ea-2c68371a39a4", "value": "T10BB3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439458, "uuid": "7a59e080-b5a6-4afe-b0fe-f9150cb1ef73", "value": "1536:WEkWiTLiZECcpHOWWJDmCn5Pd1Oe4avbNJnsD3+E7+TeVedVPneQBZN0126n:Eni50popXvhJns77+Te0dVPZ0126n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439458, "uuid": "f2bed3c1-0956-4f7a-959c-f4ca6f726790", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439458, "uuid": "4a8c9d39-ac01-4a60-ba80-cdc7db1f2722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439458, "uuid": "93b52f82-ee7c-45e9-aa8a-f8e257e5e421", "value": "rizzx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcc3b04-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771406856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406856, "uuid": "78db57e0-4c69-435a-b2eb-913ddb4d141a", "comment": "Malware payload (PhantomStealer)", "value": "8cf66721de15225d9145cf69d0ab64ee", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406856, "uuid": "146314fa-1e67-4245-8ccf-34ab2bb95ff6", "comment": "Malware payload (PhantomStealer)", "value": "d4a62a5b1eeec9d728e05d9ddec130eb869693839f5de401b300502cd6985cb5", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406856, "uuid": "c41420b2-2a4f-4ca1-8366-735f3f54d807", "comment": "Malware payload (PhantomStealer)", "value": "5008a80589ea50e343566a1ae4d50b1b8c34e668", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406856, "uuid": "48c82996-2279-4d19-9043-9a6efbc40b20", "comment": "Malware payload (PhantomStealer)", "value": "844f2df1bf60342a0c7cc91fac3c9a0d543d0ffb968d88ff012b2902169585a6f500ca266c2b544aad92337c780a35c9", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406856, "uuid": "24624284-822a-4ab4-8c01-fe22fb4541b6", "value": "T1FB4515A7DB0E51F4A4AB1027E549A6580CC10D8B66E10CFD9821E0D6FB87E71DFDE06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406856, "uuid": "8e8a7f19-5854-478f-8fdb-38eb073aa814", "value": "768:VaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaO:09PVqLiFjkbv2TuE8niFlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406856, "uuid": "1e440473-4c59-4a0d-b351-e7ca1034dc65", "value": 1190164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406856, "uuid": "4fa4d05b-2351-44cc-b03b-6be7a51ea1cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406856, "uuid": "1d2bd4ae-42cf-4d76-99cf-b73b16583366", "value": "8cf66721de15225d9145cf69d0ab64ee.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fd1731-0d03-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771444310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444310, "uuid": "fbeafc82-5f68-4a93-99fb-ee6831e341ce", "comment": "Malware payload", "value": "2160b84650f99b098640ec5563560c4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444310, "uuid": "b0079372-287c-4a42-aa50-7076f51d6bd3", "comment": "Malware payload", "value": "d4cca6c6920a39c29d891cc73393435655be3d644ef81a46f751d9133df928be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444310, "uuid": "e679387e-1cdb-4b8f-837b-3479e6dc81d9", "comment": "Malware payload", "value": "746f7d6ac96622fd487d6abc179ff99c32843f03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771444310, "uuid": "32d885c3-21e8-49ed-9227-72eb987cdaac", "comment": "Malware payload", "value": "92dae966f09e68f840c7f9db742e077045f7e462f4f0afd34692157d44ca732a3e4d1b861d5f24a8b291bbc589e53815", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444310, "uuid": "25305a69-dc55-40bb-80d1-3a1156982e3c", "value": "T195F30956F8819B15D5D211BEFF0E128E33231B78E3EE73129D245B307B8A86B0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444310, "uuid": "58e7e92e-90ff-4793-95c9-a82164712e33", "value": "3072:qL6voiQTpMSeU8MnlKfYfakhTpaJ6URv1dv5kus5CDCCx:q3ihZv4Kfaak7aJR1xPiC++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771444310, "uuid": "227d8ba8-4bb8-41b4-99d2-318b2faa54dd", "value": 159804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771444310, "uuid": "fe1cd074-a1cb-42f3-97a2-799b506a33af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771444310, "uuid": "fc3bf069-fcc3-4560-9da9-f5d901ed40b3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c05f19-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771423192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423192, "uuid": "2c064854-b4fd-494a-b794-c1f3463813e0", "comment": "Malware payload (DarkTortilla)", "value": "06e2e1a448faae4ab3fd2ad2bf87b270", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423192, "uuid": "85f0b99f-ec6a-48ce-82b6-bdd3649c7abb", "comment": "Malware payload (DarkTortilla)", "value": "d504607de90f26616f7421495fd472969b60ad04e591d76f16a035b83c4bf005", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423192, "uuid": "97c12459-9e7c-49aa-abca-710c1226dda4", "comment": "Malware payload (DarkTortilla)", "value": "074ed757c5238e938bd5907581cf5878d98eef02", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423192, "uuid": "48c78786-3724-4a56-92b9-a0dff29515f3", "comment": "Malware payload (DarkTortilla)", "value": "53823ff301e891f9486ff375e2a9a6e0c3617e714526837762908e441af9d8441baffa4edcde676a992eb12649d0fe9a", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423192, "uuid": "90f3cb18-5df0-40da-9230-92e296c85764", "value": "T10975E00623D85FA8F4FE9B786678402547F8BA0BD721DBAE3D8841ED5921F40DA51B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423192, "uuid": "7bf59eb6-5565-4e3b-bfb2-d45a2968e326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423192, "uuid": "a9fb2211-d0d9-4ead-a762-382d78f26be9", "value": "24576:7VzetQbOVebkLKuxjBQcvT8C28fCnRveYepqMKDmfC4KOSSn236I/qN+LR:7V+AbkLTxjBQcvASKRveYkqM3fC41p2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423192, "uuid": "6ca0f7fd-e776-4b5d-8986-c897511f1289", "value": 1554944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423192, "uuid": "1f222952-1bce-4182-8f9e-9c4e87dbf893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423192, "uuid": "d3036867-5fef-4d47-8f9b-9942763e8409", "value": "d504607de90f26616f7421495fd472969b60ad04e591d76f16a035b83c4bf005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2185bf97-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771445970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445970, "uuid": "2bb1ce9c-625b-4985-854c-aead8288712e", "comment": "Malware payload (Mirai)", "value": "1ead525c8395f2c5b78776e8ce16a1a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445970, "uuid": "19542768-f1dc-4c52-a596-878eb280fcae", "comment": "Malware payload (Mirai)", "value": "d525fc4256669f7e9f8dae81d6ad41eb3159666b559315441d57b47338fd39da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445970, "uuid": "1ebc5e3f-337b-4cd0-b8b7-6b01630cfa2a", "comment": "Malware payload (Mirai)", "value": "839665f6047f1f2022f60f67260d507b52f301cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445970, "uuid": "39424e86-188d-4030-9103-b81929ba5fba", "comment": "Malware payload (Mirai)", "value": "6eceb021301c0334a2138e3be9b046d49eab0bac67a369a9fb9771dcf41d1736f80c42110f3cb808e4ca06ef1f7e2b63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445970, "uuid": "acee8256-f8aa-45d6-9623-d7625ab2c6a5", "value": "T13A04961E6F228F6EF668873447B74925A75C23DA27E1D644E1ACC1106F6038E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445970, "uuid": "6d174e30-92e6-4b08-a80b-61cc6e4556bc", "value": "1536:ofqSIRrzimKey0oL1m6StkbkxEnISTr2VGVwIPecz1qGa0SDDf1TT1PIaBY+JsqD:z3RrmDukWq9TSVGVwIZ1qGcfgaBNJXbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445970, "uuid": "9163a75e-f59d-4510-af56-87a550a4d721", "value": 181860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445970, "uuid": "18581967-a105-436e-90b5-58349af7f86c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445970, "uuid": "ac6c337c-7366-499e-b79c-6bd2902fe950", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8fc0bd-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441234, "uuid": "0eac09e4-10c7-4f5e-a28c-9c149d679faa", "comment": "Malware payload", "value": "f4e63a6b5daa3c0edb74446954c1da7b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441234, "uuid": "c19c8146-cb29-401e-9190-633a2c32b82b", "comment": "Malware payload", "value": "d5c2018f87a1e747e80818d0dd8d5b0cac4fc077310ef5b6185d994a407da045", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441234, "uuid": "f9e8427b-bc3c-45f8-a9ef-8a6319d20834", "comment": "Malware payload", "value": "c1826a8847e952a8c0e4cc44110bf136ceecc210", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441234, "uuid": "706078e2-59dc-46f2-870b-576a74983b52", "comment": "Malware payload", "value": "0a2c83b3bb1744fee7dfdf079311c6aad9ab4657cc8fd09297b7d51089eb4eb240fb1f9cc7f01daa4871401d4fd3289d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441234, "uuid": "e4af46e3-f6d1-40ba-acfb-a5d3e7927267", "value": "T1B95182CE13E2237178417A5B7BB595E0BE4490D6A5C96A25FDCCBDEE808CE0870171EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441234, "uuid": "5f731a90-093d-4f88-8c32-121a497d74b0", "value": "48:UHb2HBFeH+eYHDTkHeW6zJHvIHR6HMJHTB9YHe7HQHHoj:UHb2HTeH+eYHDTkHeW6tHvIHR6HMJHTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441234, "uuid": "8a3830b3-99db-48a8-9a4e-d8a79421a92c", "value": 2727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441234, "uuid": "d01187bb-a869-4656-b5c0-50615d1ca04b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441234, "uuid": "c5b1386c-d8cb-4fe5-8ce0-358014b50f2c", "value": "penis.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17654aa9-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771445953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445953, "uuid": "8e90248b-6107-4735-9900-26b30e7ec465", "comment": "Malware payload (Mirai)", "value": "a913bd0e97f179696618fa5c0100fc73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445953, "uuid": "d0ff1e9e-f5be-4bb2-bec8-5f4cd1408769", "comment": "Malware payload (Mirai)", "value": "d5de0e56dc3e06ce23988b417c074e57a5482869b0d7cdf7238e479f52cd1134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445953, "uuid": "c46e30e0-b1c0-4fcd-9359-5c074ad5b841", "comment": "Malware payload (Mirai)", "value": "57ba6f4401b20768e2ec606d759dea3fbd887d2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445953, "uuid": "fd10f184-d55f-4172-b36e-b87a35ad5dfa", "comment": "Malware payload (Mirai)", "value": "0fa512b4fd012340d428f577156a60d11b22ccdc687b7c57d69092e5a156688820e9ca1661dcc23dc16cbdda95370acc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445953, "uuid": "3d473f13-d033-4901-8ab8-083292ff7232", "value": "T1D0E30946F8819B12D5D111BEFE1E128E33231B78E2DF72129D246F64778A9BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445953, "uuid": "dbb2ea40-0255-4bdf-8afc-881559e512d0", "value": "3072:HjxHwAUhXM97XM/bz4na5EueJKrdCRbc:HjVwAKq7XqbzSaxvdCRbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445953, "uuid": "cf54f3f8-dcbe-465b-9a47-50940b76cebe", "value": 147388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445953, "uuid": "20a99b65-4b6e-48ca-a786-a91f5fcb01f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445953, "uuid": "e5f84236-d020-414d-a26d-a7bdce38cada", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5b7a5f-0cda-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1771426746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426746, "uuid": "42d6a4f9-8eba-469c-8f68-371124b54669", "comment": "Malware payload (Joker)", "value": "b08df00427ffd5104c539cd2fc004824", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426746, "uuid": "ccde27f8-ace1-42b3-ac64-890d66dcb1d3", "comment": "Malware payload (Joker)", "value": "d6d2fec4042d53da68dea72a970d319c2fe88892cc77d92e4b7950aa6b06216d", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426746, "uuid": "c7eeb922-3fae-442b-af5b-2a2933005ecf", "comment": "Malware payload (Joker)", "value": "38c7244b5289228caba5e3a7c9b2603c5e159717", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771426746, "uuid": "1fe66226-5543-4dde-b7b1-f22ab9a221d2", "comment": "Malware payload (Joker)", "value": "0d80744c5ba184b857c64c2bf46145c261ecad47b46b1e13fc28e9957d24b1c93de97d77b728be3712952bc013d01c09", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771426746, "uuid": "54cfd4ab-3f42-4c7d-89ae-391c3f8ab714", "value": "T15827124EE70D642FF993EA7C489F5520F9A37C09A912CBE75510B25C4A73AC42F5B388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771426746, "uuid": "646ffcce-a131-4566-a96a-2b08d91828ca", "value": "393216:87U2VQWke16FBGveEXoO8l8K49rVOnFxPXhmC/JnJeDFMMHJJ:4KrYeEYOU2xOnfhJSFMMHJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771426746, "uuid": "488331a8-0c42-4865-b625-e2d95b7c57c5", "value": 21600788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771426746, "uuid": "c0dda980-eaff-420a-8436-be7ab17e74d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771426746, "uuid": "3fd850c9-64f4-42a7-bd8b-8e96c576963d", "value": "com.spdclean.junktool_1.3.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bfedde-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441231, "uuid": "e72c776a-9d24-4761-afd4-fcd743272afd", "comment": "Malware payload (Mirai)", "value": "674311e4259d789f8d9185b18cd9c5ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441231, "uuid": "8fb3c6ff-0ce2-4bed-a5d2-faa5cadb9d4d", "comment": "Malware payload (Mirai)", "value": "d6f8fb9b484ab4a215b0154b9aaadf60cb5c1325c562df78327405da3dd2eb5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441231, "uuid": "226255af-10ec-4191-ae1e-e2b4dcbd16bb", "comment": "Malware payload (Mirai)", "value": "6587076f7de8298f8bd1e3ad48a4ba73a5f857fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441231, "uuid": "138618de-0b7e-43b0-be74-c324e7fea719", "comment": "Malware payload (Mirai)", "value": "232483e398540e83dc405e054c7d93da3b9b804fc1867a04328efbd549418ec74fb54553efa4bc5a20949f6190620277", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441231, "uuid": "2132707b-91a7-4195-81ba-3a57bf35954b", "value": "T1EB041A02B9514F53C5C21BB6BBDF82953B336B1897EB3301EA18BEB42F4769D1E29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441231, "uuid": "ee842e4e-fa5e-41c2-8fc4-ed671402f894", "value": "3072:Cj5Vg3c148ft04T0D/O3E7oN/jfgqNo+td0m86CjpNJmwUa0cv5swA:Cj5Ss148fC4Tq/oEUN/jfWm86CjpNJmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441231, "uuid": "01134eb6-c1eb-4324-bea6-fa719d3204e8", "value": 185032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441231, "uuid": "ca328454-7d7a-4b89-9504-6bd528f3cd09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441231, "uuid": "a51a8d81-58eb-491e-ac08-24a1551ab684", "value": "mynode.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35957a25-0c66-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771376855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376855, "uuid": "8ce8031e-c255-4384-a1fc-50fa0f1a16c9", "comment": "Malware payload (Mirai)", "value": "8a437f86e9b3a11db6ebff1b0c055677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376855, "uuid": "33457ba1-8228-441d-9491-2fb4da399422", "comment": "Malware payload (Mirai)", "value": "d7bfa54c86927565e5aad2704d6b41b5b68b2970d92209df9a70c635866d6aac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376855, "uuid": "73fc1c13-e47a-45d4-8e3c-e241ee37424f", "comment": "Malware payload (Mirai)", "value": "aee126364d5c6cc89a8872631d5ab385d5b97245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771376855, "uuid": "06d836d8-5377-478b-bbd1-317862b5c9c3", "comment": "Malware payload (Mirai)", "value": "2e2d52e418f34b3849b1d4241ca853e96e9c30e723be9a13672d182084853553f013f17216fcf2946ebe871c45b5a22e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771376855, "uuid": "da0f4459-70a4-405d-bcd2-225a7d1ed141", "value": "T1A7A31956BD428F13C5C221F7F7AE02483B126BBCD5EA3142ED25BFA127864DA0E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771376855, "uuid": "34ea3c1a-f28d-42f6-8f03-a845644d0ed6", "value": "1536:SXLfshyGgcD4ozkF0Ps5g+vid5utSUfMm+DH3xTO8XFBPR8TTD48bW4LNi:2WyGZTPsvim0UfMm+r15MZJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771376855, "uuid": "be2eba36-fbec-4040-b9a9-0f7e0b90bbda", "value": 103276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771376855, "uuid": "594fc896-0f7b-4d21-bb44-e855748c8d85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771376855, "uuid": "20e6ecba-9685-4c79-9a1f-bd77422fd67a", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8f412f-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771406554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406554, "uuid": "48612ad0-fe86-439c-aa7d-8fbd30d5d99c", "comment": "Malware payload (XWorm)", "value": "5b28a848b13cf3abab80c4d6843b1724", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406554, "uuid": "cdad3d0a-e9dc-4f68-854e-0ed00d757a66", "comment": "Malware payload (XWorm)", "value": "d7f70c3813eca37a21e604b8c2d71c7ffce4d9fd01907b3f4a1f3fa17d1bba52", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406554, "uuid": "77d7df4d-9ca4-41a4-8f3f-65925105c498", "comment": "Malware payload (XWorm)", "value": "34b4f12fe20202836196ddd15e885a5e548570f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406554, "uuid": "7935fc9c-d081-4e1f-bd66-c8b70579cf4f", "comment": "Malware payload (XWorm)", "value": "f7d931f30d294cebd4973d6128462350c9dc188018596550a69e9159b700c9f834eaac871b9957d97c783fc0c6c0c938", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406554, "uuid": "3285eead-060e-48a7-bf32-12c64a4539e7", "value": "T115D30A22F709D3A90655AB602444F653FD70FBD63F622B024E07CC9B2D8CA95D6DACC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406554, "uuid": "a442a2b4-6f48-4109-83a7-bbea8b8309ef", "value": "1536:CPXZ6uSEYtnff7UTCjI9c0VvZFmdISdpjvmBxToo5Swav77sUAH703k2x0qhIEIS:CPXZ7Ys4YHX0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406554, "uuid": "579c7a07-5313-4a72-8fe0-41772462198e", "value": 135971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406554, "uuid": "816b2840-a7d4-4bdf-8237-f95835292e43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406554, "uuid": "38b810f4-fbb8-4bb0-a249-104cc333d611", "value": "lnvoice93225.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1608f71c-0d0a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771447239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771447239, "uuid": "83746289-5fe5-4cc9-ab64-5732b4fc9094", "comment": "Malware payload", "value": "e90d9f2080ef988ab6354075d620732c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771447239, "uuid": "6d9b9442-09ab-4770-ad2e-73e08b147341", "comment": "Malware payload", "value": "d8da3d999311cc85cca4bac2a82222d8da46e140b277357295e5d3f0c9891d95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771447239, "uuid": "053bb8d3-365a-4a0e-a28b-a619dfdbf7fd", "comment": "Malware payload", "value": "a14aee01c8e7548df35532813257219ce0d5f5a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771447239, "uuid": "19dd8b79-8b6b-4477-87a2-deda2d744426", "comment": "Malware payload", "value": "ad3e5d6f05606d9e67fc76eeab26c7ec67f5280ea47db9e782157fd16f4848f82b1c9b880482ea34c3eedd103b746a53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771447239, "uuid": "10692d34-bf6c-47f1-8dec-85b9d20542cc", "value": "T12B14E819AF510FBBD86FDE3702EA070539CC655722A43B3A3674C528F54A94F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771447239, "uuid": "7d616d68-dc8a-438e-bd0b-57eedbb2cb9b", "value": "3072:BqPnEij4gS41ERe8G65Q5h+Eua80ZmyR:BqPnEiX1ERe8G68mn0Zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771447239, "uuid": "cdd7b130-0195-4de5-94bb-54e499bd0f57", "value": 200096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771447239, "uuid": "41e202ba-c752-41d7-ab08-d9e139138510", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771447239, "uuid": "ca0e1fc3-db99-4abb-8aa8-650aa3a0a57f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee547ba3-0cb3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771410236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410236, "uuid": "b58e0c02-3f78-4b2d-b058-ad7efb2355a8", "comment": "Malware payload", "value": "b060bb1d2c0cfa947cfc3391a86e5755", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410236, "uuid": "dfcc53d8-5ed7-4bdf-98b7-bbe0186e2c1e", "comment": "Malware payload", "value": "d9d9f4551c6e8d326921f8b830c61e938925ed4e473f79f5c5e36c1a87238aa8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410236, "uuid": "86351cb4-cde1-46e6-bba7-42b7c82e3304", "comment": "Malware payload", "value": "486de6c5d8892e94fcd5eb6d2466ae89ec48a987", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771410236, "uuid": "440ce6a4-21e4-4212-a5f7-17a2c0ff8292", "comment": "Malware payload", "value": "9e22126bcb877083d0755d60f137232bbf0884feecea0e2d2130b6c33a58a5a84bbd2cb584df9e0eb771da9232d48464", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Sars-Letter", "colour": "#215231", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410236, "uuid": "079eed2b-bc13-4df8-b988-4455ed7e1486", "value": "T1CF216692250FBE549A9642F9F41A7906F8148C9FE26DA08097E4C89DCA54068D3CF77A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410236, "uuid": "a249ff62-92be-4589-8f37-724e1e4bff7b", "value": "24:jZjP3z9AsRkpX81K2epSUabbo0Z6pd4+RcSyy6SFBkt1itw2UegMOCJrDzN:Bx/kpM1KNclbcx6vy6S4t1kw3eJOWrDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771410236, "uuid": "2a3a9e87-47fd-4df6-9630-7f8193721305", "value": 1356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771410236, "uuid": "f46fd333-fe0c-4a18-948e-dec2d0057cb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771410236, "uuid": "c6dfdaf0-d9d6-4d6c-93fc-538bc16aa7e1", "value": "d9d9f4551c6e8d326921f8b830c61e938925ed4e473f79f5c5e36c1a87238aa8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1579c69-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439447, "uuid": "8c7dfb2d-2650-4b54-976c-0eb75ff8a516", "comment": "Malware payload (Mirai)", "value": "41a9eff51de774b63c2d8f27b0dd3bed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439447, "uuid": "62669a98-89cd-4646-a0eb-e8f48200e95c", "comment": "Malware payload (Mirai)", "value": "dadcac7576401459f1c85653339ef449922eaf39cd3e518bd4b16815167ee6a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439447, "uuid": "f38ae607-c02f-4431-9111-fbcf4da6b714", "comment": "Malware payload (Mirai)", "value": "21f816a1946903723aea3cf1fcdf5504e2281660", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439447, "uuid": "950d09f5-f603-49d3-8758-2f8b5b26bc14", "comment": "Malware payload (Mirai)", "value": "42bcddbc25baf856745a1f358d990947307df98a6ff98305501b06837893c511e8a083edd09f26253ce001cb4a00e4c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439447, "uuid": "423e7ffc-3680-4f5e-a26f-a7a3e4f03804", "value": "T1FA432781FCD2996EC2D4137AA73E358E33A1B3E4D1CA3613CD585B25338A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439447, "uuid": "6913ce8b-621b-48ee-92d6-cbe06acd1d3b", "value": "768:DcyddNgnu8Hkf/StW30QoyPEFMstBp5o7uS8kTIMwcLr6IoNcitKMfg3BNpTWnDk:DsnvHk36AXvEFMiolcMjLr6RtK79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439447, "uuid": "bf89f04e-cbc2-4892-a051-ac3777d41925", "value": 55880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439447, "uuid": "95faf7ee-e419-4705-8f71-6eb07253257e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439447, "uuid": "0cb73106-603b-49de-b152-f4eb096859cb", "value": "rizzx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b529a6-0caa-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771406361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406361, "uuid": "77c7cd3d-cb58-491c-92ab-80d9905a20a8", "comment": "Malware payload (Formbook)", "value": "8b1985af6ae16474d43e528e1ea4b6ed", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406361, "uuid": "7d589077-ed19-4d97-b98d-cb06132f39f8", "comment": "Malware payload (Formbook)", "value": "db8787c52a162ac632fd194085432fb43943dd3e80303e8213ddd245150ee9f4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406361, "uuid": "e21bb65e-f684-4eb4-bf26-3bdaaf40ae2f", "comment": "Malware payload (Formbook)", "value": "a9963bfa2b8f79f82f7c2809eca234db4da96093", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406361, "uuid": "fc67f81a-4527-4f9c-a727-cbe5f22341e2", "comment": "Malware payload (Formbook)", "value": "a6a9fd2b7a85c00c4feaa14109d5660be9c3b352bdaa261be5fb373984d05028c9d6876c3472c850d1122db03a4c4691", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406361, "uuid": "ca7b0db8-e84b-4714-8e34-b6b6256a2a5d", "value": "T1D13512F1729586522E78EA8473E08E91AFD375CDF73A3E8CF8A1549092097D6C658C31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406361, "uuid": "38c017af-e01e-44a3-ac2b-13f328d4c2c9", "value": "48:V777777777777777777777777777777777777777777777777777777777777773:BPZTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406361, "uuid": "bb59ad01-a5da-4dcd-9b5f-6bbbb85472b7", "value": 1156819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406361, "uuid": "a858ed75-f8fd-4cbe-9bf5-04a69e9e73fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406361, "uuid": "0c484f80-69f2-45b5-920d-190e83d2b08b", "value": "Tranferecia.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169bbc6c-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433067, "uuid": "b99168b2-876c-4514-b55c-6acf2cf1b234", "comment": "Malware payload (Mirai)", "value": "538b385c9374274098318a4076b65ddb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433067, "uuid": "6b23e1e8-2392-4c15-aa35-790557a9317e", "comment": "Malware payload (Mirai)", "value": "dbc513133d93b21bb64b91866cc7031187217354b51215b8c134ef44a8150013", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433067, "uuid": "5e342c2e-e7b6-4edb-bbbe-110ab218ff9b", "comment": "Malware payload (Mirai)", "value": "a9e6700292c3ced170df75adfea7960ecc67ff53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433067, "uuid": "1d629157-0ccf-4f7d-b7ad-991403add932", "comment": "Malware payload (Mirai)", "value": "c400776440e2146747aee4c80b590de6e4ccd3b149c9c40cafdee99471641a1018b73ed21accd259720a9efff986c830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433067, "uuid": "93ff245a-596b-48c7-9502-0ca96c030dd5", "value": "T160934D49F753E1F0DD4606B0116FB73D9674EE224024DE69DB94BEB7EC32A02A21B61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433067, "uuid": "bba0c84c-585c-40d4-bb31-c73afa15c955", "value": "1536:6b+jK3iQd3q2A6ausTZlMvDCypOkn/OhdtIGDT9Yjr6gUJ31IiyvCar:XYta2BtIlMvDnOksvTygSi0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433067, "uuid": "d70a2bc7-7234-4a25-b9bc-c5a08c1bbf6c", "value": 96680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433067, "uuid": "d1d201a0-4312-4c1a-8a19-4c177c553590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433067, "uuid": "9aabf73e-35f6-4205-a110-e74df53237d2", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fce0d4-0c91-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771395486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395486, "uuid": "75372195-d21b-4db5-894c-b1efe9717856", "comment": "Malware payload (Mirai)", "value": "69b4a6e6a1f40390b4b1fe0f5a581e8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395486, "uuid": "c679478d-69d4-421f-9fbc-4f42200830e8", "comment": "Malware payload (Mirai)", "value": "dc5934287df5b3fb29a6d55cc452afb99954825879705ec68be63f1c92b4fb7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395486, "uuid": "10ee482c-a481-4852-870e-b18452c2d844", "comment": "Malware payload (Mirai)", "value": "64c952fcc8c30f32fbe82d9f7e5335f82d7b38eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395486, "uuid": "25f880f8-746b-45c0-9c51-e36674c14553", "comment": "Malware payload (Mirai)", "value": "6b050c12283efa369c4e07dfdf4b3d22923895cc1cedea6bd4c6ca2ff80ddb2f9a403cf9cdbbdc2ecbab891319742fa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395486, "uuid": "9b0a520c-98d0-4fbc-92e2-e26f4df6a2b0", "value": "T10CD3E098F450CF32C5C1257AFF4E215573170BB9E3DA32168D289F3477B672A4E26A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395486, "uuid": "96c0d4bf-6604-486c-9627-c2e5e2451088", "value": "3072:foTTImvmBwcuNxkKs8/1EuZ8mePgMXcOMMtVutEvXggs2pq8V:fgIwWwp3kKXEuZ8meIMX30tAXDvU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395486, "uuid": "94bb9f72-3c96-413c-b188-b674ec5ca9c8", "value": 142184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395486, "uuid": "35a60ef6-7da8-40d2-a9eb-7ee6a80e3148", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395486, "uuid": "230c2c8a-5e97-4c50-ad76-e11ff3c1fe75", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24581c3-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441596, "uuid": "538e07b4-ddfc-40b6-83db-927ec84683d6", "comment": "Malware payload", "value": "bb4f1f525b93b9fe90802d46ed968099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441596, "uuid": "967ac02d-5d0a-487a-8241-eea57daa06fa", "comment": "Malware payload", "value": "dc83972f4fbb789d3a89325474f1c9529cf6795545c23d10aa18715efbeccb98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441596, "uuid": "1d1a3971-9c49-4e52-acf6-6574f75d7f6e", "comment": "Malware payload", "value": "c57b286adc56d68883b34f4397376d1b31b5b172", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441596, "uuid": "4cce7c9d-5f36-4bdb-9e64-c7a011965f24", "comment": "Malware payload", "value": "78ff8d52ac330d1ae115d0ac447d98248dd838041a9923424ef8748481a591c61f00e6c33b86f377dc860b689e6ceb42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441596, "uuid": "665b5be5-dcfb-4f32-a8c8-3e07b4ec0f47", "value": "T1BBE45C469F490FEFD85FCD30462E43272AEC9D8B62E6B73A557CCC487A5A6058AC344C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441596, "uuid": "ef34b90e-2083-46d4-a6ac-f26ca64d3174", "value": "12288:AnbhqxC+XxjMNVIzxHv3KWn9KXzJalwa8nVH+j38jH9Zx32ewrSNRUb84BBi3eOR:ybXOBueO6FpKUenq30A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441596, "uuid": "112083bf-0058-4185-8f89-fac063511c6b", "value": 683760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441596, "uuid": "651a3ffe-ddd3-42e6-ae8c-057042a9e03c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441596, "uuid": "4ed4252c-fe72-4551-88e1-efdbfacb0a7b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c7fae9-0cce-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771421603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421603, "uuid": "63052c06-2058-42f7-a1ab-19790421681c", "comment": "Malware payload (Mirai)", "value": "e6c49093b02a9a1c89503348294f74ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421603, "uuid": "1a49514e-2138-4cc4-b5d2-f4f0a585cac0", "comment": "Malware payload (Mirai)", "value": "dd27f5d9e42031fd70de3bb4d0e4f05383f7082f040b94b67d9e55eeba3eb6e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421603, "uuid": "bb623577-3297-4e24-b230-58b28bed3843", "comment": "Malware payload (Mirai)", "value": "48b50682725f6970baeb6e70dd5a68eea92e123c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771421603, "uuid": "ab46eef8-c372-4f01-8aed-b1426ab97b46", "comment": "Malware payload (Mirai)", "value": "cc4d8e90acd0e29b47daa49ab0639979e21e1e8a257a8959a82558e2f37b14d55748539149b83b05432e4982bd885d29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421603, "uuid": "ff1d4169-be7d-4484-9cd7-bba526503bfd", "value": "T1A0B3D91E6E21CFADF369C23587B78A21A75833C626D1C685D27CEA011F6034D245FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421603, "uuid": "314a30c5-5367-41a4-8396-536be23e252f", "value": "1536:071cSXpDd5Ncrg1ntj4YVIwxKCxKzeK8CXYqrQuFxhrdnHDeCWWyEWNn3Ull:61ZZd5NcrdpzYqrQuFXdnHcWyEgn3U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771421603, "uuid": "0e96518a-6021-4bd6-b17d-a377402a81bf", "value": 110388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771421603, "uuid": "1bf7260b-5675-4c47-8df7-eaf6a650c312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771421603, "uuid": "b6d4178b-3c48-453c-a32a-4efc57904e7f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ec02c5-0ce5-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771431368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431368, "uuid": "b6f5d062-eccc-43cd-8bca-54f089bac11d", "comment": "Malware payload (XWorm)", "value": "47f7af274c8c61e2f1c2c277a82f123e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431368, "uuid": "b50f69b6-5ced-4e98-888d-71a600c2c44b", "comment": "Malware payload (XWorm)", "value": "ddcc8507a3e108372012886a8cc1d9dd56f962ef749132bebdddaea8f1697e9a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431368, "uuid": "61c15b2c-2e6f-4df4-bbf2-7200a9d20695", "comment": "Malware payload (XWorm)", "value": "b77029cdf17f17dff8ce850524b06c0c064e6a3e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431368, "uuid": "f40d0f3e-47d2-4640-a70e-ec5f42945c54", "comment": "Malware payload (XWorm)", "value": "f69d0e9efbf373481bc4abdbe97b900dec9e5e39234db7f723ae3d442d0a699b05378fcb079b9ff9985dd473c7252656", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431368, "uuid": "53faf8ef-1a8d-4575-b56f-13faa4cb3f31", "value": "T172F4126B76E630E5D132467AC0168406E376BCB05B505FEF17AC82252F2B2E16F39F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431368, "uuid": "63412372-dd68-47ea-8a27-235532faafdb", "value": "9c600d92f62d19ba4861fb963ff0e2ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431368, "uuid": "673c6fa3-7e8c-461c-8672-50ae3a71b196", "value": "12288:Cyrhy0w1Arw+FsbQLGo66oqKP23QkwLsij2w9iG5/+qyA0NRWGh3zEV7Bw:5Ic9h6PJz22+RBh3zEV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771431368, "uuid": "3ef5ec82-8875-4c08-8159-9f23d822e4c2", "value": 783082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771431368, "uuid": "e13c6d29-36e0-4b5b-b9eb-b8393667c12b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431368, "uuid": "eb6a7f47-08d0-4880-9543-8e1d63f20eb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a83fc4-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771406537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406537, "uuid": "503f4575-26a3-4876-a317-e78bd67c1ea5", "comment": "Malware payload (RemcosRAT)", "value": "421c3e0f20c297ed1b8359d71d549402", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406537, "uuid": "403b243f-95a0-452d-9a87-d57d03952e33", "comment": "Malware payload (RemcosRAT)", "value": "ddd4144ce382b9c770a419f6051362c33c8ad5fa778d3de8879f3cf10710dbd3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406537, "uuid": "805acf1b-fbcb-4323-89bd-4a30a2069a24", "comment": "Malware payload (RemcosRAT)", "value": "08cf808e7e204c10d24acf4da081f1e547fb13a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406537, "uuid": "64e448f7-6140-4b97-b1f3-ffe996ef7d8f", "comment": "Malware payload (RemcosRAT)", "value": "2574ffa657fedad2fd8a9d8205063303205661171a377dbf3b0d3beea616118dd5091da6358688b52d8c68702cf1b403", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406537, "uuid": "c8e2e3d6-efea-486b-9a31-df3d883ebef4", "value": "T12845153E822640E11DF59E98BC9D33CABF4C765420669F5E6070D6FB6AA1424FC383D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406537, "uuid": "ef4a8aa2-5252-4d07-8899-083a2b038b78", "value": "6144:J2QJeT/1TtGjC9KrybmSLdgglpEGGrTY/3sjvNan8/DS:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406537, "uuid": "685afaae-61b2-495b-90e5-ad9aea58ae4e", "value": 1167582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406537, "uuid": "f9f621c4-5d7a-46e3-a125-ccdbec2f1e88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406537, "uuid": "c5d87b40-63ad-4c9a-9997-2ff0228fd4dc", "value": "Pedido - MS-Group_Xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b493c8f7-0d20-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771456954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771456954, "uuid": "c6a358a5-94d1-4013-9392-e4a8e06ba9d1", "comment": "Malware payload", "value": "b30ac870390a08e0497016dc594d8cf9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771456954, "uuid": "a9310953-ff7c-4619-9f64-9c63bee5af48", "comment": "Malware payload", "value": "ded8ea2058400dfa49683f78d7cbf3f1cb0a34e8efb8c0edbe61aed708eabbfe", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771456954, "uuid": "c333d30e-c59f-46c7-adec-e38c7d6eb1ef", "comment": "Malware payload", "value": "6a99cfd46f9a7d3265a596825a30d7e1c27afda0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771456954, "uuid": "36fccb28-7c25-4af1-ba7f-ca3559ef990d", "comment": "Malware payload", "value": "abeca420ae8b2632372e3cb143d309e627635b4b1e04b5e85832f374e42e5ca9f8f3aace29ca6a161a16b533944cb21a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771456954, "uuid": "6558f5d2-793e-412c-9b01-b515e95773e7", "value": "T1E7823C0BBC104139F4C144B89236A77E8DB998BA375569EBF3C044CD89785D2F43A91F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771456954, "uuid": "6d9a7842-9c21-4f66-aff8-b710148c1e2d", "value": "51c161c9913a4b650517329371c6046d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771456954, "uuid": "098e7ce5-a026-4eec-a0ad-2b41e5d80005", "value": "192:Rr5i47Pnbeng7GQxt/vFc4DmTcVh0rQZeaymJo1KUSh+zwzw0SJxTopHB9cth+Ra:5n/tSsLh0rQ4ayLu+sdScpHB9cIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771456954, "uuid": "a006abd4-d9bc-4144-9031-fa7e00c33b4f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771456954, "uuid": "1bf90c4e-a6ca-4c2a-abcc-c907eb98aa6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771456954, "uuid": "db32ccf6-a465-4769-8420-8ad4baafb85a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14794411-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771423185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423185, "uuid": "dfe15faf-1e29-430c-9ac2-cdf21d3c6240", "comment": "Malware payload", "value": "31edf8b960ae4dc8b70117083800ed1b", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423185, "uuid": "f6c99260-6116-4e1a-b094-1c73c4473e42", "comment": "Malware payload", "value": "df14d36205877da29506fbf21634c91c97ccca110ad0349e67c7165f287fc7a7", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423185, "uuid": "71c2d632-985b-4599-9f34-509667871377", "comment": "Malware payload", "value": "df48049694a6907949cc68f51f24f48e577af103", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423185, "uuid": "30fe9dba-64f6-4da1-b16d-0a456c88321d", "comment": "Malware payload", "value": "5b32a0e3480914a516b5d1b554a66a3043be563531577b5a35f224055215eb4e37576e4c2cd7d0793c4d276400ed9702", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423185, "uuid": "73e357ee-dc4c-4fcd-bce9-c468814abcff", "value": "T10265E00A13E957A8F5FE9B3C6779042443F0BA1BCB21EB6E794941E88821F47D952373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423185, "uuid": "aa58c6fa-245b-441d-9087-015a6d16d79f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423185, "uuid": "cac78319-32db-4131-822c-67848fe8b3c5", "value": "24576:q3st1d5R43L6c/rFCnRveYepqMKDmfC4KOSSn2p6+VIy+:3t1d5OBARveYkqM3fC41p2XK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423185, "uuid": "c03da9ca-a84e-427c-a565-3fa19ecc1bad", "value": 1436672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423185, "uuid": "beb5318a-b3a7-4072-9c73-4d6fe7777a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423185, "uuid": "247eda30-8005-40b3-a5e6-4c0832604b39", "value": "df14d36205877da29506fbf21634c91c97ccca110ad0349e67c7165f287fc7a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be43bcac-0cd5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771424758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424758, "uuid": "c26ef058-8720-4f48-8320-c7a1a652b888", "comment": "Malware payload", "value": "bc4487f8afe350d5c82f6634a7338a88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424758, "uuid": "86230c4d-bc6d-4bd8-9b25-65eb5f40bc07", "comment": "Malware payload", "value": "dfb019406aba31f6677d7ad9d63feea0031f4edf168a5fee258fdb45fb6419f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424758, "uuid": "ab39bf73-a396-4498-abef-43bc1bd53eee", "comment": "Malware payload", "value": "88cec5a9eb942c745ed860bccea669020c4f23fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771424758, "uuid": "c908f907-2053-4982-944f-cbce1d5f8a8d", "comment": "Malware payload", "value": "cf164a8ada7edfdb5c5a82ad5bc8b826238bf53ec5e89e97f06b5a14248fbb8a3b77f48e24f960f496a80ddd8a77d34a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424758, "uuid": "5f07a4ba-4d7e-4ff5-a958-331ff4c46114", "value": "T103A46CD5E6D7E0F0F56704F0102FEBEF5935A1368016CDFAEA901962B471B916B0B22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424758, "uuid": "2b325701-3f61-47bc-8986-ea6d4594cf3f", "value": "6144:eIYFlaV9TYxiegL+8uThpEvhYi80XUcwIx507cdy77cRLl+GYGU416e:eJaV9TaGQhp2h81cwIxO7CLaD416e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771424758, "uuid": "dc8bfc8f-0ffe-49c9-ac9c-5072110e9b71", "value": 457174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771424758, "uuid": "cc92d6c2-c3f1-4197-88ef-98bfc9fde978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771424758, "uuid": "b3533162-2f8d-4c04-bb2b-bf3f2d9bea55", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff98ff53-0cca-11f1-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1771420143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420143, "uuid": "81174997-f48a-4b64-9ad3-2309f15f7905", "comment": "Malware payload (STRRAT)", "value": "e56f2d02667b59b41d140565eaa4bb9f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420143, "uuid": "da14e573-1f7c-49b9-ba27-744073ea4bd1", "comment": "Malware payload (STRRAT)", "value": "e03c5c98a9b3e82353fdb4e8e92464678b73cd933fb21e2c753697a916d4737e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420143, "uuid": "706b6f8f-142d-4c5d-8cf3-5b38c1d45e44", "comment": "Malware payload (STRRAT)", "value": "570f2a197f8041920c2a5247723644a550eae0a8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771420143, "uuid": "e62cfc2c-9571-4d1c-92a3-ae7bf77c6a32", "comment": "Malware payload (STRRAT)", "value": "8977d89d2dddf3e323ee4b208ff85181e0c167494749ab368c5be8f448d4f5a10e78ffb79230a3ac4d15137ee4eb184d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420143, "uuid": "c2ea277a-63ff-4f99-96df-83ab3f5fd2c3", "value": "T1B65383467B40D4B2F733B1720A5CD20EB9B5E4FF926561870EF0ACEDDCA98484F52A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420143, "uuid": "d30692bc-096b-4f41-ac5d-fc146cda0334", "value": "768:1p6yB8HEDWQ8mhAHAWHHDjTHjMcLLWxGeh4kSHSt0SD0O9rn/DIlGV:qyBUQsAWHHHrAcLLqFhEytsOR/DIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771420143, "uuid": "fe125ab5-7c39-4f0a-a17b-7a9611a6e401", "value": 63577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771420143, "uuid": "bdea31ea-cef4-49b1-8b08-4c02f7c5a300", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771420143, "uuid": "981d6693-7b88-424b-a515-c44262eaf87b", "value": "sample.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362ee050-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402196, "uuid": "a6a244b1-b1b0-4c54-96d8-5362524c2523", "comment": "Malware payload (Mirai)", "value": "d6a3cb92c4b6a52d68e8a7326e9188ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402196, "uuid": "3a8d7201-f3dc-4bdf-bbb3-10c55833d22a", "comment": "Malware payload (Mirai)", "value": "e0cf5e22f26ad92af04d47b7d6f0cfabb1ca995d494de0c20eee78b2291d0e2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402196, "uuid": "a61256d2-a472-4ec6-b3a0-1ec7d2ab5c35", "comment": "Malware payload (Mirai)", "value": "8efd2265124823697e6aa2df9a13c14c31da59e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402196, "uuid": "87809ea0-dc9a-4121-aa4b-623f240ab26d", "comment": "Malware payload (Mirai)", "value": "198a15dee5d4a6dca16e0f7399b4e3435fda5a2d624cdb07519cd469d34942ef0b6ac45344498a68f1f78ea7c6ec0c7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402196, "uuid": "de602614-d177-4fc5-9e31-1136d64007fd", "value": "T1AFC39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402196, "uuid": "e05c6d7f-da2e-4e08-bf76-c0c8ecea25ab", "value": "3072:gf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4/qe:gf0tJBR4NSALD7rnCrheiUqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402196, "uuid": "9f64be5a-f1c0-4cdb-80c2-800a7e2690dd", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402196, "uuid": "c924e762-fa83-4977-b6d2-15c22e92d7d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402196, "uuid": "d8b28da7-c34c-4edc-b113-2993a901e94d", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cfcc56-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771445975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445975, "uuid": "1193dcfd-d151-4a77-ace3-a5859c803836", "comment": "Malware payload (Mirai)", "value": "3cdc93c14ef667903aace8697ca2de23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445975, "uuid": "cad3b68b-5ad3-4f3e-bf6c-64fb6deb4b34", "comment": "Malware payload (Mirai)", "value": "e15487e23ae34d79a52fda51a785e23ae1b248ccd88efddc4c44434e6d1ea244", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445975, "uuid": "19e58d20-725e-4163-afa8-36c99260b81a", "comment": "Malware payload (Mirai)", "value": "91541d15447271ef410430a054843e0462640974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445975, "uuid": "c8867fe7-6386-4b80-a1df-766d9c9f70d7", "comment": "Malware payload (Mirai)", "value": "4a5c63244c8b5a89cd0a90890ea59aa1563cd9c97609edc16ec1f9bc01b82f0dbbb99a9b12cef342d523c5bbf87556bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445975, "uuid": "80fe42b6-c1fc-4195-adfb-7ff33c5a0a39", "value": "T105D32A45F9414F23C6D112BBFB5E428D372A17A8D2EF72039D256F25378686B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445975, "uuid": "f7b1b0ce-9f20-424d-8342-a8a8bd002d79", "value": "1536:eW3+JAXM5fh2RRvqujBgF83AxM54VMtb4TjxB9DSxVAOBwWGFytCIv+TljFwywPj:eW3hSw083j4c85B9DgIDGrICb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445975, "uuid": "2e5a5a07-599b-49ca-9106-1edc8027ac8b", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445975, "uuid": "3bbd1a9e-67a4-46b1-9b8b-3adba781d52c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445975, "uuid": "614362ce-69e1-465c-9108-d5987ab5d6a9", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318865ad-0cf9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439984, "uuid": "f7173085-06f1-450c-843d-4738c293e115", "comment": "Malware payload (Mirai)", "value": "37fbbf34b1a796c5f04175e7af840740", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439984, "uuid": "fdb2565f-62a4-40e5-bff8-c29aca9b2203", "comment": "Malware payload (Mirai)", "value": "e177744f3dda593824a30684d0eec423e0218e3b936a377d586384e049f70ea0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439984, "uuid": "02f73e7b-5e6a-4bc7-9a6c-978f6e978678", "comment": "Malware payload (Mirai)", "value": "fe505c055a148de500f63839168596690020d678", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439984, "uuid": "2eaf6fe0-64b9-443e-b2c4-b580b18cfd09", "comment": "Malware payload (Mirai)", "value": "39dc4ac24d4a672552e8208b41ffeb36fdd567cd4614f66f4e2e039b8be15a2d1065483c9c9762414e8caa7d8d202f2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439984, "uuid": "e2d48d9d-044c-44c3-a109-252841798d4b", "value": "T1E8E32AC7F800DEFAF80AE33648570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439984, "uuid": "935b0d31-b062-4b64-b4bf-d2f2632d4208", "value": "3072:GmzTDH86JA78HenJljAX0Gidw+w9EEVvjbiQLZrEyqKYXf:G2TDH86JCHjAX03dC9EMLmyqlXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439984, "uuid": "4e2ca2f9-52e0-4388-82cb-f43d4de24024", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439984, "uuid": "a4d0aeb4-755c-4ef6-95da-ef5f7ddf617e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439984, "uuid": "89e35b63-b03d-471a-9146-679fad9f57ec", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0887b404-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771440774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440774, "uuid": "97808f32-32a5-4a74-ae5c-205ef5492dc4", "comment": "Malware payload (Mirai)", "value": "7ac8e6a860d9a2a7d3bf9af311e844a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440774, "uuid": "b9bb022e-12f0-4986-948e-cc83ee571526", "comment": "Malware payload (Mirai)", "value": "e1ae64596c26b831799ce32d5fa7592d0f294559eb3ad64614f027f81598f822", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440774, "uuid": "e67511cb-db7e-4ee4-8c97-4583d12ff6be", "comment": "Malware payload (Mirai)", "value": "aedd33cc49654a7e082efe021c9a2b283d804a6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771440774, "uuid": "eea29ba9-51c8-46cb-ae9d-6443ed623f80", "comment": "Malware payload (Mirai)", "value": "5d8a3057d95a245f6725c157b83870c3f84ca4b3170c115c4055a54d9e3893d932623e4a2689c5320010c83b64558d62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440774, "uuid": "4b5bbbce-ddf2-421d-8f4a-f297c53b3698", "value": "T1FB730A826A43DEF3E85710F502B7EB365A32FD3A083AC5C6E774FCA15A515C0A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440774, "uuid": "bb2de445-9f2d-4b5a-8bf2-31a437053e17", "value": "1536:Rcz8Mfl3USRL+r97S3Tl9ffUr9sFC1qs3vLJ7LZaA14B6Kk3u86g:RcICl3USMsTl9HUrS6qs3TJ7LYK4fQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771440774, "uuid": "203d37ee-d6d7-4575-9bb5-1637efffc777", "value": 75592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771440774, "uuid": "5e8c915f-95a7-4cc1-8350-be8a03f04cd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771440774, "uuid": "a7fed006-3776-49d1-85ac-9f6652f549bc", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b4debf-0ca5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771403834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403834, "uuid": "3f47deda-f21d-46da-941b-8bece51fd9e0", "comment": "Malware payload (AgentTesla)", "value": "9378c732db92241f37c8518c5d4906dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403834, "uuid": "7fe95bc6-911f-46f6-99a2-8a4fcdebb4a1", "comment": "Malware payload (AgentTesla)", "value": "e227a7846b4a3a030c80545620e21e68e9a3a01396cd33f31e7a89544c107139", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403834, "uuid": "99937336-e45c-412a-a90c-70320649f4b1", "comment": "Malware payload (AgentTesla)", "value": "d1e1a4c5ff6b6755702203b84f2b791682b9dd36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771403834, "uuid": "490ad287-61e9-41ba-ad8a-f6f21ff51c08", "comment": "Malware payload (AgentTesla)", "value": "2ba2c950724108117c23678d8ac6421c2e7831a72322e10b6630b6c1b946bde39ec99fe9e167af89dbee37a2822c5884", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771403834, "uuid": "786f8dc8-8776-4377-86db-a8c7dbab25b2", "value": "T17835F5898A738AD01BE11B4F6149B148EEC9A0A0739B4C61F6DE65DD77432CCBCF95B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771403834, "uuid": "1c6d7fd6-f14f-4c42-b945-2cad72236eac", "value": "384:hUnspI0314cQnolWpyi07hpJBYTZVfUH/2h0mF6VUr0hqN5tpsK:hUeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771403834, "uuid": "e5782efc-ca77-4693-8a96-ba76d74b781c", "value": 1127973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771403834, "uuid": "cd831484-7a6d-40fe-8c69-6c1b2135a29e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771403834, "uuid": "75bb17f4-5e40-46a5-82b7-ca0738987bef", "value": "9378c732db92241f37c8518c5d4906dd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba287f17-0c67-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771377506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377506, "uuid": "1124489b-5425-418e-baa2-c6607ec689cc", "comment": "Malware payload (Mirai)", "value": "86b9e0790b3422d36862d3d58d1764de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377506, "uuid": "a0ba347f-fb5d-467f-a3c0-db2e559c6e45", "comment": "Malware payload (Mirai)", "value": "e34958f69c8d73f39a0994876778151d011f5ed08350edac2b988074f9ff5ef1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377506, "uuid": "bad51854-914c-4a9f-b134-8e91658eda99", "comment": "Malware payload (Mirai)", "value": "1f4f7d37cfadf051efa037364188d0bc3eb479da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771377506, "uuid": "9709d538-37e7-46b3-9edf-2a6778484995", "comment": "Malware payload (Mirai)", "value": "d724dd4411919b25ebab5fb7653913bb19db098cee82d1026b0fc0a0439e9c91a743b812853f123eaba81708b898292e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377506, "uuid": "12a0054c-fe32-46b6-8f23-37e247abaa83", "value": "T153043C53B7324FA0D365D2720BB38B595AEB11811EE198D1936CDA103E206F9689FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377506, "uuid": "21a1f911-e1fa-4aa8-a4fe-01f45cb7cc88", "value": "3072:knxBHuJGy2nb5G+Y/HoWSc445jYt4v5JnF/6pjOZepbq3:kxJuKnbM+YrSc4KkKvnF/6gZIq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771377506, "uuid": "99821ab6-21d4-4f30-bb15-8e2a9c04b8c0", "value": 184960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771377506, "uuid": "71109913-6afa-42a0-ad05-ed8bfaec50e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771377506, "uuid": "4c384215-79ab-40b2-a881-07fe419228ac", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bda5ec7-0cac-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771406849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406849, "uuid": "7443c4c3-72db-4090-97d4-26c143985a31", "comment": "Malware payload (RemcosRAT)", "value": "be333e5088bbdd03baa54c8f331d847e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406849, "uuid": "cf5e2b76-8119-4373-b080-ed96e796867d", "comment": "Malware payload (RemcosRAT)", "value": "e4068a49fdfedaa08a46285c4a49f591a4a4e1eef8990cb9a501c1637a36dd67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406849, "uuid": "5989e5b4-568e-4f21-af25-a4ddd8ad5530", "comment": "Malware payload (RemcosRAT)", "value": "9c2c9681e3655d87c1ce7c586a6ab2333ad143e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406849, "uuid": "3441a573-7157-41c8-96c2-9c64e4552263", "comment": "Malware payload (RemcosRAT)", "value": "5b8c8e9d7fd73b478d335b49463be48d68bbe24b8ed8766bf490be1834aa749efc871e1d164e824a9ff6e609c01f7048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406849, "uuid": "117f96bf-da41-4209-97e7-094c3bc51b7d", "value": "T1557512102B2ADE02D0A60FF41A71E3B44FF96E46B511D3039FFAEDEBB4267512945293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406849, "uuid": "a9384072-8e30-44a9-b5c6-489d483a97f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406849, "uuid": "9ce21b69-b7f0-4cb0-8952-700c8e3bb1ad", "value": "24576:Nqu2VoJs80hU09R1IdqV1pZdCGjH3u2DS7U0nxcWz2kQIz6cUYCmAzq:NeVEs8R09RyyHdC83uySncstz66lT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406849, "uuid": "45f8353d-14d6-44fd-932c-8dc102164025", "value": 1584648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406849, "uuid": "ef5651f4-d84d-47fa-b86a-96ded12cb495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406849, "uuid": "4250361f-084d-46a3-ad6d-3673b1598858", "value": "TEKL\u0130F TALEP _27803 _3423 Siparis IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d34e997-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433078, "uuid": "483cab3c-dcff-446f-9655-45165615b9ff", "comment": "Malware payload (Mirai)", "value": "c90e5c466b0598aa08ed4e327a8f8541", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433078, "uuid": "d3800927-f842-415d-8503-b3d0ef7975f9", "comment": "Malware payload (Mirai)", "value": "e45776a46841d0f5e09e577998ecffa44862def0540a992b75f113b12037b65b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433078, "uuid": "ce3d2cd4-5f86-4755-b472-0d1326ffdce4", "comment": "Malware payload (Mirai)", "value": "cc2543ea705de315eed86aa25acb1e5b54f43330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433078, "uuid": "e11b63ba-13e3-4915-82c5-85ec8eb08499", "comment": "Malware payload (Mirai)", "value": "f8929a563a24c0b7fba2333f5ea2474f6ba435420670aef463c6e9455cac621b0c97bafd1e5b26d16010fe46aa191aed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433078, "uuid": "d174d204-e102-425a-98b5-396f15d3bddd", "value": "T19DD36B77CC266F58E525E5B1B0318F791B53A950818B2FBE19A7C6788083D8DF6063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433078, "uuid": "a7d86f93-dd33-4c83-b501-ed442c327190", "value": "3072:cHGWR6GnPBdFLipEAIepiG4MBW/F1A7tEu:OGWR6Gd1ipE8wMM91CEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433078, "uuid": "216bb5a2-c5c6-4285-ac77-74c88237d981", "value": 137980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433078, "uuid": "f22f00f5-1ef1-4169-aaa9-5b65c0915e0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433078, "uuid": "24d02114-9665-4add-b197-cfb3eae91e7a", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a73dba-0cdb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771427086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771427086, "uuid": "acbbb822-d86b-4fcf-8ae3-ef2efb76d4fa", "comment": "Malware payload", "value": "30d4fc258aac768d5b4583078ef532b0", "object_relation": "md5", "Tag": [ { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771427086, "uuid": "cdf61a5e-819d-4db3-80b8-ee15fb4317a0", "comment": "Malware payload", "value": "e45b92aff9c9fdd7b46b738273a1d1cbe91bd4c90bef48280c7fbbc68fc18b28", "object_relation": "sha256", "Tag": [ { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771427086, "uuid": "4c9ae7e6-18bc-4ea7-a038-314100b95850", "comment": "Malware payload", "value": "6a4aad847d70deca0d88cf44a767817dd529fd44", "object_relation": "sha1", "Tag": [ { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771427086, "uuid": "c49a979b-64f1-49b8-bdcc-7e4d688c8bc3", "comment": "Malware payload", "value": "5796d38f5331c21ab85a21209674e1e38527cebf9116e0c05ef8bc067ad4556878ef074a1798560c51aae86821991296", "object_relation": "sha3-384", "Tag": [ { "name": "babymafessoni-merseine-com", "colour": "#4F35A1", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771427086, "uuid": "6c0bdca7-187d-4542-9760-c345ab89ae70", "value": "T15C073364198C4F7BC64A85305F7EC68D8366FC250EF4ED1E4536B8E2067626472E0FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771427086, "uuid": "9ad56bbd-ef35-426d-8e2e-6cd5c2cae3bc", "value": "393216:QvoO1zCdajdTPD13IRwsJw2HeVVxufe+jER:XWAKraRwIn+vxuW+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771427086, "uuid": "8ba91119-2d50-472b-b132-6551b8169b86", "value": 17084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771427086, "uuid": "95a037e9-8752-476d-811e-46008adc5c0a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771427086, "uuid": "bb356008-7520-4427-bde1-97d164c2c343", "value": "e45b92aff9c9fdd7b46b738273a1d1cbe91bd4c90bef48280c7fbbc68fc18b28.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab3fde9-0cfd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441663, "uuid": "1ddae34a-a994-479d-b372-76055b19eac7", "comment": "Malware payload", "value": "8012b4416adf64a6d806b4f2d324ba54", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441663, "uuid": "f2592aec-1ef3-4165-ba48-debac9274276", "comment": "Malware payload", "value": "e4c43db0b2cb835d3c2c114911bdd0dd4afad293ceebbe9a0bd8b5fd63be57d9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441663, "uuid": "dabb5bc1-21d3-450f-9445-1a429eb2f6c7", "comment": "Malware payload", "value": "46d07b10c06669956abfe2999c2e112b0f6b8da9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441663, "uuid": "e35c6fb7-e5f1-4035-aaa5-7df9ed966d0e", "comment": "Malware payload", "value": "2aa6ef592de3d84aa10e97f99b59a190ca51121c98b285301e8d6f57bb8d6fdfd9142225443f2f277de904ea48ddda8a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441663, "uuid": "e88080bc-4dca-4ed0-bdfd-786f464088b5", "value": "T16F573325E8824F4BD47B4E32EE718548186DACA08CE70D1AF52F7366B5F72E1627B10D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441663, "uuid": "06ceaf58-e4e8-43bc-bbc9-aa96441c9692", "value": "786432:WQ4XDwWxogst29bxGYNGvmnvWXZ2Fy1xfl:WQ4Mnpab5GvuiZ00xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441663, "uuid": "3f6f3659-9ef1-4b80-83a3-103a7031fa87", "value": 29618176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441663, "uuid": "3d7d0517-abbc-4857-abcc-f4fbdf767921", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441663, "uuid": "7daeb61a-6c1d-4ddb-8a33-1c1ca2f33f3f", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4766f3a-0cc6-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1771418380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418380, "uuid": "06dce5ef-d793-4295-91a6-e6767b5bd577", "comment": "Malware payload (ValleyRAT)", "value": "ce7b9a6793f1af244f2227d84c188735", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418380, "uuid": "8023fad5-42fe-41a6-a6b7-a6d713046fc3", "comment": "Malware payload (ValleyRAT)", "value": "e6a4e5d2697e13451440a74f3df1f1e9c6fe1221ee5749058579b750855bf4f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418380, "uuid": "0e55b515-10fc-4bd5-817f-392b1887f87f", "comment": "Malware payload (ValleyRAT)", "value": "9f6bbca5c7ab599fb77e0df3927213df1f62f81c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771418380, "uuid": "5751b41a-c9f0-4112-90cf-0333f2cbdb2f", "comment": "Malware payload (ValleyRAT)", "value": "4d52e963e115c91149ab069b079c46a6427a0ea8a76a7b7877838f69f7174e3f3b46f6c86927c151c69dff6589b6e2a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "usd56789-com", "colour": "#E7AB00", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418380, "uuid": "391707aa-04cc-44f1-9965-acfaac32c876", "value": "T197345C063ED92873D5A9E53CCCB31D179266AC0901B94F3A3A508BDDED3A2A3DC54ED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418380, "uuid": "abae3041-2e6b-4239-b8ba-96292ca611a2", "value": "3a37bf193db4fd53450d331354a82fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418380, "uuid": "4102f720-9e23-41e8-8766-c027ff730e04", "value": "3072:TEtXFczcLRTJH0xf1kBY2m5dWzn9GVbcrrn6cFstyOhpIRWcyloGIvPWbvQVQOXo:TEtd10x99ddunc+OI+hMl8olvo4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771418380, "uuid": "173e22b8-90bb-4532-a4c9-b1369ff0d4fa", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771418380, "uuid": "0354a16a-c9fd-4787-ab82-a550d5488dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771418380, "uuid": "493dee5e-1d14-43ab-b3e3-b2f9b27a2ff6", "value": "e6a4e5d2697e13451440a74f3df1f1e9c6fe1221ee5749058579b750855bf4f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f7cc8e-0c9d-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771400483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400483, "uuid": "5f1ece27-d4fb-4f2c-a15c-b86ba6961862", "comment": "Malware payload (RemcosRAT)", "value": "98403a6260b91707e88f4674bfe7a18f", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400483, "uuid": "b93a8371-58c4-48e8-a8f2-786a80f9d12f", "comment": "Malware payload (RemcosRAT)", "value": "e7227b215daa43a3c529f9d9631880b8c20b319f049f081fbfac75011c31ed2b", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400483, "uuid": "c54fe589-10b8-4c66-a1c3-5ae37add739a", "comment": "Malware payload (RemcosRAT)", "value": "a7e7d32f0df812aa75886c6196c0dad4629a964b", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400483, "uuid": "04086d14-9562-4574-ac11-817a0627d9ad", "comment": "Malware payload (RemcosRAT)", "value": "f921fb8d7566e0c14da58828d483117b4a2e6fc15760a2ee0019fcd090abd36984c15c306b1d68eb55f0ea3de4bd1133", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400483, "uuid": "4764b158-0dc2-4768-bec5-b949a77af794", "value": "T1BA65E00727C04AA4E5FD8B75D6B900E543FEB74B9B22E75D690A02EB8D22741DE01B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400483, "uuid": "375fdce4-5007-4c6c-89ed-9c085f01fab5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400483, "uuid": "7c26b221-57a3-481a-b9ad-2d5fed6fda7c", "value": "24576:6OfZNC8ZHKJCX0fI8mVS7FCnRveYepqMKDmfC4KOSSn2d6fhnhe:PZWWgI8mcERveYkqM3fC41p2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771400483, "uuid": "2710315f-966e-45e0-8a24-6ca83aea740e", "value": 1437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771400483, "uuid": "91690d07-1593-42df-82e8-8cf5fdfd50a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400483, "uuid": "64680d38-7e0e-4707-a55a-afe35fd22aa1", "value": "e7227b215daa43a3c529f9d9631880b8c20b319f049f081fbfac75011c31ed2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4355aff-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439398, "uuid": "818319ac-b267-44ee-ba0c-abc6385184dd", "comment": "Malware payload (Mirai)", "value": "2cfb216f15e41767b80ae565b3adc20d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439398, "uuid": "1d8ea517-a6d0-4f1d-a219-522a40180109", "comment": "Malware payload (Mirai)", "value": "e9e2e3ce2221dc85c5864337b54ae4863ead655db85c711b87a8bd2ecbee5d57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439398, "uuid": "d9f1c316-0d8e-498a-9d05-919a2489a6b2", "comment": "Malware payload (Mirai)", "value": "0a6cf58a7ddea3018d6f9810f15b4d6be66314c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439398, "uuid": "071fa920-32ca-4d0d-a655-dcd884906f42", "comment": "Malware payload (Mirai)", "value": "afb6d31e1138595c5bb675157399197f385b8d44d9f6a3e3a034c6aba403431f98aa6403dd6e037123e0d416c202fa51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439398, "uuid": "6df89108-45f1-4494-bb9f-a4da5a7a47de", "value": "T111739E23CCA61998D25C42B8B170FE3A5763D81056936FF7059ACA7AA047EDCF8093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439398, "uuid": "fa1f8282-2c98-455f-b979-a923a5f491ef", "value": "1536:0/C/lVA7lvDQuh23KoJeE74kvJgC9aglZQP+Y:0q9VURQuh26oNNvJgNGqP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439398, "uuid": "067c1c25-154f-4abb-8fef-e68f22e56539", "value": 80372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439398, "uuid": "1dc2bb99-318f-489c-87ef-671770633e7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439398, "uuid": "52731ffa-c2f0-4c7d-af98-9963b290e75d", "value": "rizzx.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186945e5-0cf8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439512, "uuid": "05731c2f-c0c9-40a7-ade9-d6656a11e2bd", "comment": "Malware payload (Mirai)", "value": "5e4b21827a7b29055a8ab83e11777dc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439512, "uuid": "9d917556-e8e9-480e-a6ac-87cc343fdd0c", "comment": "Malware payload (Mirai)", "value": "ea7aa80c0b28ad98e94b2e274c0a58845c85b24a84f362d09cf763fc4ae1d9ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439512, "uuid": "632c11a4-b4ee-46af-a77e-248b157c1edf", "comment": "Malware payload (Mirai)", "value": "5931664447f1977f9cffae9c11d4012d9fc7e02c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439512, "uuid": "99ecb7d4-d698-4826-942f-c6f421814bfa", "comment": "Malware payload (Mirai)", "value": "7d4ae6120537fc02a620ca9de0a08b94e0e7aa8a8cb7be9be04bd59cc13ddcf32ec50d5ea984f1d70812a5bd98ea4a73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439512, "uuid": "a1161fcb-8227-4cc8-bb8b-968d85a78528", "value": "T18E8328C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439512, "uuid": "40d424a4-8d2c-450e-ba81-37f850b68d38", "value": "1536:ijDwDhVtcU4xiUWaqH3Fk0eAoWFS6KjfTsv4gz9F7vX:YDWKzQLH3FrDc6KjfTc4gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439512, "uuid": "c2c28caa-2c99-428a-b593-6bd0f58e4de8", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439512, "uuid": "98536527-fff5-4ccc-8153-ae5f973385ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439512, "uuid": "79967822-318c-4d50-9bee-734d00d42dd1", "value": "rizzx.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2add814-0cfb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441167, "uuid": "48032787-88e3-4423-96eb-7ef99a38f2fe", "comment": "Malware payload (Mirai)", "value": "1e72351a08c20577c7eb5cb5c881e7ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441167, "uuid": "34f50371-a1dc-4901-be4d-ff3d423b6228", "comment": "Malware payload (Mirai)", "value": "eadabc0782154e4adb98677549da67400e7a08728d300d33936551ff08f6a93d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441167, "uuid": "09b022a1-f28e-4ffa-939d-2bd93208bfcf", "comment": "Malware payload (Mirai)", "value": "c4dfc04a32a153fbb8470642b6e20346c3d55a9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441167, "uuid": "53129ab9-f6ec-4148-b48b-c20cfa859ae2", "comment": "Malware payload (Mirai)", "value": "32b125602910bcd003585318670aab92f8a63c524264a61b92f28180e1aa6bccd16a249c1efa7c6b7f5ab3923232ab27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441167, "uuid": "928054a1-af40-471f-9fd7-f24b883be5b2", "value": "T137953354C00AB92FCB9AC0F45284FFF795192DA97E6AF78D8A344DB5E79A702070710D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441167, "uuid": "ea9eb8a8-a9f3-4669-8f28-d60c52406a0b", "value": "49152:FRyY8+n1dU00jJcyp6As8PQpzPrYk2Gi+Y6vtZTIlgb1J:FRhsPjJBTQdce6lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441167, "uuid": "f4229856-1532-4424-b216-b3847350491d", "value": 2052836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441167, "uuid": "232f3d15-a4e3-479b-8bba-b62eec3a756a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441167, "uuid": "7f56ac9f-4a32-483f-aea8-9b3272305766", "value": "deferwqd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9e01a5-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771406827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406827, "uuid": "e1506a3b-986b-47bd-95e1-af7b307a705c", "comment": "Malware payload (RemcosRAT)", "value": "4411ce727cae059b031b244b1f2422b6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406827, "uuid": "a96013d1-d073-41a6-bce6-f746d009780d", "comment": "Malware payload (RemcosRAT)", "value": "ebec186c9e43e30587104bff5ce4cbb6430fe52c4b083c6fa4cc31b6e4df86d6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406827, "uuid": "3f632101-ffc0-441a-a677-40646fdd57b6", "comment": "Malware payload (RemcosRAT)", "value": "e42e004ced84e33991bbbe6384e3987bef9d4e0e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406827, "uuid": "23232bfd-509f-4ade-89b1-f3c730030835", "comment": "Malware payload (RemcosRAT)", "value": "3f1c85e13d473313ebe14e6b5cd20596b3a9d40085a9d5418b3f544c4723a1923f63a7e1f4e2e0a63dfb03bd9a064ab7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406827, "uuid": "39d7d427-a384-4e7d-bebe-882cb0b2d9a4", "value": "T1CD4390E528370335F5F1A9EF42DB6211EE09A3458E105B787859A2AE474F3D23BEC91C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406827, "uuid": "2e9e2104-7fd8-4c2b-b30a-96b541cb4527", "value": "1536:bilk6LIWnW+/PhDMhaD9cjhjELJWHWz1HxKDa1Kjzg3Gtj87ZCaRAxgk9UopF4OZ:biwpFEpFEpFEpFEpF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406827, "uuid": "e155c32a-fe0b-4d75-94a7-c46f3521ce1a", "value": 56748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406827, "uuid": "d1554ba7-a9ec-4f0a-88f5-a8ea768e9df3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406827, "uuid": "97b0886e-33e9-4f5d-ac99-810571d19eb8", "value": "4411ce727cae059b031b244b1f2422b6.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dacc49-0c94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771396713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771396713, "uuid": "cd9868e6-79d3-4dea-a5b0-66ad70879192", "comment": "Malware payload (Mirai)", "value": "d5fefc5a33fdbcf2dfc38126a837dcd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771396713, "uuid": "01d40908-8dbf-44d6-8c75-8837811f5422", "comment": "Malware payload (Mirai)", "value": "ee582c6c16f4fcfb074f159c31ddcfc3eb6e8a5c629c23fc835320711e1c5c4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771396713, "uuid": "d4fdb9ea-408d-492b-92c9-9240acd9e29c", "comment": "Malware payload (Mirai)", "value": "c12769f9b73295685d4cc4bbd5dc458f582a1ed5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771396713, "uuid": "207fe631-5947-4154-a907-0ae2f1ed1ae6", "comment": "Malware payload (Mirai)", "value": "1c209efb1b6b2212ea0143183f25277b5547666bfefd13d5040c2be6502dc0f24f383865c901b03c4f1d7c65187b3f61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771396713, "uuid": "42acc311-861b-4dee-be7b-01f5620d0422", "value": "T134A533E81506AFEDF9EDA7BAC9AC5AB84734EB7FD1ED86080CC4857D480049E071BD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771396713, "uuid": "fe2c24e5-e930-4ef4-a228-45be9da1caf6", "value": "49152:muCRY1fpv5xCbgIlzlMi1z6YLGZhdMPdb8SEgDZI:mhuxpv58UHu2Y6fd6d8SEg1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771396713, "uuid": "0e8d8722-2290-4c22-9cb5-f2c7e658a315", "value": 2259524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771396713, "uuid": "eb5a8c8b-5812-4812-a2bc-d77a5488bdfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771396713, "uuid": "008acc28-9fd1-46b9-8bb8-a575d33a41d3", "value": "kworkerd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0576928d-0c9f-11f1-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1771401255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401255, "uuid": "0f588c32-f041-4c2b-a170-7520a3d0446d", "comment": "Malware payload (PureCrypter)", "value": "1973d8b0b477c1a3a41a2819ff8c7244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401255, "uuid": "7e07d5ff-e413-4ab5-b5ff-021612393068", "comment": "Malware payload (PureCrypter)", "value": "eee4f03d3ac46e5f6b01d34f9c30636ea0b6b49b6f1eecd6a2c6c9d56de10faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401255, "uuid": "0c2d4613-ca43-484d-927d-bf240763b802", "comment": "Malware payload (PureCrypter)", "value": "f3bc63e3b3ae35ea0fcfc6e619f2cd2a13e96c1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771401255, "uuid": "65b6da77-5173-4a09-ab09-44f439040b09", "comment": "Malware payload (PureCrypter)", "value": "3ff81b00010576a073f6a8e9291d6f411e92f5715804b692a80e51b86709da22e77a3aab09270eddf88082acf9d868a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401255, "uuid": "ce2982d0-1173-415f-a3c3-a4f366eba5d4", "value": "T101178C51B251C1BAD28110F069BDBFBF5B69DE180B884AC383D4BE2DAD349D35933E49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401255, "uuid": "a58cb2df-bbf5-4830-a5e0-4f8a3d083e44", "value": "8f2d019f8fba0f0e9bb93dff4b7bae96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401255, "uuid": "27e268e8-a5de-464f-9148-05c8d099935e", "value": "196608:HQhYHom2OyAo8prfoFAxTWZyMsScDta8C9DSyw:HH1pyGWZyPiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771401255, "uuid": "c6686b59-0f19-4b75-8f5b-a549ed7cb64a", "value": 19311616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771401255, "uuid": "9d9e058e-9cc2-44a7-b054-1a3d24acd7d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771401255, "uuid": "e877a2b0-086d-4007-84a4-5878671b1813", "value": "1973d8b0b477c1a3a41a2819ff8c7244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a75fae-0cd2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771423178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423178, "uuid": "3fe1c622-b6b3-4620-8449-d5dd27e7357f", "comment": "Malware payload", "value": "4c00a16e93435d2ec6860395803bc0c3", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423178, "uuid": "d786b7d5-82a7-40d5-9fa6-9ea8ad05638a", "comment": "Malware payload", "value": "ef462c0e50a2175139b32494e06f07137f5386a20e848261fb8c143d1613bd3a", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423178, "uuid": "5d09828e-595c-42ed-82f0-aba5efe3180c", "comment": "Malware payload", "value": "69a66b0e22b1cb702847dd9a542ed35b7b45e5fe", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771423178, "uuid": "bf180c17-a3c1-409c-a5d2-299a0b629790", "comment": "Malware payload", "value": "ca1015c6e589e17a0b81d8adea01bcececd8af04e99cd6e3b384288bf5bb027bc898f70d826b8daea48bb8bcf96601ee", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423178, "uuid": "433261e2-94e7-4be4-b3f7-b72194109cd1", "value": "T18965F10A13E956A8F5FE8B3C63B8406447F1B91BC721EB6E694941EC8D21F83D952373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423178, "uuid": "f2ea41f8-94fa-4e61-a9af-2b89d5d93bc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423178, "uuid": "f4e22cc3-512f-45af-abc9-a7569141dc15", "value": "24576:NHu8+C5rHZ49fWZsmp6iLkvD0CCnRveYepqMKDmfC4KOSSn2Y6cbBkrTeG:luS5l+WeJmkveRveYkqM3fC41p2YFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771423178, "uuid": "b6317417-8394-4a92-af9a-940ea7dee050", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771423178, "uuid": "a4b869f3-28de-4b7f-98b5-5dcc428b75ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771423178, "uuid": "d9e27bfd-a844-48a4-b039-02c9aa3f8f72", "value": "ef462c0e50a2175139b32494e06f07137f5386a20e848261fb8c143d1613bd3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f5253e-0ca7-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1771404887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404887, "uuid": "a9bfca9c-29de-4f6b-bd87-4b94a347d455", "comment": "Malware payload (CoinMiner)", "value": "247b0015a59185df92b82751e06c7f45", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404887, "uuid": "b022e448-e51a-4b46-8312-5614c646dcac", "comment": "Malware payload (CoinMiner)", "value": "efac57361fa125ca73858831c5b7a1e8f236add5c534925c98c48204328c8540", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404887, "uuid": "2d887186-0d94-4912-a7d3-79465bd5457e", "comment": "Malware payload (CoinMiner)", "value": "073a1dee8cdbef674ab60c809a54136ce9e50825", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771404887, "uuid": "327cb8e0-3e9d-40f6-adcd-4565703860af", "comment": "Malware payload (CoinMiner)", "value": "2dad5490c8f5008a01128b32415f30b98502d7fcda6d54f5e3f01674ecd03132e1da047fff9fc6b71f15a93dfff151e2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771404887, "uuid": "0711e384-c8dd-4bee-bee8-c593fec182cc", "value": "T1D3B6BF14A3A900B1E577C730CA669733CAB17D964B34C50F0699F2522F77DA29B6F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771404887, "uuid": "3c7063e0-0b06-4b36-a9a0-c48d44900660", "value": "f9733d815c562b4051f00a897b1b84e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771404887, "uuid": "bd05d178-0efe-435d-9d53-7c9a4cac31e1", "value": "196608:h47+mVAW0oF+UNjFvuzVdx1c5W/k32GiNxNUNEQ2/DQtyuQ+ps:h4ymVZ0ozjFvuzVdx1c5W/kfiNxI2cyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771404887, "uuid": "502fcb2d-217c-447a-b791-9d3d19a28d36", "value": 10515868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771404887, "uuid": "eabde0fd-96a6-44da-a071-3bd52c0d48c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771404887, "uuid": "c634baf9-2b10-4d5b-8e4d-8091ac8d348b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e92808-0ce5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771431644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431644, "uuid": "8b51a9b0-9f86-4e23-a879-65acd560e24e", "comment": "Malware payload", "value": "f696b51a0b5f007998f8f2df0da3540b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431644, "uuid": "e67652e5-68ca-4740-b4d2-496557984105", "comment": "Malware payload", "value": "efd350ccfbf13fb1db9dd5c71aaf1277ae2c181d0197d3e767b0f9241629939b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431644, "uuid": "45cf14e6-0adf-45a6-bc5b-bbf5e5554fef", "comment": "Malware payload", "value": "849184e7d53c13b4592d0706e15bc94d29c3e8f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771431644, "uuid": "ea883d53-c6ef-47a5-8392-7d57c9082e93", "comment": "Malware payload", "value": "6139b2fd13b827de5fd1b227d7b25deb5cd8c3738a0db89e5125a2cf2cb16d6db0dd435c22b119162ac817ad7867f93e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431644, "uuid": "d1744d5e-58cd-4693-97ee-b8df9415a184", "value": "T10AA76A43E48250D1C1E9C234C5B2DA977B32389A836423C7376DE7B41F56BD49ABE368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431644, "uuid": "b82168a9-ea7a-415a-ac16-3139339833c6", "value": "393216:HhNAvEIHLc3Q7dk4FXC1PYGLTogc40FC5:G5rc3QBk4FXC1PYGLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771431644, "uuid": "3dd8a67b-592e-4a94-8e4d-70cffd290394", "value": 44947208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771431644, "uuid": "7666bf5a-d9ef-4533-9782-9ba9214e5792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771431644, "uuid": "5476bf0a-0739-468d-a851-bf25da061ef0", "value": "vscan", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6e9c06-0d07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771445961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445961, "uuid": "6a8b940e-0a38-4786-a56a-71fac83ee43a", "comment": "Malware payload (Mirai)", "value": "4a540d4cd76c6d07f2ffa14b069164b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445961, "uuid": "c86a4d51-cf49-429a-bab0-6d742e8d16a7", "comment": "Malware payload (Mirai)", "value": "f26e721cb30041ac0448b9dcf9a11efd3f9db0d5fd4bbebef38fa72a5dfd7adb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445961, "uuid": "981b6907-5a27-4ac3-a25f-20edc8f5c3c9", "comment": "Malware payload (Mirai)", "value": "e78bb8c9ffe4235ed1c5d3f237aff303ac3c0def", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445961, "uuid": "3b1916c8-cc7b-4f7f-a093-dc14aec21d0b", "comment": "Malware payload (Mirai)", "value": "3ee9c705d5f821f1ebf03727de5017142583def784239520745ff5f677d28a35277204bbd0ecf3c4397c19062be26821", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445961, "uuid": "fc2da568-87ef-4241-9627-21d81bc011d7", "value": "T168D33A17B5D184FDC499C2744FAAF13BAE32F5591238B26B2BC4AA172E8DE305F5D600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445961, "uuid": "082757f4-6d09-4735-ae24-2b416ddea6a1", "value": "3072:XNFsFEDahDToQ4coXZDHcz/hnHpIHgQhUCuFlH5Nbf0TI:dFsFEDahDToQ4RXaqHE1wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445961, "uuid": "9ef4157f-cdd9-4f5e-8b24-a521b95735fb", "value": 142696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445961, "uuid": "9b98f0ea-9a41-401a-b196-641fc343d841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445961, "uuid": "138af3a8-58b2-44c9-8c77-bfb0959eaa0f", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f60e0eb-0c9d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771400413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400413, "uuid": "2d0990a1-9f7c-42f8-b527-60c0bf531a46", "comment": "Malware payload (Mirai)", "value": "03a6ca57f631de89e13f83252a48c546", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400413, "uuid": "6ea4c9da-84a9-4247-9616-0fc29eabfe3f", "comment": "Malware payload (Mirai)", "value": "f3b7db8088f1b7720b0bbe3ba295f9a338e6cc69c1ffaf09ae124b0e373066a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400413, "uuid": "4b7a49e0-209f-435e-9772-664386a44937", "comment": "Malware payload (Mirai)", "value": "f6c497d351a35f4bbce5140dab1884ed7efe2f92", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400413, "uuid": "86ae38de-c152-4119-a748-4412e9ee162e", "comment": "Malware payload (Mirai)", "value": "9e9302ed8e7f3eba0a4b41ad009b28682e672edbf475e14e7cf5c1cfc90b98697a2d03ddd6aa902d39b08dec36897449", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400413, "uuid": "b00e8218-89e0-4b7a-bfa5-57dbf9d6f6a6", "value": "T19FD11DF2B4C653BCDD9FCC3A6150296D1086A98B268B4D6887ED30667D8AFCC2C449D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400413, "uuid": "1e80e73d-9b85-4000-9097-d82da3c4fe07", "value": "192:0R3mBD0OBqgfp83Z4C128Ok7sS6gnAmJPOZLJPOZLCofI+TNwDFsGpiI+Ur8Cnx+:0R3mBD0OBqgfp83Z4C128Ok7sS6gnAm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771400413, "uuid": "9a5e4986-d168-4aa7-ba57-68cc40b97f61", "value": 6359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771400413, "uuid": "26ebe90e-ec63-4cf1-af83-4d8304d37ed2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400413, "uuid": "6d0529c0-ee8f-488e-9aa8-f4a9a06d68e9", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43521c15-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771402218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402218, "uuid": "1bd6372a-96f0-4c0e-9df6-5470b90124d0", "comment": "Malware payload (Mirai)", "value": "623551e179fbc434220bf845381d2a39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402218, "uuid": "079c7652-1bb8-44e0-9c7f-3b8ebfb260ff", "comment": "Malware payload (Mirai)", "value": "f42a7738ff077ad43d45ef349392e73d7cfdff75e3b350f8105ada7fae43e9b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402218, "uuid": "74e2d86a-2139-440f-8199-c866b56fdcda", "comment": "Malware payload (Mirai)", "value": "5a09b50e38a4402f6f10444a4a170126122338ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402218, "uuid": "03817caa-fd70-46f2-b010-c676c1d9db86", "comment": "Malware payload (Mirai)", "value": "0d5f35806d3e4c87f12b8e421767d663f5d461af11f9a0dc91057ed9151574335ad23553265cdf7e07743f239fbc152e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402218, "uuid": "489f482b-9a9f-42b0-b064-46459608884c", "value": "T14C03F1E2C649C7ECD93B10F2ACB76B9A880094CDD4118796A7D8F25F0BC6B681C1DBD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402218, "uuid": "5bcba345-652d-4381-addf-11b0a8a95c46", "value": "768:oJzRFjWYS0Zuijyvk4oxPqIdxRQg2mNEJwc10V4jsgq9kUSHnbcuyD7UtQRjx:qlNStisk42fdxRQgThc4aUonouy8tyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402218, "uuid": "2dcbb888-7e3c-4439-8775-0907982b8f17", "value": 39372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402218, "uuid": "c31e8fe9-dc3d-4e78-becf-389a37298a44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402218, "uuid": "01e4a0ef-fe0f-41ac-a2fb-f2521677352c", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7494f0-0ca1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771402206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402206, "uuid": "858fd402-155e-4b66-9c6a-dfe3fbf18d4e", "comment": "Malware payload", "value": "7869991a17896b65ddc7f797d6a973a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402206, "uuid": "98cb6672-af30-4392-91d0-0ee757ea22a1", "comment": "Malware payload", "value": "f47f31744963241467016fad235123aac00d057da927225d8ca852d0460ff496", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402206, "uuid": "46468154-f704-4144-b321-4bfe5cf8917c", "comment": "Malware payload", "value": "36a50ef731e6b8e30388f3e43fb26937690a7a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771402206, "uuid": "4df7a7fb-201f-437e-861d-91460b4005bc", "comment": "Malware payload", "value": "ca7c67445a3ca62ca0db3ce1890d24bd566e6c1e7241abe3a4a05cb437848f7ec77289fb2e3d4cccd5dfe2c30e1a6f5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402206, "uuid": "6514cb0b-0c52-4d8a-86a1-cd52535bf2be", "value": "T19EE3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402206, "uuid": "b712bcbe-cace-4472-bb57-56fe838122d8", "value": "3072:axjJw1Cc/0s6YAPwenUr48pzfR+Joney:axlw1xAop0YfRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771402206, "uuid": "96950a3e-22e2-4f2a-ae4a-053e4845220f", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771402206, "uuid": "abe7e345-31d2-4c65-a86b-9f972b817a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771402206, "uuid": "aa72e291-1caf-4d4a-9401-5ed6ec47572a", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebc2841-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771441294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441294, "uuid": "3c6cb7d7-49c0-47da-b23b-8ef9c4584f3e", "comment": "Malware payload (Mirai)", "value": "2f2d9228777cc3105da9b0523bc10aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441294, "uuid": "180e4738-3d27-4a39-8810-0b697e652109", "comment": "Malware payload (Mirai)", "value": "f4a5369dd39294481c01df5919b49d1bf2597ec88c848d3cf82321f1ce11738b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441294, "uuid": "1ee65b42-d92f-42f8-87bb-576ee082933b", "comment": "Malware payload (Mirai)", "value": "8ec2015bda6ead4d559573ea7590b2a21efe4987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441294, "uuid": "f624b8fc-5f31-4c6a-a38c-80737a647576", "comment": "Malware payload (Mirai)", "value": "94548f50c2bef01eea1b7b1bda2a7601118300fe20595518a21e5ab4586acc020b3567318561411348f53825875a5ef5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441294, "uuid": "e0cc745b-f561-4b5d-93f8-2a1d1a5e41e8", "value": "T189864B42FA19AFA5C9248C3385B3496027726D555B328792F704F6BEADB23050F53FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441294, "uuid": "b8809127-3162-4b1e-a2c8-e2085ccbe2ac", "value": "98304:gYaz8Dk8INZHXfHuOUeg19tKJGyykfdNE0:gYaz8DrIw9tTK1e0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441294, "uuid": "696954d9-16dc-4dee-ac1a-907b57c6f3db", "value": 8192148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441294, "uuid": "edde00b1-8e0e-4202-843b-3bbff266a025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441294, "uuid": "e6b421b7-5bd0-460c-a51e-6be131425e2d", "value": "ttmswapd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ad8f5d-0d15-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771452146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771452146, "uuid": "fd01b55e-e748-4707-910b-29e982ea96a4", "comment": "Malware payload", "value": "a683ea07521d8ea250ceb2cec115991d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771452146, "uuid": "e12074ad-17ad-4bc0-9b1b-6694f542f9c6", "comment": "Malware payload", "value": "f72cf44a998d32f12721e54901d489ac4726e5710030bd34a9660443af671ced", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771452146, "uuid": "4414ba97-c729-4c30-87f5-66fa4224cd8f", "comment": "Malware payload", "value": "9714b3ae22450e1b4fbd0b77d352ded5f779a43a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771452146, "uuid": "7c34ab4a-7b20-4a57-8e33-17ddb101d787", "comment": "Malware payload", "value": "fb1f9d4eadde7f55f159231770417913a9984b6219bda7175a46ee437954668c54e6f46dba07dd4f3dd6e1fa6e39fd08", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771452146, "uuid": "88f16eca-dcbe-4d56-b62c-ef96b7d7ddca", "value": "T120B37C1130C5C472E522257B4955D6B58E2AF8710F35AECB7FC447AE8F2A2D2DB26383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771452146, "uuid": "fc719c9c-a2e2-4d20-87ea-bc5fd060ddf1", "value": "a2e64cdeefaa0ce3250bb673c1d26712", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771452146, "uuid": "60cfade6-ad88-4689-b8f2-abd389a8be01", "value": "1536:e5YGwcLxWt4wN3LcssL9O/KbCTMXM3NmXb5yUnW:Ius5QLuL62M9Ib5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771452146, "uuid": "eb08ceb6-1f2f-4964-b7a5-fe77b22589b8", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771452146, "uuid": "fa4b8f60-a81d-41f9-b31f-4ffc0cb3767b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771452146, "uuid": "200d344e-7863-43ef-91be-af52dfb2e26f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd9ca75-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771406796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406796, "uuid": "d681d4e2-38fa-4e6c-8808-ba0586df5ab7", "comment": "Malware payload (RemcosRAT)", "value": "035bca03c475540a45d18c11a5dc02dc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406796, "uuid": "c6f62517-77b0-4450-8bd6-83bfa7b1ea9f", "comment": "Malware payload (RemcosRAT)", "value": "f77f326be5a917843406b76a80e882bc3c15b606db7c22950a89e6421ae5cd4a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406796, "uuid": "6d601ebd-74f2-44e7-84b2-be28426bbc72", "comment": "Malware payload (RemcosRAT)", "value": "047bb54309dd82ca8e2d0568fa6c2c9a84614f93", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406796, "uuid": "356ef432-008b-4d54-b1d7-3d3caf07a041", "comment": "Malware payload (RemcosRAT)", "value": "901be29d8072c06868b43b3db9111a85512c1965c3a8e808bc3d88becaa3f8dc1fee87caefa0902b44a5bd10ad0092c3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406796, "uuid": "7dc90d27-9956-43b7-b053-192b5ea4e335", "value": "T1B645EBBBD1B8689F2C14E7A0272CB53B5DB80D48CA33E190251587A62C76F13D3BB9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406796, "uuid": "f04b3f6d-e2fa-42af-aada-2bffedb7a915", "value": "192:B5ekl6QtqbSFzFAYOXbFOJiCiYFBK1KUqv31ZcflSrRC4PAo5ipVR6Muc6bf16vi:Hm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406796, "uuid": "2236595c-4117-46d5-b211-1463a8d87aa5", "value": 1245569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406796, "uuid": "727369bd-0f0f-4b5b-9592-baad38edf6f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406796, "uuid": "0dc1102e-1ae8-44aa-9fb3-03f8506dbe13", "value": "Purchase Inquiry 001981.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddaaec40-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439414, "uuid": "429fa5b6-ad35-4a80-849a-d3c58eebc14c", "comment": "Malware payload (Mirai)", "value": "71c018c93e09ca8789371e315c69c470", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439414, "uuid": "c3c066d4-68a4-4855-a141-f7f6ec3d99a7", "comment": "Malware payload (Mirai)", "value": "f9132d227a1f0e08d98ac0185264d356e93b15a7c1912c35c1f3a98a61cb1c4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439414, "uuid": "9c7b3c46-d185-4a37-a98c-2fe906a1d657", "comment": "Malware payload (Mirai)", "value": "c5992216ba089f63a22d6ff0e7ec520e45f42530", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439414, "uuid": "91c9bd42-efbf-45a0-9566-83c6451afd48", "comment": "Malware payload (Mirai)", "value": "7e7a446d41d43597a46768cfbdc48d5215f8509f1a6ae4cc16573a5cc4572823e10a9676c962767d4fc2aad9448f6f71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439414, "uuid": "cc763f6a-f4ef-4359-a6cc-19669eda1de4", "value": "T14A63021055CD99A1CBD111B3FCBEC853BBAC93F692FCA80E2325C655E3F294265F144A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439414, "uuid": "21c76405-9ef6-48dc-9563-337f127df972", "value": "1536:pMyXG5+FLTeIHbCSxsONHZJ45o3za3L7B9mHgTt:pMy25sLB7tFHs23mLtMHgTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439414, "uuid": "ade80325-eb7e-4382-b7bf-47a9b0a78ad3", "value": 67428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439414, "uuid": "6c69e9f8-6512-47e2-a7b8-342c5ea78627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439414, "uuid": "82bf3d1e-2eab-427b-8493-1e74af5a5aca", "value": "rizzx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccabce32-0c98-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771398583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398583, "uuid": "ac95314e-705c-4de3-ba4d-74296538794a", "comment": "Malware payload (DarkTortilla)", "value": "03c8603541ed3b4728580b6659fbf579", "object_relation": "md5", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398583, "uuid": "8502e4ea-04fb-4b52-97be-238c3b055228", "comment": "Malware payload (DarkTortilla)", "value": "f9c355171701bdaa99b18d04eac2fdb10647f9cba56dbcc417396f3ca9023b25", "object_relation": "sha256", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398583, "uuid": "765e56ab-b70d-43d4-b3db-25f75fa1e4ff", "comment": "Malware payload (DarkTortilla)", "value": "7048ff80dce23ed14499368149c8822a9bfc8d62", "object_relation": "sha1", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771398583, "uuid": "5503b109-00f2-4a5c-9838-68a1922b8354", "comment": "Malware payload (DarkTortilla)", "value": "bf167cdf6f0a1f6433129bb33b888edffd6f80474b5d814e8e45d5d3bd2a9be63e09aa610baf485a6194acb1e3491210", "object_relation": "sha3-384", "Tag": [ { "name": "cbzr-98pq1-ydns-eu", "colour": "#64D265", "exportable": true, "hide_tag": false }, { "name": "code1-ydns-eu", "colour": "#4F180C", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398583, "uuid": "aa550139-a3eb-4ac5-bc6d-708899d0b6fd", "value": "T108C423ED4C385C30DC30E9BB3B6AF3DBF9C2AAE12055AD26115C5B3474506BD582BAE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398583, "uuid": "6e77287a-cbd6-4921-9b7e-b41db8edfefe", "value": "12288:a9BFzyyFj85CFnJT/NkHPHI0qunDhKhBxoorCvO6k0V:SB1jJT/EPRTDGaoGvOZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771398583, "uuid": "036b79f2-d43e-4564-aad5-5507ee9974c7", "value": 578745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771398583, "uuid": "b9592971-1eec-47fe-b371-7bd1e97f979b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771398583, "uuid": "97c23c8b-0453-4b92-832e-b57933d843b3", "value": "Ordine ALZM SRL_DDT N .453471275.PDF(72KB).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b759e9e-0ce9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771433102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433102, "uuid": "0460ca20-11f2-4c51-987b-fead33e45845", "comment": "Malware payload (Mirai)", "value": "756416ac0adc4c5f10dba2759fcd2afd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433102, "uuid": "54abadf3-127d-4db0-9030-da5f82489a40", "comment": "Malware payload (Mirai)", "value": "faec0b3aac31748c51407af7a881285a293caed2c84174a2414d7ff85375e15b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433102, "uuid": "aa7c26a4-8538-4b28-b5e9-a6df421584f7", "comment": "Malware payload (Mirai)", "value": "f270ff05a1c4ebf46bca8611a2fb7aa6869f149b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771433102, "uuid": "0ed6fdcc-7b86-4a1b-a226-42542304d704", "comment": "Malware payload (Mirai)", "value": "21331989fb6c976bd4ceb2796a2e5e9f161ffa3b8ebc082e44392762532e3da969f71235c35c4eae07e2331493493456", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433102, "uuid": "59cbfeb8-32c8-4ddd-bec4-0fde80e4df3c", "value": "T1C1F31956ED819B11D5C152BAFE0E528E37131B7CE2EE32129D246F347B8A87F0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433102, "uuid": "16704721-ab2a-4f82-ace8-6175b7a789b1", "value": "3072:DDw5Qcqgs41ZXOPCFd5QajQJXXfvvaIo8TFxZT/FHjgM977PF4Y:Hw5Qcq41ZXOPU9KXXfHa/8JTjFHjg67N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771433102, "uuid": "c2c13531-a1f8-434a-b322-109872d4d887", "value": 166548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771433102, "uuid": "34d85ecb-5148-45ae-bac8-80096fe84a59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771433102, "uuid": "e317ea53-764a-491d-b912-6402b1c57ee8", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ce733f-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771406436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406436, "uuid": "26b05676-c103-4653-882d-a859a88f9b91", "comment": "Malware payload (Formbook)", "value": "4d2e25ebe9d511b48900801911a3075b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406436, "uuid": "55c09dcb-a27b-4230-b138-b881aaed14dd", "comment": "Malware payload (Formbook)", "value": "fb05809e17753c5ac6c04b88d8a187b2392c1f912b3951273f39bb63e9228d55", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406436, "uuid": "88a3ecea-2aaa-41d1-a68e-88f012e96518", "comment": "Malware payload (Formbook)", "value": "9dbe54e0b13216019680ca75d94a5759dc01c1c8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406436, "uuid": "dc76191a-9ea7-4631-89ba-79ab741c072f", "comment": "Malware payload (Formbook)", "value": "344711c433d67c23a7244b278a77d4ea247aeb40450660653edbc50579bfbb885c43cda479d3988c82b7a018648aa117", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406436, "uuid": "a7382899-a199-4527-8972-46d2470ef480", "value": "T16D95C065EBC97FA5EA5CDE1AB42D9E0E71721DC224CBA9C5F2520C43CE7E41804631AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406436, "uuid": "cd98ffba-2081-4e99-84f9-4de12ed59884", "value": "49152:L+2l1CdeCQAkwDOlTFvD/YMJ7gMJvWJ2hU8i:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406436, "uuid": "ac105f2f-88d2-47d0-bb07-e65cc4cdb927", "value": 2047995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406436, "uuid": "dbb339a9-8e52-47b8-8d78-4fa6d5544529", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406436, "uuid": "abc75f2f-8b79-43af-ba51-b6195f15c858", "value": "Technical Purchase Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2102779e-0cab-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771406455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406455, "uuid": "b64b3406-9254-4549-b366-43f35c42de37", "comment": "Malware payload (VIPKeylogger)", "value": "0ce2607fedf1d1acee30ddb7a15ab92b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406455, "uuid": "5a5797a8-f960-4cb1-a65f-d4bd31eb8b21", "comment": "Malware payload (VIPKeylogger)", "value": "fb196f31a463c29a71797c899352d150bdfb1fc7c4ec2b6280d766693f6e0da3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406455, "uuid": "4ed9bd08-f3b5-4047-94bd-5b5e859f8d01", "comment": "Malware payload (VIPKeylogger)", "value": "6e4ebeba352217646590ec75c83bf3e02b7f15e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771406455, "uuid": "e16c380e-5013-4e53-b382-6978e5706ba3", "comment": "Malware payload (VIPKeylogger)", "value": "a89e75929041be59c0b9dca3aa9b533451495d57f5b43115357e59f4dc61c78faee6d73f1da64edfed5db2834a530cd0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406455, "uuid": "f8c382cc-e383-47aa-852c-6084e7855b57", "value": "T16A76D814EE4E4D4818AF6FF765B1B4FC57CAA24368951AB0A2375722F8F4AC3C712670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406455, "uuid": "ca799b53-1498-4dfa-812d-1c21ea149010", "value": "196608:HdIktdK3OYNG1E6mojB7FX4u2F8vlTM75/pVKUoPrAScy5B:HfYNOEBKBpouRtTk/7pHY5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771406455, "uuid": "5f56f1e2-7ac3-4d24-be2f-243beb8687ee", "value": 7199395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771406455, "uuid": "98c3c642-e3f3-4598-8284-e28a976b894e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771406455, "uuid": "15c0bd92-0f3d-48ac-ade4-005c0d6eae6e", "value": "RFQ-SPS-5520-MFR-907.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8cb674-0c9d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771400411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400411, "uuid": "271556e3-0ce6-414e-83ac-d56956000203", "comment": "Malware payload (Mirai)", "value": "de73fa06ff5f3d5d143a26ffd661a6e4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400411, "uuid": "1278b43d-2f35-4a30-b652-8609dfa2dd94", "comment": "Malware payload (Mirai)", "value": "fb51cc30f5ac43a9cc4ee8e036da03135fdfdb5c285d651682e96d42541fd678", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400411, "uuid": "66cf5902-5966-42b7-af3b-494459d48d5a", "comment": "Malware payload (Mirai)", "value": "bb76f6a2404dcde94d803254a4cf322c1bee0a57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771400411, "uuid": "75936c06-1870-45a2-a780-cf68e9fa6cbd", "comment": "Malware payload (Mirai)", "value": "0c5e588e7c87806a35e432f239509aaf0a97c4cac3b8e54df5f92a7371b696f114b5adb370d527e8c342eadd622c05d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400411, "uuid": "d8a9fc8e-c89d-4eed-9733-951521b4a5f0", "value": "T17031AD9FA0F41A81C6CBCE0070E58DCAA39E999473F94732EC851EB69489D943C59B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400411, "uuid": "2b84d6ec-d8b8-4005-8d0c-3ae9161c4930", "value": "24:HDdQC1WKrBM/hpi1bWK2wc6fko7egKPJd4vH9:iC1WJJo7eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771400411, "uuid": "d4991f54-e190-4e7d-a758-69ae6f10bd34", "value": 1845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771400411, "uuid": "793c364d-9031-4607-ad67-d016dc16fb46", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771400411, "uuid": "bcde20e0-ec3c-4612-9ed2-0a9b27af7226", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e8d58d-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441224, "uuid": "2d26ecfe-25cb-4cb2-9efc-b896a568f417", "comment": "Malware payload", "value": "66135a343899fe01c1b2a9fc5c9d18bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441224, "uuid": "c54ed32d-3d17-48a0-b815-d9aec2e17061", "comment": "Malware payload", "value": "fbc8ef286e292e4a8b1a79590fcd4b30323e1ccca16902567b04acfebcbbc1f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441224, "uuid": "8d452c9b-c943-4d98-b7a8-394d8cf458b3", "comment": "Malware payload", "value": "aa7733ed63aa1832c42bd7a30e28b6be7a88b8bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441224, "uuid": "d6db3514-45b3-4e1f-ab46-8de347de1634", "comment": "Malware payload", "value": "63f747a37d3eb08d4ee7376533dc327a744ff302d1a29b50519282d9917083d991ee98e7bd51b877d878e025254b1a76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441224, "uuid": "e439657a-3603-4529-b8a0-e54c330d9ea4", "value": "T18C140A02A9144F53C5C31BBAB7DF42993B336B1897EB3301EA19BEB42F4769D1E29501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441224, "uuid": "3c566abf-be64-4f31-a964-62619eebc0c6", "value": "3072:IqnO/CkJ424HPmcoEKwu0UHjq0fWJqN8+4B3Z8Tm/6CzOuJe3pa19Ic1BA:IqOKkJ42mPmFg1eq0frm/6CzOuJe3pae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441224, "uuid": "a6d258bb-855d-44cf-a3cb-63817970eac1", "value": 192487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441224, "uuid": "df26b8e3-f9cc-42f6-8c5a-3445bec67b1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441224, "uuid": "48df84c0-eac5-4444-9f8b-b8a20aacadd9", "value": "mynode.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae968c2-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439463, "uuid": "9018454f-bff7-4b38-af1f-cedab84f3ae6", "comment": "Malware payload (Mirai)", "value": "9bc7b83d2f9e2f9b69da22433cddfc03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439463, "uuid": "0a03bf07-4bab-4bbe-9aa0-5cd690169fde", "comment": "Malware payload (Mirai)", "value": "fc043e89e37bcafb38c578714ed3938103ea4270af97559ba1737e06cada9d9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439463, "uuid": "6ab80a67-fc66-45a0-9e39-442158d39b54", "comment": "Malware payload (Mirai)", "value": "a0a4a3c154799db3b3cddc5b1b87143b70fe88cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439463, "uuid": "3cd31f82-5381-4cc0-9209-d7b57dded786", "comment": "Malware payload (Mirai)", "value": "e0fdcaa6b537a207164763664cd8dc166f34f485d89aedad677024dd6d836332a757f32ef2d237e57474ee2e2744b3a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439463, "uuid": "9f800d5f-1d25-428b-b33f-431ac311e152", "value": "T14A044C46EB818A13C0D62779F69F524633239B94D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439463, "uuid": "5fe67720-30f1-46f3-ba0a-629a2e37dceb", "value": "3072:XlIYLg3DYaX5dPRdzFFoJSUYCOK/Ulbmy3d0fM/9XGCCeM:XlWzYaX5dPRdZFAGCP/cbmy3dEM/9/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439463, "uuid": "784a224c-fe6f-4568-95b5-3a7a9e5002cd", "value": 176499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439463, "uuid": "0f7c1d66-6b7a-4658-b9ab-5ac5def03040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439463, "uuid": "770f9543-76c5-48ba-9782-06b09811cc1e", "value": "rizzx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59dbcb9-0d1c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771455345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455345, "uuid": "5c7ba9e7-aef2-41fb-b5c7-09167d65206f", "comment": "Malware payload", "value": "f7a1616b4c53a0ebca1ee389ea732633", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455345, "uuid": "ba791e34-49c2-4c3f-a243-feb901426574", "comment": "Malware payload", "value": "fc175a719ace46ea67a989eda476dc20e68f860d417bfc04762b822da46880a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455345, "uuid": "7e39f0f1-bea7-4a08-b8de-cb782b0ef726", "comment": "Malware payload", "value": "221d58eb16f53c22c77536e67b7e243713d337f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771455345, "uuid": "7d47832f-140e-41c3-be90-68dcc3f3178a", "comment": "Malware payload", "value": "cb761e3cf7e980fda5b4de8cc4c1a0f14d5c692549d282b13ba581f4248c3d9c071facc23ee0b230a5cf41efadefdbec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455345, "uuid": "0409fa05-78f3-4856-b1f0-ab331325d5ea", "value": "T1DDC30895ED829B11C6C2167BFB9E828C3727536CD3EE72039E256F61378B45B0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455345, "uuid": "e4f329f8-d1a9-42e9-853c-a909cd5ac247", "value": "1536:maJW1lvj9gulfnWwJ00/goPjpGW83rZGC9YjgvHaO/fVQcRMBkCmdrQUdQEV43:mXzuUnlWjzF1GCLvwXByr5Q33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771455345, "uuid": "8098397f-6eda-4b64-89e0-af6427d34cf2", "value": 120636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771455345, "uuid": "db717038-90d8-4fa7-827a-55de6d92ada5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771455345, "uuid": "6ef57327-51ec-4a56-baa4-b6f3cbaad930", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132083df-0cfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771441221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441221, "uuid": "b5293f52-61d8-4a20-8d2f-fb35a147d64e", "comment": "Malware payload", "value": "bab8f244b795801bacae9cfd46ee14df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441221, "uuid": "cc97665f-2372-4b8b-885f-5e85ba8faa36", "comment": "Malware payload", "value": "fc5bd40ba4b85f1aa6de04216761919a2ae57effe70ff0a0cc56df1587e1d569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441221, "uuid": "4460ecfa-1abc-4eee-b5db-27139c7890e8", "comment": "Malware payload", "value": "d06d7a5ccdf092251ffa76dbe3436ca1474625ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771441221, "uuid": "eb5524c6-a1fb-4a68-9642-bacfab8ff13c", "comment": "Malware payload", "value": "04e26d7dea2f5262bf6608249aea06bb76cd0d2db917fb1af75e46ae33b6224fc19b0cf07f341a5ad75d6b3ab0417f25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441221, "uuid": "5f5e6dde-5bd9-47c2-8a15-ff578f379991", "value": "T15EF32A41A646CAF3C4C30FF612A75B654633E8291B2BCE45F32DBDF88F465C9B106668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441221, "uuid": "4d5e2b77-a7df-4630-8eb1-c23c61f83354", "value": "3072:QFYlFWge2IClbafA1JVUPR4OS4vFFoNDDmI6Cyq6wcYTC4UHgB+:/FNe/IfVUPRNS4vAN/mI6Cyq6wcYTC4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771441221, "uuid": "693ccce7-98e0-4144-bc6b-665d6163afa4", "value": 157801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771441221, "uuid": "0b62e091-c671-4753-86a1-fcbaf27a51a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771441221, "uuid": "ae9af408-8786-492a-ba9c-9cf740e433a3", "value": "mynode.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caac317a-0d06-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771445824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445824, "uuid": "a024ee5f-73d1-4cc7-abba-49cc8a79cac4", "comment": "Malware payload", "value": "7bd60498b2d024ceb02253b04c21f650", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445824, "uuid": "c4d45c96-efb6-4236-98ba-a01d85d87fe2", "comment": "Malware payload", "value": "fcf6ed70caa702e85b9715dc03a9afbcf87ed7158f3d900672be79bc87db3451", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445824, "uuid": "c7603f86-4208-4bca-8043-6a30a3968d26", "comment": "Malware payload", "value": "9930bc9b72f9fddab285e4a6560eaa1182ccdf6e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771445824, "uuid": "e4d2a87c-67cb-4a8b-a436-f5c60e8fd907", "comment": "Malware payload", "value": "f474504ec359012d9da988c5454c957babb8b789ad3cc275d5fb660447aa9050ff2875f1a06a8052005db87c70096d9b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445824, "uuid": "f5481aab-89c3-42d2-a057-39bad1159d13", "value": "T11E3396A167F9152AF6F78F783C7065968C7BBE726D61E08D4280204E08B5B95CE78733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445824, "uuid": "28d638db-b8b8-48da-88a8-e155c52d78f5", "value": "0765db21700aa225ca00e841fcebff9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445824, "uuid": "04b3872f-a208-49c6-9f71-876f90a5b1a2", "value": "768:2OVB8H/0vaXDiTLlGCI0App3tnvU7+dEErkdqsq:lBXEiTLXA3dsidEzdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771445824, "uuid": "0c604bba-5ff7-4417-b400-74c7c7016022", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771445824, "uuid": "43a8ab16-980f-4717-bc5e-1187d58f9367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771445824, "uuid": "a440953f-d981-4883-b7f9-e7c120139e1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b13e67-0c72-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771381975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771381975, "uuid": "fc395454-3036-430b-8cae-314f859d8420", "comment": "Malware payload", "value": "327ca2c8586799617c50e6f55684c4d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771381975, "uuid": "30dbbd78-72e8-4cda-a58a-0f2b74a88303", "comment": "Malware payload", "value": "fd240ad6909c795fbf63c4974cbfb7cef100d8ff431f4cc2d5f0a44f6567f598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771381975, "uuid": "7ec62e8c-b3a6-4618-8b52-f3826c29f84a", "comment": "Malware payload", "value": "fd202ef4c3ef136b43fd476e58c4ca531fbcf8e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771381975, "uuid": "90fd0d18-fbfb-49e3-8a58-38c34c924cd8", "comment": "Malware payload", "value": "e0074130599741ac7002046bca380f7e4ac6ca2c9836c9962cc041584fa4f7e7e8dd10d748549f7b1f4847e3ebe7ca70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771381975, "uuid": "2a29670b-69ca-4f62-ba90-a9839f22f83c", "value": "T141746B59F7A910F9ED77C23C89628545E6B278164B31D6DF0364022A3F272E19F3AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771381975, "uuid": "098b2b6c-5837-421e-a2d4-d8f49363ea88", "value": "351bc040901a62bd50231340c431e09e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771381975, "uuid": "bf121b59-8044-4ca8-8bb6-15f97a16a50c", "value": "6144:GHxrjr3VReVONB/QxFoDOkTu1qD3ixLbugohGOuBhZ8Vz:GH5jbVYVOLilqVgo8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771381975, "uuid": "85f50c9c-e787-47ec-9800-e2955e0f501b", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771381975, "uuid": "06d49cf8-0f7c-4f5a-b86f-e7f1e3cd20be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771381975, "uuid": "4194a8d7-d012-41a2-9700-62a3fd21cb0d", "value": "KCode.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae3bf2c-0c91-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771395332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395332, "uuid": "968f8834-1ac2-417f-901b-4c7d2c0cefee", "comment": "Malware payload (Gafgyt)", "value": "6928986e37629e6b731249c026d735af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395332, "uuid": "0d96a6b1-4ac3-4071-9a18-882a2ac66be8", "comment": "Malware payload (Gafgyt)", "value": "fd60bcf0d4e6e423eddb5da1f5c2afc61034e04e5ad48625b1b2a1837cb301e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395332, "uuid": "eebc6518-f619-4a8f-99bb-22b11e20e494", "comment": "Malware payload (Gafgyt)", "value": "950e43ae1ed6a0f3f7855bb994236fa30056e6a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771395332, "uuid": "01a7c51d-f0cd-407b-b32f-01acf83c992f", "comment": "Malware payload (Gafgyt)", "value": "02a0e29d340021a5dd8ed9628e9a32eca83bfc9f7fc1872308b23eb9017a27469ac368b88467e54e3ae3adc23b4b3c2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395332, "uuid": "6dc6dfd6-13cf-4b92-9b2a-7b1dd006cf9a", "value": "T152C3F1C2E6D3C572E08344B10497E38BEB33EE575150C5B9C3887F29BDB2A6B061D959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395332, "uuid": "d7898f28-73bd-4e21-824b-0436005263d7", "value": "3072:qa3z5a9yc6DyNivwcQRb37CVO2Gu/4NMb8gdKNR:qqm10yNivwcQRb37S/4N1UKNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771395332, "uuid": "850275cc-6a9a-468e-b691-dd5f80d03e7b", "value": 127073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771395332, "uuid": "2e93e5c3-098a-4175-b9ae-81a44f2b65cc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771395332, "uuid": "3a62f62c-0b24-4cec-ba5e-6e489de55ed9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a52bd4-0cf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771439405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439405, "uuid": "cb86e196-c157-4ce9-a4b3-f4da2368a4b6", "comment": "Malware payload (Mirai)", "value": "c07f3d82ac0fd062c2be6a612c902824", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439405, "uuid": "30be76bf-204a-40fd-a007-ebfdd0c0175c", "comment": "Malware payload (Mirai)", "value": "fef2eb6f39205bb097d7e44f7804fc04616c00a6d0db98e03ef96874244f7083", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439405, "uuid": "8fa29bfe-c19f-48f0-a7d0-08199ec62b66", "comment": "Malware payload (Mirai)", "value": "aeadd4b3144d36f4d02cc69403ed2da45a603cb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771439405, "uuid": "e52f5de5-0c57-4318-b286-752df3c92478", "comment": "Malware payload (Mirai)", "value": "5925e5614ccd27d103b7cf708ae7749430ea9a9a6756ab29f567dc263c8d38a20ae0e71993086279210190720abd47d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439405, "uuid": "77abfa01-56ef-41ce-b705-5a4e643acad9", "value": "T1FB13E17C030F08F2EE3599319BD81BE01DB202739547DE5EA179E1D359609BE3693E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439405, "uuid": "921fdd81-2e62-4b99-a3a0-bc7f4c1055dc", "value": "768:sls4wXUXTCPZyiWUEm99uS9I2fOivDY2k9SanPC3BmwMDjf010XlmhzJgGlzDpbQ:slSXUOP8iRBFIEv27PYBmJns1rpVJu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771439405, "uuid": "9554803a-774e-4541-841d-db0ac4ed6fc8", "value": 43288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771439405, "uuid": "beb9a6a1-2e13-4737-b889-a63eb847433e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771439405, "uuid": "127577aa-9947-41fd-8764-afa37a7589e8", "value": "rizzx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }