{ "Event": { "published": true, "date": "2026-01-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-15", "timestamp": 1768521781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a97ffc79-47e1-4410-b110-8f5f85e2eb5a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd02ace-f1f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768467830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467830, "uuid": "43637ac9-555e-406b-90d9-b85fae4059b5", "comment": "Malware payload (Formbook)", "value": "94985d48b471e893cbdac6becb8fc36e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467830, "uuid": "79f365ee-ceae-4d71-8703-8c9f35b9aee3", "comment": "Malware payload (Formbook)", "value": "01cbe01d18871c18d56da2cfc6ec2b67cca061529e56632206ebb6073d36c798", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467830, "uuid": "70f9b8b0-62f3-4926-b4aa-b9de8b4eff62", "comment": "Malware payload (Formbook)", "value": "4120876487b550aa266f876a23fc406265247f95", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467830, "uuid": "ab709eb6-349d-4224-a136-549b60be0f30", "comment": "Malware payload (Formbook)", "value": "dbea45f89e6fe468f2e13d5523b1e7525171ddb5ca0227f4bf33e6ff5c7d53d0a4e126f9c182c5689fc9688706e07830", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467830, "uuid": "51330426-bbf3-45c2-bd81-772706fcc646", "value": "T1DE6533011DACBEEC26ACC31531BF5F4F2DE1ADB2804981E76BD044D9198EF52859B4AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467830, "uuid": "77cf8907-6fe0-4a00-a252-4254fad8f894", "value": "24576:mu7zjLJNi62ecm5f7nXoANKIXOcMUUp9+WOw53w7tnrQO590ZeBnVF1K7a:5PaG1MUiLR0VNB02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768467830, "uuid": "2bdd045f-2dc5-4d17-979e-73bb6999272d", "value": 1437549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768467830, "uuid": "7fc37b6f-c817-4cc1-89ac-c9966d503f61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467830, "uuid": "1dca19ef-cd74-4870-9479-d36e50a99d08", "value": "w7cba5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a649302d-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463767, "uuid": "e77fa79b-b5ad-4e7b-a5c8-25637ba1620d", "comment": "Malware payload (AgentTesla)", "value": "d07bf769aa4031d0a29791943c2bea80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463767, "uuid": "e6ea918f-59f8-4bd9-baa0-eedf4199648a", "comment": "Malware payload (AgentTesla)", "value": "022284600fd5031861bd4ae068576fb1574524d00a5fb5abb7d06f11ad30ed83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463767, "uuid": "85f203ba-b267-40ae-aeb2-17a555634cdb", "comment": "Malware payload (AgentTesla)", "value": "c8b2e9a98b5a92b1eefdd687e8ad17edb7ba9ced", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463767, "uuid": "ed0600ac-7f36-455d-9583-95d20361c61d", "comment": "Malware payload (AgentTesla)", "value": "ed0f25f29305873ec145699fad5d99614e3b7692e74ad088ebb2a7af22b9819d6556a42a132c8b5b4434badc1cea43cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463767, "uuid": "2fd82847-01a9-4b40-bcf1-690b3ddc2755", "value": "T111B385C939CAF47343B935276D1BB05AF12F4D82760C80A4D2D766A8FE68708D635D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463767, "uuid": "e0d8dbe4-187b-43e6-8ffd-7c010d018c8b", "value": "1536:WniV3jT0jqWarR4E6lIcZ4iUK/mUJUbyzMNVp3xG51Sl2r4whuEmmzXZhfj+9Ig3:WiVsT15t4XExkoVfUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463767, "uuid": "3c73f029-634f-4761-9e4f-9b0ea724937d", "value": 111516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463767, "uuid": "3f90d222-a52a-4a17-b73c-7f5aad9d8bc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463767, "uuid": "773530b1-452e-42cd-9a83-806696e00e01", "value": "PO No. BMSPO1143.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e15d570-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768466116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466116, "uuid": "62750a10-ae58-4a7f-8016-90569546b648", "comment": "Malware payload (AsyncRAT)", "value": "688d7cb2667be4fff30a8e1bc5935dd1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466116, "uuid": "c19e27b3-e741-4490-bd44-3f9a0e147e90", "comment": "Malware payload (AsyncRAT)", "value": "02323ae6cf1211fe2cca692faefed667f3b53b222835513fee66f58d81b78283", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466116, "uuid": "824253fd-df04-4487-9f76-d841cf8b2028", "comment": "Malware payload (AsyncRAT)", "value": "1d3e58958223dde631cff1a3bb020ad451b63d51", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466116, "uuid": "8d9c60c2-8ed0-4f24-97ce-d5c7725fa7ee", "comment": "Malware payload (AsyncRAT)", "value": "caf3aeaf5681f139b269f1100243923d88b5c8eb3c8be00e758c909e450bb9e125138b5f16f2d24d3639640582ac6f7f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466116, "uuid": "b34e0c9f-9e85-4cfb-afc8-56e77a5f86ea", "value": "T1EC2422164F04DF6445ADC630A1FA19B2C4740B47926AF1C0F8CCCF5A9F64A74D32BEAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466116, "uuid": "6d3e41de-57db-4301-90bb-e6d050099aef", "value": "6144:7jVH7qulv9y/3t2YBXkijtQGeOgH7g0gi3:7j51l23xBXkgtQG/g3gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466116, "uuid": "fa363e40-4edb-428b-9e0f-298e3d120d56", "value": 226821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466116, "uuid": "2c7932bf-fe26-4e3d-a13c-40a7b247830c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466116, "uuid": "aef3c34d-7c4c-4844-9029-90ad0ec70e5e", "value": "eazyy.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f80dd7d-f1b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Hajime)", "timestamp": 1768440885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768440885, "uuid": "137c308c-4670-4aba-8041-1bcf54819b33", "comment": "Malware payload (Hajime)", "value": "5ea8197eca1c6b71c3225a9b78e4d229", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768440885, "uuid": "09dd35e7-7e19-4ab8-9dc2-a7d4bccceeb2", "comment": "Malware payload (Hajime)", "value": "025f8c57aeed8e8d618ccae3fd094e945af54279fcf45655facf9de539ebce22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768440885, "uuid": "dafb40f5-4505-452c-a65d-b7f29d6fc223", "comment": "Malware payload (Hajime)", "value": "950085e1225e1ba77a2207328c6781a060a06bd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768440885, "uuid": "badedf6e-4fb0-48b8-9ddd-888c16d76e94", "comment": "Malware payload (Hajime)", "value": "734af3dfd7349977deb4690fa087e352d3702b09ba6c0e76adff55e354327702c22941d677faa3b2926fb1dae73332c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768440885, "uuid": "361b5673-7d6b-4cdf-9cba-940cdd0667cb", "value": "T13C82E14626983B47E4B155F1F73CBE9CB2051E9CAB7B98279099613360B312EE604C77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768440885, "uuid": "53049ba6-18d1-477e-a14e-b31472ac3732", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcXBy:YTYIDfYG6ZmewZ59+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768440885, "uuid": "fa74d32e-a643-47c5-bb36-ef126bf182a2", "value": 18720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768440885, "uuid": "98240416-a338-4ca0-9e72-efc5c4ffe6d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768440885, "uuid": "16ac1688-3246-4329-a04b-9b6d12a158d5", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35fdf9c-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463333, "uuid": "ef04001c-37cb-478d-98dc-c4d7f82fac42", "comment": "Malware payload (Formbook)", "value": "b7d48c83b0a91626475211dab147f622", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463333, "uuid": "810d0e4e-03a5-475d-9a0a-dd1939e43211", "comment": "Malware payload (Formbook)", "value": "02b11e22d98a1162169bcd3dcad8c65feb2faa4f4f583c54ba7611317e5af2f1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463333, "uuid": "0468f992-3712-4dad-a6a0-3829489ef467", "comment": "Malware payload (Formbook)", "value": "4374ecebb4071335a43bf38d9f39ebdabc84cac5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463333, "uuid": "abd74394-183d-40ef-b857-32ac7eedf818", "comment": "Malware payload (Formbook)", "value": "efc03fcee48d87d4bbddca19c8735518129f5d408780170d3f67bb03fb284f85b47e7ba3610855cf01e654d7a26fe191", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463333, "uuid": "b27fd8af-88b0-4c35-9ecb-98129ae90a7c", "value": "T1AA7374DD7BE7F475139168337A2BB05AF22E4C80754C4191D29A6585FA38B08EF3BA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463333, "uuid": "68476442-1358-4901-b2b9-3fdf81768496", "value": "1536:e72aviADD8KXPZvFb2Fzf66NvgqgHaRmgsXnHjBvy5gTnHwbxrh:e724iAfhFbYcoR1sXDBvyU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463333, "uuid": "964b1c7a-ef42-4398-ad9c-c8ce8d469d26", "value": 79935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463333, "uuid": "3174bd47-6aea-439d-8ecd-7917fd4922d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463333, "uuid": "de5bd38f-83cf-4bbd-b72c-b28935be9beb", "value": "Payment Confirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b53277-f248-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768505285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768505285, "uuid": "d8edd07c-2fa9-4b91-8743-593431791f7e", "comment": "Malware payload", "value": "31b6c6599054ae8826cf2aca122c1496", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768505285, "uuid": "c0f76ff8-4a07-4bd3-90b9-5ab5a7b8c059", "comment": "Malware payload", "value": "03e0b4fd95da1ed152fcb22924c35f05060dd63c89ee5cf751aba498e84a6360", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768505285, "uuid": "9cd1bb20-002d-4219-979c-4c57e58fe7ab", "comment": "Malware payload", "value": "961efc2ad8c25b7531f9a623e6ec9d44f2b1152e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768505285, "uuid": "8a3c7157-ea30-4ebe-913b-b29173e3a5da", "comment": "Malware payload", "value": "1fd032594c781567709aa31c5b2733b4c3c8f83a77c92a82c50ac1fadac03ff5c42e20fe9b2d1be1bd825330f2a8be76", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768505285, "uuid": "3c3d9be2-8cfa-4a15-ac3b-92e47fe7c323", "value": "T1E0C62366A1D8A3D8D8D34B40B18B12CB35D1755A82FE8C1E3BCB5C027721DAB458BE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768505285, "uuid": "334d8ed9-b9b7-4d32-b2fd-18f0c7eebd01", "value": "b544070d00013e564a6e7901399d1921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768505285, "uuid": "d487732d-db8b-41d4-8f2c-c33c7ae4182b", "value": "196608:Jm0k46RDCcIVSfm4OOQ0BnJpBd4zij0J4cfMOJPQXEWsej4sVzlntscI+:J360rVGWOQmnJzd4VzfMOJP+PtpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768505285, "uuid": "752602db-cb12-461b-9344-6cafcca071b4", "value": 11949568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768505285, "uuid": "f30cc494-f8d4-4630-bef9-3f21f35cbce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768505285, "uuid": "c9a9796f-1fbf-4d71-a502-a8c57b5422be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9623aa6-f21c-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768486616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486616, "uuid": "33f6239a-7b0b-4a57-b3b1-4ddb61ba1da9", "comment": "Malware payload (AsyncRAT)", "value": "acce5d40042bef878a69374811b777f7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486616, "uuid": "6a00783a-1b28-4a6a-a7fe-3ce171b72659", "comment": "Malware payload (AsyncRAT)", "value": "0661369bcc84ed31ddf3effe5165105748fa42b9d0bbfef276ed606a3093c417", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486616, "uuid": "46e79f02-8faa-452e-9ad4-750c3cdc0239", "comment": "Malware payload (AsyncRAT)", "value": "38c3fec1eeef203eaf71c569aeb67cc67d3956ac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486616, "uuid": "f01ed6e7-c5a8-442f-9cf0-225ac74b5a56", "comment": "Malware payload (AsyncRAT)", "value": "56103a68b05bb25a83f9c934d8b483c097dca62a341fcd5cd376e8e5c8417bae49f29c8e5c46d909a0bc465350c973dc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486616, "uuid": "79a0bc6a-42df-4663-9222-6cbd2fa24cfb", "value": "T1E455C38301213BA9FDF921A1D7283AC69BD841A2FAC399795C5E5DDB81074BD04387BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486616, "uuid": "e63f853d-24ed-4be5-87b8-a81c3fa7644f", "value": "384:U1I+d9XB9dbHEJx0VQjew+RWsjT+XbrK3Q066fPlM9NsbdBexxzh9EHjdlrcrx6I:Sie3Uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768486616, "uuid": "f0258bf5-37e9-47ac-a831-4cbe6404ed52", "value": 1304126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768486616, "uuid": "f146c87c-5539-4117-b2ba-8e2887a6871c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486616, "uuid": "1b4c83d3-e346-41c1-97aa-6b8ca3170640", "value": "QUOTATION LIST_08766.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bb75d3-f1c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768446855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768446855, "uuid": "c94d5e56-af49-4d8f-a819-deb9f5e07857", "comment": "Malware payload (Mirai)", "value": "612542e11435ddd2795730541cb1bddb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768446855, "uuid": "2011ad1c-bab2-4794-b0a0-4f84ae35e8d1", "comment": "Malware payload (Mirai)", "value": "083e5beea5b26771cee1d513a4d864a85e87a7107f8e0cb8d0e586b5e9de908e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768446855, "uuid": "c9baf958-60c4-41eb-a3f2-09fd157c4727", "comment": "Malware payload (Mirai)", "value": "e836c9a71e8c64012d0d4a301cd4465cce0dc302", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768446855, "uuid": "59dcbe4a-d896-4467-96d2-ed888d9fc4c1", "comment": "Malware payload (Mirai)", "value": "6487c0ef1794bd911b2d53086ab60890df1fc9e2f1e7314cdda32efa5b9d5de0cf0ecfc81a63a88a306495c9311872de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768446855, "uuid": "eae71fb8-74aa-45cd-bdd4-05ae1be2b510", "value": "T1FCC3F796BC819E16C5D156BBFE1E728D33133BB8E3DE3206DE145F2067CA91A0E7A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768446855, "uuid": "99c069f7-4c3d-486a-a96a-887243955d2d", "value": "3072:T6dhv7kZLJtEZJMYJzEyHkzor/zBh9b2GOvnLcr1G:T6dhvgZtt2JMYJQMksrT9bTOv+1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768446855, "uuid": "fd6906ae-8f4b-49ed-9871-4b9b0ecd7d12", "value": 124204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768446855, "uuid": "1855f1b2-66e4-44f1-912e-deac38ead0be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768446855, "uuid": "a2f40236-4dff-4c12-8e99-9f9c2cdaed93", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a4e155-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload (Kaiji)", "timestamp": 1768500456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500456, "uuid": "89d43d2f-eb1e-4792-86ba-c8ba99892f23", "comment": "Malware payload (Kaiji)", "value": "6643b264527c2817cc37e9c01b4bcbc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500456, "uuid": "1b25ccb6-2cab-4c84-90d6-dda22bf5f29a", "comment": "Malware payload (Kaiji)", "value": "08b1ca7ff461d7931cdcbdeb71a22fd67bde07b93607bf2574b7cd666a93ed30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500456, "uuid": "6fbaea5e-8402-4e41-b7ae-ee9a8e8eac6c", "comment": "Malware payload (Kaiji)", "value": "f26034dd2b3a7f6c35783620e4919ab8a61bc8a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500456, "uuid": "576d1e20-1431-4f64-89fe-c66b40f06aff", "comment": "Malware payload (Kaiji)", "value": "e5868a84b1db158af55bbd5fcfc1de09f772aef82a084cee122915796a6e11bff711ef08f854fcd8dc613288811146ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500456, "uuid": "e9b68a4f-6608-4cc1-a25f-e5cde9bbc656", "value": "T1FF951711F98B54F2E9071A3104AFA26F27319D054F34EBC7EA40BB6AFD776D20932259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500456, "uuid": "d4b49eca-fea0-41c8-bf98-2a07d6e82a01", "value": "24576:ae9ufJvk4gQjMNRfktnsIXvZFyD9i+MPCIxyuzNqssZXJj7bdYVVMtIwWz1v:WYMnwRO4ssP7d5Wz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500456, "uuid": "57d6b239-fa43-41a9-94f6-531b73cae1ff", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500456, "uuid": "c7b1298b-0e57-4672-81a4-b02a4081a338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500456, "uuid": "52440064-0fb2-4676-aef1-744c49ea309d", "value": "linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24accb7-f264-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768517555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768517555, "uuid": "1598362c-c4de-49dc-ba55-341075724709", "comment": "Malware payload", "value": "93a8cacb1d1544aab1f23862f9078f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768517555, "uuid": "7d494e9c-e6ae-4b94-ba47-d22bec5ab4e1", "comment": "Malware payload", "value": "0b4a2ac06a6619d814f82412f393d961f2693f7d70bdbb1dc97ebfb02e56fd45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768517555, "uuid": "79ff6552-0d5e-4fdb-a609-e8cdb4ee1476", "comment": "Malware payload", "value": "da8f24cdb8dddcb7f42c6d9e5f80e0ee4923deb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768517555, "uuid": "baf172cc-0dc4-49e9-a522-0a2ca7033f9e", "comment": "Malware payload", "value": "a4af0b728d4cdf1280032daf3ae4ab7dc6c101f71f476078e0299e28b093cfa54cf3e1537c8ded5aeec219ad4e9f0b76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768517555, "uuid": "f1d84131-7708-41db-adf3-a5b302ceba84", "value": "T156A6AF367604A53ED09B0735553BE721983EB77226038A43B3FC148D9FB99546A3F28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768517555, "uuid": "cf8cb6a5-ef5c-4f46-af59-9b753b7d60ba", "value": "b3db8df2b78adb59f7861c04fb2bdfda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768517555, "uuid": "dcce530c-cf19-4711-9c1c-2fd179bdc39a", "value": "196608:KWuRc89udxY7z8eZ6Jbp2CuJOgjPKbKkybx6:KWuydxMz8eSpYOgjPKbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768517555, "uuid": "3958c682-3c00-4a21-b61c-5af7a27e59e0", "value": 9964544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768517555, "uuid": "e3dc0703-8c50-4d39-a5d3-41a5e17985ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768517555, "uuid": "7531f96a-f9b1-4fb9-820c-7ffb462ba16f", "value": "DXSafeAdmin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01028fa1-f232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495702, "uuid": "8030c1d6-1160-4a8e-b23f-0e1ec80b5048", "comment": "Malware payload (Mirai)", "value": "3e3644b3ad14ca75c50d567654455e7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495702, "uuid": "bf53492f-6966-4f2b-9495-e15c1e6daa0d", "comment": "Malware payload (Mirai)", "value": "0c205753701807954b21b125866030ac034b331dfc9618952385dce90ab1e00e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495702, "uuid": "c82135a1-1baa-43d0-a853-2953139f6e0a", "comment": "Malware payload (Mirai)", "value": "4afcd3659c6b608d4981e199552977aed05c3397", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495702, "uuid": "a8354fcf-86b9-42b3-8f0d-262e4caa8a08", "comment": "Malware payload (Mirai)", "value": "30eb9a8cb689703a23984bbaf6ce7a117b9772eeac2c812824dc807324f3a6ee29a6e9cc5e9687b9b7e0251a4281db45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495702, "uuid": "711c5d96-fd13-4959-9cc1-5b058db98df8", "value": "T11AC31B45FC405B23C6C612BBFB5E428D3B2A17E9D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495702, "uuid": "7a4c6292-e2d3-4f5a-8057-7d79d5171e92", "value": "3072:pKaprMh70OXWFh4UX0AFcO5ZupvWVvec:pK7hXgh4UEAFcuZupeVvec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495702, "uuid": "80d7737e-798c-4e39-b0cb-315fadfb129d", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495702, "uuid": "1e01f59e-80fd-4b95-b5d4-2c5ec31e6d2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495702, "uuid": "9ed56cb5-bee8-4cdd-b8b5-f488ac421389", "value": "djmario.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffb45cf-f23a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768499190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499190, "uuid": "b904bdf7-1d23-4261-a783-5224a5264174", "comment": "Malware payload", "value": "27d4d26832ef89761c4534edcea2cb39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499190, "uuid": "fa582bf1-5bbd-48e5-81f1-8aca9141d551", "comment": "Malware payload", "value": "0c23eff79c5d333e00b45e224656b6bf8f9e659dbd6761d926c09a0f301cdcc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499190, "uuid": "88034573-9c54-427c-947b-27700033e474", "comment": "Malware payload", "value": "3ea0b851305df63191d4e401ea03c50ba8c09259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499190, "uuid": "faad14ba-b4fa-47b6-8b56-de99a7643143", "comment": "Malware payload", "value": "0d8833ce1c2a079b01cc3653bbbe5e9a7e134a7a001f896e4475b4f48ccdb109f602f728e127715800a562da0ac8b06b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499190, "uuid": "dcf80d33-98b9-471d-8d7d-9e1885e2450c", "value": "T1BAB4392E71F48B6FD07AC17689924B639532787C073681FF1380C2A5DF95AD0AB3AB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499190, "uuid": "f3f1561f-d73f-4dce-a827-2c805d0d98e6", "value": "0ef9f4a9ca5532e968783ed88f5341c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499190, "uuid": "df46255e-1403-412a-aaad-188708fb02ae", "value": "6144:4kj2XIRmj13uBUwU48quXeRlnMWejKKp0JQIyn4dugWZD6qqDLuEblKA4vRD+x:4aRmgay9sKKkQl4u7qnuLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768499190, "uuid": "a9a17eb5-6f94-4bed-b5a8-dce523e94732", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768499190, "uuid": "edd77ffa-2806-41f3-b8dd-9d9e36cae252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499190, "uuid": "2ddad645-32db-4c82-8517-4e0cad948109", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04a77f5-f1e1-11f0-a129-42010a9c0007", "comment": "Malware payload (RondoDox)", "timestamp": 1768461261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461261, "uuid": "c11c1de0-7423-4ec0-99e3-8e94ae4909c9", "comment": "Malware payload (RondoDox)", "value": "f200c242477f7c6ac4b8af6679cac248", "object_relation": "md5", "Tag": [ { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461261, "uuid": "6136936f-25d1-4209-97d3-31823d8bec9d", "comment": "Malware payload (RondoDox)", "value": "0d230a0db9f277c8f94d916beab06f184471e9ad08ae31f49013551ae05c2492", "object_relation": "sha256", "Tag": [ { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461261, "uuid": "5b43f662-df68-4f6a-865d-9b3470529d93", "comment": "Malware payload (RondoDox)", "value": "adf2da07cbb7f70d2361940d004c75b0edd711a5", "object_relation": "sha1", "Tag": [ { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461261, "uuid": "479fb56f-05c6-4916-85a1-bd9b20dd5744", "comment": "Malware payload (RondoDox)", "value": "c953906b5956e17f10c8b71505ba08f5c6b7c03d4e80b7ba5d2d9cee95f836da36980d948b5372a6cdc5bd67de563eb6", "object_relation": "sha3-384", "Tag": [ { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461261, "uuid": "7082ac86-4e08-4a85-9574-25809eaf71bd", "value": "T1F32219CC31DC13BE649564426193827E6989C1EBB2928DEDD48E8CB69DF0448E17FB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461261, "uuid": "e2866d7e-cfd3-400f-9307-7fa95d32f0ea", "value": "192:hs9W7I1vVYTSPG5oOQhwWcWPjCryEI45ReV068mfTC3egkG/zmv2YOfmoY45RmZj:hu19YTd5oXhwPWPWry945AV0LmfG3e1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461261, "uuid": "1d7b438d-5b9f-4445-993b-75a5675c42ee", "value": 10876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461261, "uuid": "f14ca5dd-ebab-4fc8-b573-c3907d1d4e53", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461261, "uuid": "ee80fedb-7499-490b-abef-2f25013616c0", "value": "rondo.aqu.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f4e5d5-f20a-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768478905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478905, "uuid": "0a9499d3-0a8a-47ce-b849-4ec8517071bd", "comment": "Malware payload (Vidar)", "value": "5a67451fcb568588202bd2b5ee934b31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478905, "uuid": "f565241e-1219-462c-9bb3-0d85a6cefd21", "comment": "Malware payload (Vidar)", "value": "0d7df867846b2b57f07b3ed8818eec3103d3ab7b99a5dd76362aa06f898ae0f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478905, "uuid": "e2913644-04aa-4dc8-bcd7-fd4ef24c2ae6", "comment": "Malware payload (Vidar)", "value": "804195b925f9e0060eadc7715b69138b3d99a21e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478905, "uuid": "31c4f2da-157f-4eb9-89a2-78081ba0a12b", "comment": "Malware payload (Vidar)", "value": "48e486e1afc63a4b71bc781214eb4c7fcf23e529238ffbcc8005b9abcf8f3ec3951ea405d1cff0ebadd4ce433dd56b20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478905, "uuid": "340f527a-85d1-4190-a637-3850ca9c5119", "value": "T1ADA56C57ACA005B5D4AAA2358C7A2160BF71BC450F2123E72A73F23C2FFAAD0D475B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478905, "uuid": "a8afed0d-a1af-4610-bb59-d5b0a0d56c0c", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478905, "uuid": "705a312e-ba0f-4b61-9f53-c3251f175984", "value": "49152:6r/41eGP4p5SRA4CaHabryJ3TOJi5kT41UxZ2o:6Ur2GAvU1e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478905, "uuid": "20f46a7b-0d0d-4173-863b-ce4e6d50b1f6", "value": 2089984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478905, "uuid": "21480212-f649-4110-b764-2d174927eedf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478905, "uuid": "6626ac3d-cd6f-4f74-8340-df64d55dc597", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9693f1ca-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768435824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435824, "uuid": "941c147b-b0d4-412c-a44c-11611e31731a", "comment": "Malware payload", "value": "da86f73e624e4a68fa67fb81d433a2f6", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435824, "uuid": "e0a60081-141d-4198-a8a2-e143dbf2e211", "comment": "Malware payload", "value": "0e48f13f47a3a9c7ce8735a00a04786664c1f43e18ad7b28d838e3926ebfac4e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435824, "uuid": "58941ffe-3004-4672-8968-c70387aa9161", "comment": "Malware payload", "value": "b5c17b47ea0d438c62b43397a2f78768a7179327", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435824, "uuid": "16c71040-746f-4156-a2bb-a9edec051448", "comment": "Malware payload", "value": "72128f82ec5a44c65c9d4a28d628b59d282bce918eb14bc71e878dcddb8291a2ee772a155ace7e237213031e682395e8", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435824, "uuid": "5b56465e-521c-4aae-a594-80032f304bbd", "value": "T100378DFB661085E9D26B9936C0D39A16ECF2F2B50F23C6D782F507B65A127C4CD39A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435824, "uuid": "a1409537-9d36-45a3-bc7f-726009038165", "value": "b57bea7b5421874a35f4643d58669085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435824, "uuid": "6b072f24-9962-40b2-80be-fd1c01f78612", "value": "196608:T5oeoC7lWx9Hnm3/lXHfJi30d9bEh4Ue15080lDmLXpRFgw:FoeocYxV8/xHfJi3ag4UensmL5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435824, "uuid": "cf20db4d-de84-42c3-80b1-581cb5fdf324", "value": 22359040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435824, "uuid": "97bca3a4-be52-47ba-93d5-2a49682279b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435824, "uuid": "7d425580-1a81-47cd-bfcc-ba642988eca5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ef332e-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768463522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463522, "uuid": "4b201d24-ab89-42b8-be30-3e18287e835c", "comment": "Malware payload", "value": "8a8cad56dcf89eb35fe5a1a250916e79", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463522, "uuid": "fe6ed619-b334-4224-8c40-55ab38acf42d", "comment": "Malware payload", "value": "0ed7cdb4423ca5856ab85f1167a33da7dc8941046f51816d8e7c0ef740930991", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463522, "uuid": "72217b21-8906-4935-af36-5ff71263a12a", "comment": "Malware payload", "value": "8dd3849794744b06569c40ed7d173e75b06b9ddb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463522, "uuid": "e20b6eb5-11e6-43be-a0af-8cbd0ee83a6a", "comment": "Malware payload", "value": "14d52a246f741f57bd7b2c0a36dadccf8b0fae645ae7a32289175b4db828b74c90ca80093d710f0bb6a7c51b87ed3149", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463522, "uuid": "24db4cf1-d6be-4fc4-96d6-55fa10107726", "value": "T1C14583B4A0580987D440096B741AB074ED4C7B18E96F8C5BED53E9EEBBFD2BD0483729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463522, "uuid": "370f692b-e1f5-4558-8deb-9f1c5a823959", "value": "192:7VDayHWhowiRArVCB5h3WqbkyBaQZvHx8qTkjCLv8ShwQxDEsONmF0uX+yLpNCHF:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463522, "uuid": "262d2665-0dc5-49f1-96b2-6d1eae8962f4", "value": 1268978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463522, "uuid": "2c8c3231-a539-48a2-94cb-5633ce4704b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463522, "uuid": "411f2875-0503-483c-abaa-f8d6bd3d1c02", "value": "pla\u010dilo_46236421.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111ea733-f250-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1768508614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508614, "uuid": "118b408b-56e9-44c0-a3a0-d51d685f419c", "comment": "Malware payload (PureLogsStealer)", "value": "30a532fd78ada4d3b4a1298279468623", "object_relation": "md5", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false }, { "name": "virtualized", "colour": "#E5D141", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508614, "uuid": "b5232743-8464-4f6b-b824-84094530282b", "comment": "Malware payload (PureLogsStealer)", "value": "0f60bb38538603b49af58a2c51d8866b159c1af92b93b10867cc803ed70de1f0", "object_relation": "sha256", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false }, { "name": "virtualized", "colour": "#E5D141", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508614, "uuid": "7772e5d5-2741-4b71-a597-d95949635d6e", "comment": "Malware payload (PureLogsStealer)", "value": "5e89ff42d7fdefaf992450e51f0dffb79d812781", "object_relation": "sha1", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false }, { "name": "virtualized", "colour": "#E5D141", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508614, "uuid": "3db783a7-1482-45fa-af1f-653d8312756b", "comment": "Malware payload (PureLogsStealer)", "value": "efdff0fff8c95dd69e0d25e5937516c007a64982e794edc8606a65937ec4bf8955a31f4f50e48b0bbd501f23baee7c1c", "object_relation": "sha3-384", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false }, { "name": "virtualized", "colour": "#E5D141", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508614, "uuid": "4621f259-97a6-4f8b-9271-ea36edbaf486", "value": "T11F54129D766A8C93DEF68A3BE0F7C4078372E6511127CF89249F96105D023B5E990F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508614, "uuid": "ed5d5530-1f81-4832-a860-ce61acded1dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508614, "uuid": "1a00b03b-51c3-4024-994c-32160314ee3b", "value": "6144:15HrFZYt74yNgCdax7mgLKZRvawrN+WNqAzClp4OJkAO3rKyJGGA/S:vpats8goax7IZR7B+WgAmK3KAKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768508614, "uuid": "238dcde6-d0bd-4646-b716-8272d3be92d8", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768508614, "uuid": "79ab68f3-e71d-4740-8c76-f7196c06015e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508614, "uuid": "88eccefc-dad3-40b5-b87e-f0e0d6de3f0c", "value": "file1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b39ccc-f1dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768459393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768459393, "uuid": "d122610d-4379-485c-8ec8-d49eb3bd5660", "comment": "Malware payload", "value": "2c4a99c9070b6b68d5144b1021115de2", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768459393, "uuid": "e40ad51d-adca-4fa4-b2e5-97fc655fa540", "comment": "Malware payload", "value": "0fc20a482e1ff4b9f04940dd0018b887756873cff1ba8d3610ae2248f9b7659d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768459393, "uuid": "6a284991-7dda-48e9-9098-d686c8d58337", "comment": "Malware payload", "value": "50515ea9037d5cf826d501e46a716cb1405ce67d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768459393, "uuid": "df5537af-cca6-4184-956e-14e67c34401a", "comment": "Malware payload", "value": "263de2658ad0208b9902426660708ce3ad4ff6c94acd03d5007152aeba784542e2cdb9371ed36bb23c8d060c38b11903", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768459393, "uuid": "b292ee0b-9ea2-478d-a56d-06bad07e5eea", "value": "T128459FC4C8432870AB3D5851CA6F963D201B74A312265E29AE5972FCBE9C4F7CD652FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768459393, "uuid": "b401b06d-bef6-4432-9b5c-b87ed71df15d", "value": "12288:fVxNwgeZWDVxsmQa0dR8qyuXC+aS26P2jPvY3i+6j7R8SJM9B:fVxNwgeZWDVxJQa0dvyB+v26PwPvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768459393, "uuid": "da3c8e14-88e6-4e0c-95a8-99c37e7dc4d6", "value": 1210978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768459393, "uuid": "165aa64e-fbad-4dd5-aba3-d3c9983f91d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768459393, "uuid": "0a606095-4608-4bb5-8e46-27986c2e6a82", "value": "generalexcel.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24df5277-f204-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768476006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768476006, "uuid": "6e98787a-a61c-4f3b-8785-e473b14e2634", "comment": "Malware payload (AsyncRAT)", "value": "1687803de9269d78f982bdaa53ea053f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768476006, "uuid": "ad3bc747-834d-4450-aad6-884e8a800e0f", "comment": "Malware payload (AsyncRAT)", "value": "1080826aacb388d5163487f739c15a438307d6ed2f4b1c753eba12ec4850ba92", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768476006, "uuid": "b180a06e-4538-4d9d-8585-af105b5c619d", "comment": "Malware payload (AsyncRAT)", "value": "4dab0d5eb212c3167e1825f4d98c7f1661365791", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768476006, "uuid": "e70b5e3b-57a1-41d6-857a-27fea1b98cea", "comment": "Malware payload (AsyncRAT)", "value": "93e21dc2551afe172186d1d03b48acc606780c0135b75ffc189fe760e159faf35fdc9086b9773566a0134a81cb22ff0b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768476006, "uuid": "a7ed039a-aede-441e-9095-f5f4adada02f", "value": "T177535B002798C925E2AD8AF4BCF2550106B5D5372116DA5E7CC804CB9BAFFCA4A167FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768476006, "uuid": "a51ef414-0bb4-4f33-8407-dad5f9e2aa7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768476006, "uuid": "acae6251-a78c-4dd2-8aaf-aae9b685251e", "value": "1536:LJOrwIn+GYazwxTGbbnwHwIDEGJ4VclN:LJ3In+GlwpGbbn0CY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768476006, "uuid": "0827bfe6-14a4-4ceb-9cb2-099c2d505fb7", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768476006, "uuid": "b2cbe2fa-da79-475c-b212-04cafd500b9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768476006, "uuid": "10bbed18-1bf3-4a83-bbc7-277bff2c621a", "value": "QAGACloudApex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd409ab-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435728, "uuid": "295cf31e-e039-4d2e-993d-05dbc9ee0d19", "comment": "Malware payload (Mirai)", "value": "93e492d9db053882373adaab5e5c5769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435728, "uuid": "4adb414f-986e-400e-9e4d-4b1f6691ab64", "comment": "Malware payload (Mirai)", "value": "11494a98fb150512d9bfe4961040bf5218816d6ef8ab3aee48fabf37e1f7c460", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435728, "uuid": "a3793db6-b334-4b8c-948b-b65987890b0f", "comment": "Malware payload (Mirai)", "value": "e9b95164984404f440a31c92b44fa4fb89c66ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435728, "uuid": "cfe6f543-48b0-4d0f-9795-d54357f038c5", "comment": "Malware payload (Mirai)", "value": "63c9e457481bc3e51f95e187b727a47429d97f8ba1d446e3df6b0162d251fb30f71edf0ac9d0f16376d93e0790c41911", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435728, "uuid": "efd87d77-541a-4bec-98b8-c1369f17332a", "value": "T11CF3D60E6E25CF7DF7A8833447B7DE21966837832AE1C546E16CD7105E6028E245FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435728, "uuid": "c3b5992f-d50c-473a-aea8-32660e816af3", "value": "3072:x9Ar7T2y0qDZ/jqhJJ6TvPFY4LUuohgJk3DbMxkIsIZpSkrpgQG9TQ9flJO9a2FR:x9Ar7T2y0qDZ/jqhJJ6TvPFY4LUuohgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435728, "uuid": "65059db8-102c-46a3-8f67-6af1ba51d8b0", "value": 170812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435728, "uuid": "f3036b5b-93f5-4461-b28b-c7cbd95b4aff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435728, "uuid": "a8307b38-db22-44fb-b12c-7ca10d2b99d5", "value": "systemx64.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94397fa3-f220-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1768488218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768488218, "uuid": "c31f5c20-02e0-47e9-9467-21bf37999bd7", "comment": "Malware payload (GoProxy)", "value": "98199d4f23696217f9b68b062178c392", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768488218, "uuid": "2c5ed66a-903b-4e2b-9cc2-a01dd5660475", "comment": "Malware payload (GoProxy)", "value": "11c620a088b35f33c2741ff279109850400bbb1de507aa556a53863e0776f7e6", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768488218, "uuid": "5c92f109-4b2c-4091-84b4-21049ca7451a", "comment": "Malware payload (GoProxy)", "value": "2fc78be9bbfd4ad3d46d6e06b695597af9fde022", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768488218, "uuid": "ab3299a8-bc55-428d-81f7-e18b0d550f19", "comment": "Malware payload (GoProxy)", "value": "ed01cdaa5abae58adf01934ac66ae5acae0ff61e3d2b45051ee439c989f9c8b8e6b2295541677ae52795568faf249352", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768488218, "uuid": "5707fd30-9a4f-4964-9465-c99425f7f672", "value": "T10C868D847DD18537F12A483AAEF435276E3EE24506D36EF30324A32BDA779D64867318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768488218, "uuid": "66578b94-f0b5-407a-ae1f-0f214efb940d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768488218, "uuid": "4b270ff3-476a-4f64-acca-f48ffcd90816", "value": "98304:1umx0pi2X4Q43xLHUGCHA+Je7oZjtZEUPMeQdxvvx+:1fxCi7QxM8Z5dMeix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768488218, "uuid": "2d64d342-e29b-4100-a5bf-173233aea966", "value": 8225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768488218, "uuid": "6ed60b95-5433-436e-a621-62a58cd57ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768488218, "uuid": "2e27eda9-7ef4-4d1c-9b84-1de357961a5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1707e556-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload (Kaiji)", "timestamp": 1768500464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500464, "uuid": "ca783310-76da-40d5-acd1-531e787e9753", "comment": "Malware payload (Kaiji)", "value": "527db97913b8800370566ca8b874f070", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500464, "uuid": "fab61b71-2272-4875-ab7e-956de5d1e128", "comment": "Malware payload (Kaiji)", "value": "12f65318aa3316ad18c0a9e879f1171fbcfee23d4717e5925a12867e42b9f589", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500464, "uuid": "a7b28e23-0fe1-4d59-a39c-d4f685111728", "comment": "Malware payload (Kaiji)", "value": "68b46315cf1575f191d4eda495af71e87ad7b94d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500464, "uuid": "19434fef-755f-492a-96dd-60e08ad90c30", "comment": "Malware payload (Kaiji)", "value": "b8d2c3cee1b511825eff0d5f68e772bbe19d5e6cc7aba2b44699a324b2dd647c4a4e92f322665860e341dee12ba0d34b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500464, "uuid": "8a01c620-dd27-48ba-9ec3-1eb99a94b0e7", "value": "T1CFA5F857B8918552C4E42637BCBE81C833635EB99B8663666D04FE3C3ABF2D90E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500464, "uuid": "a328b34b-ff5c-4eba-9a21-adf66f08c0a8", "value": "24576:J1rMILphWsdRm6vM7lUVJtq8wfe9OqbVgYQ3k48jtIMoG34WJnWVh1BPnjKqZdtX:JVfjmAMo2T1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500464, "uuid": "35af5868-af55-4001-8a2b-0c19da65135a", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500464, "uuid": "1e0eb307-7800-46e3-9a9b-d1598f5e1011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500464, "uuid": "c2bcb6a3-0a89-4d74-b849-685870141536", "value": "linux_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d37417-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463495, "uuid": "89b7b09b-8513-4010-8a66-a31c76700ac2", "comment": "Malware payload (Formbook)", "value": "28b7f8fac730848cd2a9becce97205b0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463495, "uuid": "fed5b846-bc24-4e95-a00a-8904d64cf5e1", "comment": "Malware payload (Formbook)", "value": "1449683482941dbd14be616af652ba869a9e922dfa2a3885c732931ebfd686c5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463495, "uuid": "1d76218a-1a77-40a0-9c4d-b6a05f466668", "comment": "Malware payload (Formbook)", "value": "0634727863cd8e13734acdcfa0b18a9b712c8abb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463495, "uuid": "c0409e3a-3c0e-4f8d-9de9-8773a3041b2d", "comment": "Malware payload (Formbook)", "value": "123dbdeffc67a3e2d202f07410f692218b2540048e95523cd532f16fac8880b3c58e96e08188b3368f9670edb05b1d3c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463495, "uuid": "5f8670c5-b393-4739-919a-aad1ed6e6cb0", "value": "T166A376883FC6F07193657433692FA0EEF27E0C91760C8196DAA760D4BE5CB18E2B595C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463495, "uuid": "2d2ebd11-b7aa-4a16-8ba2-4d8658503ebe", "value": "3072:O86fPJptwTmqAz7vcHk2CzlZR4GRricgg54oRuyrrP9pn19e6msCLP/:F6fPJptwqqAzsk2CzlZR4GRricgg54o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463495, "uuid": "ea1e22f8-c1db-4731-a755-b1fdf8b8cb69", "value": 101442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463495, "uuid": "b2b01527-374b-4097-a9c7-dc57e099e1b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463495, "uuid": "e87e1943-fa49-4026-ac7b-2aa14472458c", "value": "NYMPH THETIS VSL Q88.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fc901c-f1ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768466023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466023, "uuid": "7a72fd23-370e-47ca-a025-4cad128bf01f", "comment": "Malware payload", "value": "44ed12cfb7bf2296a34987cb92b0c176", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466023, "uuid": "368f82cc-623d-4994-a0a3-6dffb1b93f10", "comment": "Malware payload", "value": "14c326921d33c02e0b462ade8e50cf34f83e83ab5b82ea21a865d473aee2715a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466023, "uuid": "cce82774-fcea-4f0c-a4a5-04550d49f504", "comment": "Malware payload", "value": "fa0c67a3c019f70928fb7e39716b0d3b5c616b42", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466023, "uuid": "99b7119c-fce0-4bb7-8876-b27b8f8df720", "comment": "Malware payload", "value": "9e8b9d41bf916ca3947cc776bcc4781f98827d2723c2e901c5359f6e65fe9c36f3f2ae3827bc8e2c4f9a25ebc6020eba", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466023, "uuid": "b4a72d07-ecf7-4d9a-b5a0-070355719d69", "value": "T1C0A5337707B400ADE9F9CE024B202A85A97FF829D54151AE48A326F019FBFD631CF55E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466023, "uuid": "b79ad39e-8ae2-4cd3-8bc8-56703602143a", "value": "49152:tY2J0/M2it9eMj5lGfh2knLRH++23i8HtlMRjJrERUvZWxJPtZ:tY1iHeMjqskLd++2DHbMRVIOZWXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466023, "uuid": "2361dad4-0b77-4afb-b0b1-948f412ee202", "value": 2239218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466023, "uuid": "245ee1ad-bd70-4b11-80b1-a5e79366d7bd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466023, "uuid": "855b3f60-b2cb-4e0d-94e9-57d0f87ad7d3", "value": "MT-23537_TN-31953-R.1 NSS A179.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fec61b-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1768463448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463448, "uuid": "2fa0d17b-9324-4fbf-94f6-83cfe73b09e1", "comment": "Malware payload (XWorm)", "value": "0e4208aa1d865b134432ddc23a5a86e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463448, "uuid": "3ed836af-f285-4f10-a77c-99acb2583751", "comment": "Malware payload (XWorm)", "value": "15a9f29aaba59940714e92ef77712542ddb68ceb2f82f62ee85e30956ec23929", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463448, "uuid": "d0ff71b7-4522-44d1-867c-fbbb407d9020", "comment": "Malware payload (XWorm)", "value": "ffa29b152e062ea8ff61ce4aa4e087427ee0836e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463448, "uuid": "f9659a50-26f5-4896-92cb-fd2f531f3705", "comment": "Malware payload (XWorm)", "value": "97e90557e773e61fbce2c9c75be6f3d5c21cc358bc9ad272cde43a98158e65e46002a8aa3de3a884ee7f3f39b91dffe1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463448, "uuid": "79c6de56-e243-49c5-ba6b-f9cb5323aade", "value": "T179630D212D6B71698EDD4697A8349CBCCC70A3AFE114175816B52CACCB4FA0239FE75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463448, "uuid": "20bd2966-a7ec-4d2f-a2b6-baed375c50e2", "value": "1536:7SbzP65GOpT9sIGKnEGCx1d6p01Howdk04uqTSQCp:7SbzP65GOpT9sIGKntCx1d6p01HoQk0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463448, "uuid": "8612acf2-f618-46a6-b598-111da40896f8", "value": 67302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463448, "uuid": "0dc109fc-7e90-4171-8202-5d39704f6bc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463448, "uuid": "42ba6c93-8b3f-4da8-a9dc-1fb17c914e19", "value": "MV HG HONGKONG CARGO DOCS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29b5496-f262-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768516589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516589, "uuid": "f8643b1d-db64-4beb-ae69-61f4af53559a", "comment": "Malware payload", "value": "ea21c93c8093bef1c5745d11cce3853c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516589, "uuid": "c9d873bb-4c16-4b9b-998d-03384fdd346a", "comment": "Malware payload", "value": "163f78541c2fbdad128997534ecc2ad31b112f779347c526dd4e071a608de85c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516589, "uuid": "bb8074bf-ee63-4aaf-88d9-6340725199a3", "comment": "Malware payload", "value": "d684662b6504a1f7157a9f52fe838b0447dba4c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516589, "uuid": "a93c862c-129a-4bbe-b7ed-94a0035e36dc", "comment": "Malware payload", "value": "51f21e9adf05e7ed40e150abb19266f7554b6b4a435c3bb18b9f9d9fb9e1465ea6ae9b0b01904397636fb36b068a9a0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516589, "uuid": "70dabecb-9395-4673-904c-1cefeab2e8d0", "value": "T101567D57B90F3C22F3CBF77C9E4B9360A7177990D3225072B9164218DAC36D8C6B5AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516589, "uuid": "fdbc6104-b923-490b-a7a5-2486e4bcc789", "value": "98304:pQb0E6a6jn36FylX9OGfT1czRY06aESwpB4wH/E1AjJ6:pgJ6L36FylX9OGfq3ES4uwH/djJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768516589, "uuid": "d6b09bb8-f8de-400b-b94c-d04775aace98", "value": 6389008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768516589, "uuid": "12836977-8041-4e52-ae4d-95bd2a10189a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516589, "uuid": "852d2761-fe7d-47be-a10c-c78f9d48e604", "value": "xfitaarch.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f499e3-f1ec-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768466043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466043, "uuid": "4ad816af-67df-4a3e-a05e-205669d26062", "comment": "Malware payload (AsyncRAT)", "value": "377a443304310aeeee79546fe4cb80f6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466043, "uuid": "2a5fdd4d-b8df-4ca7-ab7a-3ce8ac3cc0f0", "comment": "Malware payload (AsyncRAT)", "value": "1644f13e5d0c4ad03970f04f894c8ef6fbba3fa99111e524932bbd70bb8d5fa7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466043, "uuid": "2e3a0667-670e-4280-bc9d-8a3582a0f212", "comment": "Malware payload (AsyncRAT)", "value": "1bca357c21a9ea7fbe5c6d224c2f7a22298c4896", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466043, "uuid": "e2326082-ac1e-4d45-92eb-c81892019a82", "comment": "Malware payload (AsyncRAT)", "value": "5b69893ec0ace5acd459dc094a64db35acd6f91416dded04af3bec1d22c7664efc25414448d99bf3da0388424dc3276d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466043, "uuid": "79c43bfe-6b06-4a6b-a233-6fd9f18add76", "value": "T10F24228639A64DD80BB95151E57ECE80CD4CCBE3645722863ADD02B42F6F7D0F12E89A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466043, "uuid": "dbf142a8-04d0-480c-916f-2e89f6c57ef8", "value": "6144:i/6CunMExHr92WLKVr7BHIUsqHHlBk+WF:SExHr9w7RDsqnDkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466043, "uuid": "27d57ebd-6b6f-44ea-94fa-04ff017da804", "value": 226821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466043, "uuid": "4b1e18b6-6955-44c9-9722-ed5907c3adb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466043, "uuid": "5b592de4-a3c4-4eae-907c-b60632f9a7fb", "value": "eaz.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eafef8e-f234-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768496772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496772, "uuid": "f53bb575-00e8-4fe3-b541-ab202c351b96", "comment": "Malware payload", "value": "2c5ed7e1e49cd7da03bf8a8b433da805", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496772, "uuid": "630c372a-ea1c-45ce-8e08-2eab037c7c11", "comment": "Malware payload", "value": "1656e2c4829e05f3f805f7f9d8d11ab4114f46a89c0b12ae0e085726fa51795a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496772, "uuid": "fd785148-3116-4073-a3fb-bd30bf497390", "comment": "Malware payload", "value": "ebb3c68ebc01d2dc7ec46a27800461309a431695", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496772, "uuid": "06fa85b1-ed5a-4b28-9467-57ff87919b79", "comment": "Malware payload", "value": "46dd16d25999018a5886c78f241e02b49b8927dfb7e20b5f86a740d02033efb295071b24e26cf1400e3c9dba9e6624b9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496772, "uuid": "3a153980-63f6-4f76-a259-816c46dc2071", "value": "T18945B635ED7358113854E328093FCEF6194799A4B9DCC3B19FD068F29F53886A2978B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496772, "uuid": "23ea6f86-40cd-479a-ab7d-4ececefc1e52", "value": "192:qQe1olRggrlckHXyj9o7j7Zrv/1D2BB2/282ZE2lOo2Hf2NNT:58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768496772, "uuid": "a1b9b9ce-43df-48d0-953d-8269270e523a", "value": 1266712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768496772, "uuid": "fe6c1d88-7e57-436f-b0d5-a8d0600fa8ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496772, "uuid": "f9f1cfd1-0b03-424c-ae8f-43d7a9d7ab6c", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b46ce70-f1f4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768469305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469305, "uuid": "f5cdd14d-065e-47a1-a756-839bcd6ef814", "comment": "Malware payload", "value": "777824f33b3430c165f59ae899f1b56a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469305, "uuid": "85a7dc81-1e1b-4a9f-bdb8-5dd1bf85d81c", "comment": "Malware payload", "value": "179d4cf1e8baee3cf92031fe7929eb4118b11dbf3098c293b8c2e0af39914238", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469305, "uuid": "67ba5711-e4d2-46a9-a115-3f8afff8c046", "comment": "Malware payload", "value": "dce199129469ff73f92737de6d76b989fe661c5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469305, "uuid": "3c088a69-b602-4d97-b072-b625051bf3fc", "comment": "Malware payload", "value": "da33337c464fbd61efa5f9ebb17c07647cc17320455db559a4f72da8352552448896b07451ff1c11efc7c16c1bf39a20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469305, "uuid": "ef61c091-5232-4710-8c9f-3d234687d101", "value": "T1EFB46C637B318F94E365D67006F389556D9812A60AF284C1937DCA207F60B6E281FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469305, "uuid": "0d893e7f-080c-404b-8c8a-9563b2cebec8", "value": "6144:PhsfOW9Fj+8TAm30oE6o9NPNvNuXi8cde49GJWX/Ls/+w+ZX2Xmks0FWSaHEIrTs:PhsfFGaD0ZXDBe49GgX4tWXO0S2EmlxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469305, "uuid": "bf116c7d-e311-4964-8545-cb851268f3a8", "value": 519831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469305, "uuid": "70be81ce-4752-4e01-b7af-ae4f023a090b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469305, "uuid": "e68512ec-a908-4149-95dc-79be6752dd2c", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0b7133-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478380, "uuid": "a45aec34-0c5a-4ef6-aaf4-ec680bab1e0d", "comment": "Malware payload (Mirai)", "value": "15d82e244395c25cb0fc9b01834d61e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478380, "uuid": "3bf20ba2-6315-4298-a7cc-522337719f9d", "comment": "Malware payload (Mirai)", "value": "194b3056aef89842958e0af0d0e8ac494f714cc31f5f9fcb9d179dfdb200d3f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478380, "uuid": "df453bb1-a317-4a81-af4d-51407e718704", "comment": "Malware payload (Mirai)", "value": "d948ea3b8f0a7be64cc4df72a86c4441835c3c56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478380, "uuid": "63b94ec8-510e-4868-99f6-5b792a4b24e2", "comment": "Malware payload (Mirai)", "value": "a6fbd18514be0171c3ef2c6780f2944c7e21c9b65ca198be9948edb077822501935812bc1dd873f18dcc970d1fc16258", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478380, "uuid": "2d460357-3ef6-486a-b9dc-fe86370f9b09", "value": "T1C443F157B2BB69B8D89E41B662FDBA4CB5021407521F42710B8DD39ECC365EE2433FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478380, "uuid": "3d3212cd-0790-43d1-839d-a1348997cefb", "value": "1536:T6LYc0O3JvaIISR4dxwJubexj1BuaDB84B4zJmcrH2:WMc0OBaDSGdxwJh3L84Blcr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478380, "uuid": "7312572a-7efb-48bd-a410-b72cc8c0bbef", "value": 57604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478380, "uuid": "209d7a4a-fbfc-412b-915d-35b29729b613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478380, "uuid": "cbd4e645-ba8d-4dbd-94e4-cefa4f2b3e8f", "value": "sumrak.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe543c4c-f200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474652, "uuid": "4b006081-0e7d-4d33-a94a-e5420703ff15", "comment": "Malware payload (Mirai)", "value": "81a85aec32c680df69735c03792aa40c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474652, "uuid": "15220314-706a-486a-a63c-30a60be1512b", "comment": "Malware payload (Mirai)", "value": "1a7b63431c88608448b1d53188757a8e540f60bcfa37d1abb48f55b62bd3021f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474652, "uuid": "b9853c28-1686-45d9-9208-fc86b286f9c7", "comment": "Malware payload (Mirai)", "value": "65cdd01165d4f90210f611c31a90641e03146069", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474652, "uuid": "f6ed90e6-401d-499a-a8e8-288c154ae52e", "comment": "Malware payload (Mirai)", "value": "7bf5a85fcb17bade976e8bd26579030561adb8819df4a2ed20e16dd814dba28c8d4c4eda944039432e52f3df033591b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474652, "uuid": "1205b5f7-2540-4a07-843b-27518c7d80a3", "value": "T15583F79278C29A16C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F0DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474652, "uuid": "6e7681ac-5c11-4f7e-9e25-707c8311db69", "value": "1536:MsCvlPf6NDyL9Jb0+pHXlzPhha0xT45An6ahWNr9UKW5fnHM35XzC:MsCvlPCuTxCAn1hiXWO3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474652, "uuid": "98ab0885-984b-41a3-9a65-6ef5fd984a4e", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474652, "uuid": "8f4bfa0a-ed3d-42be-92ba-20d640c3b451", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474652, "uuid": "7553fbfb-6aa7-49e2-afab-dd16e2d07898", "value": "UnHAnaAW.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc6df78-f1f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768469657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469657, "uuid": "f066c188-8278-4f07-8db4-0f7cc03254d7", "comment": "Malware payload", "value": "4ac50c7ed31fc19454548f5e38aeac67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469657, "uuid": "61c50ed4-ac17-49b2-9d74-e0b48ddb091e", "comment": "Malware payload", "value": "1ac406c11016108336b564c166121fa8ca95300d54ae5debb8003913e09082ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469657, "uuid": "ee803041-35ea-47a1-94e3-4b835578fd77", "comment": "Malware payload", "value": "b899278d2954a90f302a89985e35a5240aa13f83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469657, "uuid": "21ffa712-9c45-42e3-8dda-baf6c6672e19", "comment": "Malware payload", "value": "1191a7188a163f637554d8ec6fb0ba4eef09383584417663c8a870efbbd13f4210aae03869ed5208297f43c4b1d8ec47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469657, "uuid": "18eafc88-ac52-408b-98d8-6988574cb1a9", "value": "T15A04F14637010FB2CABA817109F78796FBF712C612D29657A72DD9009B95B8CB40BFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469657, "uuid": "5ce77a34-5a27-47c5-917c-a1d945224da5", "value": "3072:kgfKVeEOH4lcgjkBgqLVymaOAHvEqmlvp+4C8kVsBrzfInsSsStFuxht7wL:kbNR1mgqxRrKeB1fkVsB/f0sMzch6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469657, "uuid": "ecc8a98f-d182-4193-8b76-654c89e27194", "value": 180354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469657, "uuid": "a75ed4fa-5f14-437c-8d26-358c0c978adc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469657, "uuid": "5fed29e5-17ff-4ed0-879b-74bc209b9912", "value": "c74rmo09rp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60608e55-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435733, "uuid": "63347d4e-be8f-4029-948b-9635d67afd66", "comment": "Malware payload (Mirai)", "value": "339e0ec7518cefa691b7e9c50d4da1fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435733, "uuid": "869b05bf-b03c-4d76-a0f6-34b5abf9f717", "comment": "Malware payload (Mirai)", "value": "1b5244ed477766385e2feb71fa9c99821a220cdbb7ab774173002d9b4baf73bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435733, "uuid": "fb81fba1-d8aa-4c7a-a4f7-4f2010e70616", "comment": "Malware payload (Mirai)", "value": "861396d673b840191c368b3e0b54485e53cca766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435733, "uuid": "94e8f2d0-3cc1-4b41-af1c-013612c54cd6", "comment": "Malware payload (Mirai)", "value": "e07a973cfd9d7449ada926f19a934337b13566472b527960cf6552df40d96cb9e1ad83efd8c306e19294637e514d342a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435733, "uuid": "d5cd7cd9-f708-4bc5-9dfc-eddb4f134782", "value": "T10CC3AD36D42A79C4C0914534F4F09E751BB1A1C44257AEBB2AD9D5B900C3DA8FA0EFFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435733, "uuid": "6c9ff624-cf1e-4983-a316-8b0a13950ea3", "value": "3072:wwYYZdqZqMYn8wUjqblD3Pr9pvlEkYMEf:wEZaTwj3Prb6MEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435733, "uuid": "96d6e96c-2e2e-4820-8504-790a15ae4bed", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435733, "uuid": "c22d90eb-cd61-474e-b7f7-848d9dc9b5ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435733, "uuid": "61666cf0-8a91-436e-89eb-2db4e119b0b3", "value": "systemx64.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183a3f69-f20b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478991, "uuid": "d7dc6c1f-9dab-496d-8ed7-3a4b0aad1566", "comment": "Malware payload (Mirai)", "value": "2abe4731615b3c32110c2cb056dd4d26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478991, "uuid": "4717152a-03cc-46af-be24-ba752c043b53", "comment": "Malware payload (Mirai)", "value": "1b81441b82ef7b5f91b26dc488e048d19e056855a1058df6acdc8ff7fa078b32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478991, "uuid": "4af55d32-94f6-4a03-b6ef-618bf4fc7b94", "comment": "Malware payload (Mirai)", "value": "94fac6ad34c81d9305bb03d398a8f6855106ef8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478991, "uuid": "f6cb0e0f-7ef6-4f72-9df6-b2b4d79670d0", "comment": "Malware payload (Mirai)", "value": "4e4ad13e0f5c71f84ab5280570f38fb16c9139ff53fd64d0e9d4e1db26f5cef516a6e99954e15c80905631e93ed14a1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478991, "uuid": "323f0684-fe6c-4d02-941b-100f3c8008a2", "value": "T1724115CA21558F303CEE589BBFFA5C4A74D0A09B9DC12E1159E834E9448DF083F89A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478991, "uuid": "7e0ad89f-2be7-4e8c-a506-ff4e974f6858", "value": "24:vd1WQ1d+jwQ1dCOCRQ1dk0Q1dB0Q1do8Q1ddkQ1dmwZQ1dsr7sQ1dnXKQ1dNvOTh:v1OpU3MXBYOruV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478991, "uuid": "36199b33-3746-494f-846b-a0f4def107c4", "value": 2027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478991, "uuid": "609d5e08-3a1b-4b93-8fc0-85fdd02b06be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478991, "uuid": "10ac1c2f-8b91-46c5-aa9b-2a37bac518f8", "value": "76d32be0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b34624-f24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768508275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508275, "uuid": "79330d0a-47b5-48f5-a32c-3626a30afb65", "comment": "Malware payload", "value": "d3fa4fc860919b7f3fdc5348ba7292c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508275, "uuid": "7a644504-5957-4f4f-8e88-af3468a64d82", "comment": "Malware payload", "value": "1b823811c7dc6e2760dfb337de076c86956b7e70848603067de82a1dfd3001ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508275, "uuid": "33d47dd2-9ca9-4cc7-9f2d-43d7b5ef4353", "comment": "Malware payload", "value": "6ca9701b317440c2db69e946e1a249d6f2f9e117", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508275, "uuid": "2fb1fe00-1e2d-411e-b2fc-01a98c20ecf0", "comment": "Malware payload", "value": "3560c8cb33a904cbacd676a7055d1921c67a3bb3c3cdd5a607cebea712b7c716bee5b4799e408ac8a30e07af11a4d7a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508275, "uuid": "032720b7-1415-49e2-813a-4d1fb6586fe2", "value": "T1435309426E43EEB3D01331F912EB5B704E72FE365822A586F7693EB1EA052C1B50536D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508275, "uuid": "8d8618e4-8888-4b74-a988-daabae762726", "value": "1536:XDPWLaOmWFQJ1n2rqPLjz4fZGMUWtwFJFAeq:DdOeYrqPXz4fZTmhAeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768508275, "uuid": "a41c2016-dbca-4c61-a2c1-6f0b737a947c", "value": 65044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768508275, "uuid": "ea0af09b-becf-4745-a750-11524c504139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508275, "uuid": "649cb1c3-9dae-43e3-af6c-a2990e2c1d57", "value": "2016Nwji686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d3b5af-f238-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768498448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498448, "uuid": "3cd834e0-eb89-48d7-b259-1f541b5bd46d", "comment": "Malware payload", "value": "f0d3a7e85367282e9f57c7e561a67c3e", "object_relation": "md5", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498448, "uuid": "b003f30c-0bec-4620-a2de-4e4e1d663707", "comment": "Malware payload", "value": "1bb1c2c4be89e0c88563bb0fccee5e16ff910695bba78c8c43f3259d3f3f8ff0", "object_relation": "sha256", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498448, "uuid": "c593fa57-156d-4cb8-a9d2-df4b8b24da12", "comment": "Malware payload", "value": "a6bc65e26ef3bff3a53b017f1a4273f420f3f2b8", "object_relation": "sha1", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498448, "uuid": "39a867bc-039f-4510-88be-9d68f8e40869", "comment": "Malware payload", "value": "936c7bc06d61206ea926a43225df0771d1c6055b9ea850272dc42de38a1c8534bf84f2b15c75cf0c26e6856c28472cef", "object_relation": "sha3-384", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498448, "uuid": "655fbd16-1121-452e-8666-655f77fdd8bf", "value": "T15AD02307001D4205CCF3DC40FC53C3A2A343D6C0810A14A366D38C57581239492BFCCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498448, "uuid": "cef96107-ab0b-4126-9daa-7d5b797d6fab", "value": "6:hmRLt1U7NKz98XI1R3KujLh8JJwkWgR6Iy5zQQIjHzBW1AQQd7zn:wxGI98XI1kkG3wPIy50QIjHz4AQ0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768498448, "uuid": "bd7757c3-38ab-41c4-a17e-7d323ccc51b8", "value": 228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768498448, "uuid": "19150f35-efcb-4a09-970e-a156807b2588", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498448, "uuid": "933d1b7e-a342-48d7-ac99-a05025d4e195", "value": "a.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6b3b8f-f1e3-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768461927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461927, "uuid": "81e57991-8846-4f53-839a-6d96b2711f61", "comment": "Malware payload (AgentTesla)", "value": "8884a41159b3700157541d51b07b192a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461927, "uuid": "1c788c2f-02a0-460d-875d-749a7652830b", "comment": "Malware payload (AgentTesla)", "value": "1c06d6d987d0c8b8f82ceb29be9b738f27626266d3e6c706725698c8bacd5eb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461927, "uuid": "114c95ef-ee66-4062-8aca-6e4df7a03e7e", "comment": "Malware payload (AgentTesla)", "value": "76615354987dd2f50041d76633b132bf08ed22b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461927, "uuid": "0a88a1a7-f5d7-48d1-aa61-1b8adb7cf9fb", "comment": "Malware payload (AgentTesla)", "value": "b540ca4247d5ef5aa9863fbe8c18c8ae29ff3c66da0ddf5f7ade9d4c024d11103725c03a91ed6542ea4f033745be33a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461927, "uuid": "d202b8a5-a9b0-4443-abac-8dcecabc8d87", "value": "T1AF35AE0273D1C062FFAB91734B5AF6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461927, "uuid": "4efe5fa4-bd14-4eb4-80e0-535def2dd6a4", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461927, "uuid": "1908a29f-4ac2-48a5-a1c4-85f6651e3928", "value": "24576:p5EmXFtKaL4/oFe5T9yyXYfP1ijXdaJWs92CYE59l8:pPVt/LZeJbInQRaJW2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461927, "uuid": "d8f8f15c-bcf8-4099-ae6e-cf17cc5118a6", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461927, "uuid": "2059a8fe-c980-47cd-b544-59bb4b3230b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461927, "uuid": "afbbe449-a014-4b06-8874-69cbf28550a0", "value": "Notificaci\u00f3n de transacci\u00f3n BBVA n.\u00ba 700339 Pedido del cliente n.\u00ba 47132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612b8978-f1fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768473530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473530, "uuid": "62105804-c8c3-4495-ab86-a82c22fca9a1", "comment": "Malware payload (Mirai)", "value": "d9adcbac4272f8a95b068e1cad314f59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473530, "uuid": "565bbb5a-0988-4482-aac0-a70b4473ad18", "comment": "Malware payload (Mirai)", "value": "1c513038cf0e06e20aeac63558954efecba1b400564ea35cb1a14b68087c0051", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473530, "uuid": "a1cc4c1b-b5b5-4650-99c4-2b37252d805e", "comment": "Malware payload (Mirai)", "value": "7a05c53a00023f7e8b3fe3867a913d248eef6816", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473530, "uuid": "89cd761e-9c10-45e0-8a20-02167e695947", "comment": "Malware payload (Mirai)", "value": "47bd68ebaf2ead2b1d1c86189c0bcb4887bde8f0d211a0cf4769163568a77b972e4c9aea2a683e7063983ede2a6419e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473530, "uuid": "91b5dc73-dcd7-4279-8e04-c4d9739385b3", "value": "T1F931F09193D05D69C8E451BDAE570714B374AF40E0CE3222822C67595D1AEB86D27156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473530, "uuid": "b5e6d38c-db7f-4554-a2d5-6499f8ea18b3", "value": "24:uPd9KGpa7Urz/jlfiFXK1hH9Vev3gRGaJ9i9BBuLlgC3FiFiFNvk+D10yww:ul9KGpa7UrLZfI+J+Bu53AADp10yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768473530, "uuid": "6a9093e0-ecf6-47a2-ab31-3b298e84007d", "value": 1604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768473530, "uuid": "648bc305-aefd-426a-be99-fe775479cdf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473530, "uuid": "8cc323f5-0226-4454-876b-6a1ec947378b", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107a3009-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768500453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500453, "uuid": "04d212aa-25d2-4767-a18a-132981eac4e3", "comment": "Malware payload", "value": "911e0d9320bff2c2b01fa12bfc924fda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500453, "uuid": "bc30886b-731c-4335-ae7e-962f6532e834", "comment": "Malware payload", "value": "1d971ecb535f66b367264556aa031706ec71504e60258d4d35640ade33bcf170", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500453, "uuid": "26371b01-6cf2-4c8f-bbf3-ebf1308aae1c", "comment": "Malware payload", "value": "bc22901bb15651ba8a70ae8e5ea02a010cfea385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500453, "uuid": "8e09e891-40da-424b-bea4-12946d065fbe", "comment": "Malware payload", "value": "e1cb0e3de4a03c07a8fd5d6409d9a4145767afada1eb43d60c2fd5a1edd3966284880e0f6b831a4a219233a8e90e0c4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500453, "uuid": "0952524d-9ba8-4828-a001-2182cce89a94", "value": "T199124147A2D0CE3FC8D957384467122472B394BEDF629713064915B53F427E81E2EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500453, "uuid": "4fe188ba-0009-4323-9d2c-2c53a98148a0", "value": "96:GqTVJWWGXzS6WH5ML09V1J9G8Ym6+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHJZMWT1YmHhrsnurfjTr8sbnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500453, "uuid": "ce285e93-b71a-42f2-90b6-ad82e1b08d4b", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500453, "uuid": "66b69baa-ab9a-4dc6-b2c8-9978fbf88ecb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500453, "uuid": "dfb4e8f7-a2de-4fe7-9f9f-0854191ec413", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051afeb6-f232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495709, "uuid": "241aa1f7-f2cf-4910-a24b-f9ffe3cec9fa", "comment": "Malware payload (Mirai)", "value": "ef4eaa7754e6582b96359db2e3af21df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495709, "uuid": "feaf797d-98e4-4673-b236-ebf2d7a62715", "comment": "Malware payload (Mirai)", "value": "1e54387d2545094dae5a55b49056d73f076028cffa530f2b060104af7709cba8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495709, "uuid": "a027029b-bcf5-4008-a710-efdc9f6ec855", "comment": "Malware payload (Mirai)", "value": "5ee5edb744925e91d8c50893e1dac7a4b83f8313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495709, "uuid": "a1a0a706-c3d1-440b-a780-a860f7d2751c", "comment": "Malware payload (Mirai)", "value": "f53d0697eaaba552a0f7f090dd43bcf9040c53833660f4b4c212f09c34a1c96691b023756ed3adcfc86049e87d60b161", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495709, "uuid": "ea9391e4-70c4-4522-b180-3fd715ba4aef", "value": "T17004881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495709, "uuid": "54303b9d-9c13-43ef-bb48-e0e34b44fcac", "value": "3072:jg57R77LHZwbq1YSBan1yvbysxr1uWSdI:jglR77LHZ0Bqyy1xSdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495709, "uuid": "3d6de334-6514-4252-88e1-13bb3a0c2896", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495709, "uuid": "7c5e4789-f60c-45fa-8108-6cc8b97c4263", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495709, "uuid": "226e27cf-0326-4f90-9cf8-acf30a773e23", "value": "djmario.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55da7392-f213-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768482530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482530, "uuid": "15db9063-fa2d-4360-ba4c-544bbd9d8fce", "comment": "Malware payload", "value": "be1e2dbbb07531687023907fd34b8cdb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482530, "uuid": "37257e1a-ea87-4614-a120-581b102601cd", "comment": "Malware payload", "value": "1e5af12c6658e64f76f435e57e745dd07cd9e972c838b0808928b879324b0115", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482530, "uuid": "00d47fb2-140b-4006-aacf-1b140d564b23", "comment": "Malware payload", "value": "e881b8fc742530ae4a88895b07c4e61ab68d7a61", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482530, "uuid": "57e74b8d-c404-493f-bdd8-043ba11865e3", "comment": "Malware payload", "value": "912bb6569fb9af1e080bcfbfb0ea10a402d7820895eddadec655b6b172a40d279478457c466282ec02ee1dfe1e705db8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482530, "uuid": "bbfea95a-ae5c-40a4-8e6a-b0c91a075582", "value": "T1F082A4A58865176CCAF0637E6662C107D9AB8773C3221790BC9CC3087F323A995D2EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482530, "uuid": "c1b8509b-b081-4b96-b535-837b2bcc29bb", "value": "384:2ux/Iw+fg8NAF7Z9NPlwO8jS4v1E5m7BHHWUEtukaPEr:2KIw+fg8NAF77c+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768482530, "uuid": "105e6464-f88f-4af6-851f-4382af7e5ebc", "value": 17573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768482530, "uuid": "d8eafdf9-00b7-43f6-8da6-8620abee2f15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482530, "uuid": "0f50a3f5-e226-4b51-9ebc-29206c4ff3a1", "value": "main.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9679b02-f255-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768511071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511071, "uuid": "2df9dfca-e586-43c7-b213-cbac39e3ba3a", "comment": "Malware payload (Mirai)", "value": "b3c7aad0719b5d4d8895a2cc4d1e7ef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511071, "uuid": "200e4b07-f515-4328-810b-d8a954fbcd5e", "comment": "Malware payload (Mirai)", "value": "2064243209ee037dd2c9a32cbc481ad18389113a10b3405c2c0bb7ae996704fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511071, "uuid": "f8084146-a5d6-479e-b4a9-c25264e79c55", "comment": "Malware payload (Mirai)", "value": "1074114de1129cbf3434827f668fcba427174ece", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511071, "uuid": "52e184d2-0161-4df4-8df3-08bf635c47ef", "comment": "Malware payload (Mirai)", "value": "80ef8116d82ca2bda77b27e40d383d79f8b985b2678fdcc61154aab1f943579c6e525d99d53c527992e421bdf6b4708d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511071, "uuid": "e0fba947-3183-4464-a78b-9c0e7899153a", "value": "T107334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511071, "uuid": "44e37017-601f-46ec-b9e4-d11f68deeb03", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8TwJ:ivW3jdQGqt7Y+Z+zN9cGgI6bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768511071, "uuid": "854df9aa-a58d-4015-bf72-d39e4455f2c1", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768511071, "uuid": "0e66bec9-e13b-4453-8af7-7feffd5eea46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511071, "uuid": "565f256b-680b-49a6-b1f5-e54fd78e5fde", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c82ee1-f210-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768481453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481453, "uuid": "e077f7f6-6524-4164-98d2-d5fc4acd960e", "comment": "Malware payload (SalatStealer)", "value": "32afd89e97554cbbf917d60a9cc03863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481453, "uuid": "afdbb483-0ed5-4005-a32f-ea93b164d0fe", "comment": "Malware payload (SalatStealer)", "value": "20b75865a3a895749f18c2cc7deec8be6ec77152967038163f5784dc7bc6f236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481453, "uuid": "71a1dfb6-f037-4192-a543-63a79e27094f", "comment": "Malware payload (SalatStealer)", "value": "848c030b48c37cb755fc3d7056954893883a0386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481453, "uuid": "0d167f2d-c962-44e1-b8fb-5db1265ea4c4", "comment": "Malware payload (SalatStealer)", "value": "712f6f47b96a8a1fcc1e7e732732f67a83291f04a0d67ecab35561b5d14ba20692a28e3689f452cc97b238da88c1f154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481453, "uuid": "aafa21fc-251e-4401-aed7-f19b6fe31326", "value": "T1CEC65A51FA8B54F5E9031835409BB23F67355E048B28CBDBEB543F2AFC77692192B209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481453, "uuid": "f0894bf7-34db-4fd6-9690-9a2138b357f6", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481453, "uuid": "31b653a7-74c3-40d3-8a28-3864a089fdf4", "value": "49152:QUKvrW2x7BO+A3V/mZgDZRksZ88mxpUBPfvn6JunN5cTwHVn3v0QUlvyTXj0unn6:JSrW2lBE/T7jdEM601C7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768481453, "uuid": "e31dba1c-12d4-48aa-bf88-6b70f92336c3", "value": 11660288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768481453, "uuid": "36a6eb71-d0d9-425b-82f0-d32c72b9573d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481453, "uuid": "60acfb5e-791c-4afa-92ec-59de7c2e5986", "value": "EACobxod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53d71e0-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463336, "uuid": "7a57dac7-4f85-4e67-a367-2a224126c9ab", "comment": "Malware payload (Formbook)", "value": "abcfda1d6a1baefe6d1b5e65fc00f7fd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463336, "uuid": "5149262a-e4f7-4a4d-a020-280aa753bedd", "comment": "Malware payload (Formbook)", "value": "20baa9b69c32db4899eae270b9ea70742c006cdb272ff59d3b912c9962a13e5a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463336, "uuid": "53289339-83d1-4a0c-8a42-c6205a34d426", "comment": "Malware payload (Formbook)", "value": "f1ac06caada576860315492a9ecefc818ccef4b2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463336, "uuid": "9609fbd6-b918-4221-95dc-a7808825c626", "comment": "Malware payload (Formbook)", "value": "85e1dc7be370ea7f2d402b08d47501f4bf394102ae518d5194f8b6fbc668193d61a9c54f2b70a27dcc2b008088711c90", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463336, "uuid": "75722bdf-b35b-4ff3-a344-33056ffd3b26", "value": "T11673629D3BD6F467535130333B2BA0ABF12F9C42748C8091E39665D8FABD708C975A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463336, "uuid": "29586f76-3be0-43da-88aa-691b4b9134e3", "value": "1536:6cGYwoH+9s82xuRyPHr7GR+ycpy5PtYJrlj6WIHG:gYrPE+yiyVtYJrlj6WIHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463336, "uuid": "54415b7f-1c4f-4fe7-9a54-8e0d8fec217f", "value": 77341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463336, "uuid": "8d4735cf-a728-4b1a-a138-947277484e6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463336, "uuid": "202acea6-0660-415d-b5c0-e2a323cf25aa", "value": "Payment Instruction.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9a15e3-f1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768449608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768449608, "uuid": "f32c63ab-0e91-4c2b-82ff-7e510114eba8", "comment": "Malware payload (AgentTesla)", "value": "558d1ddb72528e18f81f41065456e117", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768449608, "uuid": "9880624d-8cd4-472e-8775-1b60c5122a03", "comment": "Malware payload (AgentTesla)", "value": "214f81361ecc2893d57465ef2c57662f7d60b2ea06408d6a40d6982f0c484e40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768449608, "uuid": "02120713-e7e2-40a7-97d9-eaa0a575b9da", "comment": "Malware payload (AgentTesla)", "value": "73f730189092a54ac2f03baaf6cb011c71250143", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768449608, "uuid": "9f8bd7a1-d7eb-4c7d-adb5-9b5e759c1c18", "comment": "Malware payload (AgentTesla)", "value": "a796f3154529f3a576b4824ed7c0bbaf04e1907737da6f805592ffdbd85cd5ab935cb95a6cd49d66e4df71489f730f09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768449608, "uuid": "ba61ceb0-69a9-4c03-bdea-67490bd2084b", "value": "T10435ADEF7545E417C9929A31F417E1F50B2C0E8A9E408167E6ACBE8F3CA452B58C63D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768449608, "uuid": "1f4e1c63-59d9-4ae5-937f-eb4a97273a86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768449608, "uuid": "ebd6028e-70e4-4bf2-bf93-404e50d6df75", "value": "24576:ukWXPbAjwx1knhPRUgAaqmgtQIdRW8q/FO8:uPXfkh2mgtSRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768449608, "uuid": "e333d3fd-df52-4925-ae1f-41ad8f6ad63d", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768449608, "uuid": "338a7145-4a06-4592-b174-0529a05aadad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768449608, "uuid": "1e023289-f3bd-44ca-866a-6dfc1d7fde8b", "value": "rAWB-TRACKINGShippingDocuments.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dfa9d0-f232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495704, "uuid": "8f39bc97-a2b9-4d9b-a99f-c481f8b41c39", "comment": "Malware payload (Mirai)", "value": "0b89bd3410673646f69498ec33fcb9b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495704, "uuid": "2763e88b-7eac-46b9-9a75-a8be02165fbf", "comment": "Malware payload (Mirai)", "value": "216bc844451868628bedb68b6968b4627968bde0593e00de0853831f10dc635f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495704, "uuid": "634a5f60-bdc8-495e-8799-a86946e02fdd", "comment": "Malware payload (Mirai)", "value": "1ec4840e238f4919c38aea5cc53bc641628e05bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495704, "uuid": "b0669c72-1b40-45f9-9ff2-9fec06ee3114", "comment": "Malware payload (Mirai)", "value": "7097d76cca134ba3b5aa63ea2cf6c54bab187124b54ce553c03f655d1b1b5a68cae49d2da971f0836a2ada83958515bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495704, "uuid": "9ff83405-ca40-4da4-b51f-ac5d5a29368e", "value": "T147D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495704, "uuid": "8ce9d5e0-50dc-4d66-98b0-d634a10f1ef8", "value": "3072:79eSuygEPjt6qkWq9dymDnYMb0YBd/gQyVGsdqml6/aj:79eSuygEPjt6qkWq2mH2la/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495704, "uuid": "b56377fc-39f1-4384-b5ef-d09df9ff29e4", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495704, "uuid": "284d9a14-38b5-47aa-a214-144370ae1f9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495704, "uuid": "df521adc-41c1-476a-8889-881818b115d2", "value": "djmario.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961a292a-f20c-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1768479632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479632, "uuid": "49a60722-8700-4795-abe1-400443c7b4ea", "comment": "Malware payload (MaskGramStealer)", "value": "5c9806752d69f7cbce9bffff25828553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479632, "uuid": "722029b6-c0f6-4b5a-be36-cf7a5cac6e15", "comment": "Malware payload (MaskGramStealer)", "value": "21add12ed1120f8d211bbe635ed95d37c1c87e9f4454bbe8d328dd4d8ccee288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479632, "uuid": "6ea421c8-7869-44cd-830c-22ab30810e14", "comment": "Malware payload (MaskGramStealer)", "value": "7b452c94c54c683470c903acfd14a10aff5b4716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479632, "uuid": "ac310367-e6ea-46bb-9ca7-acc7eabc1c3b", "comment": "Malware payload (MaskGramStealer)", "value": "76ca043c74a5d2f83f496e2593ee4df97748d9cf0316d1ce4f03e925324320ed042af09741ad099fb2738b6b99b37971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479632, "uuid": "959c3af1-bdab-4c25-98b6-c92e8d6d2051", "value": "T18D04F1BE49FDE64BF5B4E4B8E0089F859860B61D5F1D7693877AD1B033308442A2E3E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479632, "uuid": "446ba7c8-4b76-4b5c-a970-2782eebb4971", "value": "889d7d9bd78af47c7881d69d79690e91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479632, "uuid": "eb157d01-1841-4855-b259-4808f9723901", "value": "3072:/UCxep801cJu0o2xzdr8xQpButB9TrEge9KHjR9hIlm9CPZlKIPu7zw4q8OnohdU:FP01yxpst4WDRfl2YIPunf3KWno3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768479632, "uuid": "3258bf65-b252-4d73-9440-bfe34abe31e5", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768479632, "uuid": "bc69491b-13b6-455a-98e7-34593433b58f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479632, "uuid": "20a62509-d202-4084-a0b7-826a48d1a826", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839373f1-f20d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768480030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480030, "uuid": "e79fdadf-e7cf-4c4a-8df5-a9abd2b04787", "comment": "Malware payload (Vidar)", "value": "46f196884ad6805093c3b67a3cdbde05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480030, "uuid": "8baf1955-0209-4bad-bd9d-a63983a50fb1", "comment": "Malware payload (Vidar)", "value": "2268924c36c128c5ad27cb3074c163fe239f385c70ee556e58dbf8c92c053cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480030, "uuid": "a7279577-1c53-432d-8be1-2b1366af81aa", "comment": "Malware payload (Vidar)", "value": "31ba7cff9876c3fe4b0b48f1351067c8eba95a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480030, "uuid": "dc26c1fd-bd67-40f1-ba2f-d64542e954b1", "comment": "Malware payload (Vidar)", "value": "5893c34c2975e51950a460cb6157107938afd0a72652f2ba21a904fbc3f86cc612f9c231f9b61ab6bfcbbd789b3cf8c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480030, "uuid": "2349ac18-a4e1-4891-906e-02924552b2c3", "value": "T1EBA56A0BBC9444B5D2AB52B18DB65299BA71B8510F2023C72F5373B82FF73E59835B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480030, "uuid": "944fe585-9d2c-4470-986d-2d5827e3d1dc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480030, "uuid": "8a090019-206b-497f-bddc-63265fe76792", "value": "24576:D6yNv8llE/irFbRAvhY0+i+weuzFrB1SbN23Jy59tGMUjeleN4j42Wcgy2o20:D6CvOlEwFbivhBUyN1SbN25OUxM2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768480030, "uuid": "28a4ba2b-f700-4241-8a8a-28f07857e748", "value": 2089984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768480030, "uuid": "4413fba2-f371-4a79-a488-58dc2c1c34e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480030, "uuid": "01543d55-b86a-45b9-bd32-37e73941f52c", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb14ab1-f210-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1768481231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481231, "uuid": "32a16353-e10f-4a30-b9c8-b3ae9a099f77", "comment": "Malware payload (MaskGramStealer)", "value": "4f365bd6ca367d0b8c1008dca6416dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481231, "uuid": "811097a7-4991-4bbe-be69-e630bc12bdd5", "comment": "Malware payload (MaskGramStealer)", "value": "23c758e56e0f7f446f5a07e3d9321eb40d764044ad455f6276b476552d390015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481231, "uuid": "e407eb95-82ac-490c-814f-85517d2f4044", "comment": "Malware payload (MaskGramStealer)", "value": "63fdbe0d66bea58637f03a1a3b542d576f3f7084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481231, "uuid": "e09c2353-a7c4-4952-b53f-5d858021ff6a", "comment": "Malware payload (MaskGramStealer)", "value": "2b6b86a30ab8830cd34c351aaf13e842376b229e1c5086f8f1eeb96c3843f13dfe196b7bbbf41342110e199125214526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481231, "uuid": "1eb34a87-6620-496c-be42-1ccb589c0a35", "value": "T109B56C0BFCA20DFAC0A9A2318876919ABB61BC451F3113D72E90B7B82F72BD05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481231, "uuid": "7f494c14-f2da-46d7-b5ca-4cb873f2c50f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481231, "uuid": "c09881dd-8ff0-48ea-8c88-fe5977dce262", "value": "24576:qR2aNcgrCaoC85hEV77rYMPrT37WaVbOq5nTcFGGmcoeleTNj4HGu2+oc3rtSf/:qR2MDrCC8HEVn84PPVbzTDUmP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768481231, "uuid": "5dd166f7-08bf-4176-a88c-206eee5daf8d", "value": 2416640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768481231, "uuid": "462f5bc0-2fcd-437e-8c5f-583b781846ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481231, "uuid": "729452c8-3c9c-4371-9abc-c36ef7d7e9f9", "value": "v\u0435xon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7338d4a2-f1f3-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768468836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768468836, "uuid": "3b2aa2e1-a497-40a9-aa89-8bd80f20bc0e", "comment": "Malware payload (AsyncRAT)", "value": "043fe59ad36f2379893b6cf415ef7ac7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768468836, "uuid": "cb58b0be-b2f8-4ab7-a1cf-60ae0d61d525", "comment": "Malware payload (AsyncRAT)", "value": "24c39f968e8e2a724ea14bfadd8c871f7a2160c2fcdf3d824e9b00af2cf80a50", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768468836, "uuid": "ec3f9865-7a23-483d-9d1c-bdb9a0c79f4a", "comment": "Malware payload (AsyncRAT)", "value": "00df144618916de19c8459447f9eb39c33f78600", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768468836, "uuid": "b87d6eca-bc03-4b0f-9a2d-284c99ee86fa", "comment": "Malware payload (AsyncRAT)", "value": "5bfa8f603eacb99c313d3342752127c132f2c3e5e459eeef939d77d8d99ee8a5ec59178ca0a068f84722be5bf9bb97cb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768468836, "uuid": "57821184-7995-4bac-8849-9b28f100dba6", "value": "T184536D003BE88127F2BE4F789CE26145467AF6737602D94E2CE4C1975713FC69A42AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768468836, "uuid": "5dbe3c5a-afbf-463a-b3d9-dd7f6ab40467", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768468836, "uuid": "6a894852-bfb0-44b9-a03e-1f11f3f72447", "value": "1536:5umpZTEqJ2oUpKzw0bMXSrEsHdOHNwiRZBI1Y8BN:5umLTEqJ20zw0bMSHwtBkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768468836, "uuid": "068daeed-ad74-48eb-b38d-5cb86550db59", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768468836, "uuid": "7376135f-b3aa-4b27-89c8-cd00711d3372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768468836, "uuid": "2da17e97-baaf-4ddb-910f-d3a1f722f503", "value": "MetaSecureEdge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641ce15a-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (DestinyStealer)", "timestamp": 1768463656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463656, "uuid": "7b002ba0-147b-449e-92c8-5edd7b9f2594", "comment": "Malware payload (DestinyStealer)", "value": "64046c67e096a637fd8c70482c947960", "object_relation": "md5", "Tag": [ { "name": "DestinyStealer", "colour": "#059BE5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463656, "uuid": "b4ebe78f-f295-41d1-84fa-5b206d4c5876", "comment": "Malware payload (DestinyStealer)", "value": "25bcebc19dfd1a2b43a7c5c69215eda70b1f9a35a7c9c02ca261e20f91b7a442", "object_relation": "sha256", "Tag": [ { "name": "DestinyStealer", "colour": "#059BE5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463656, "uuid": "91c17227-08b9-4c1d-b027-195152eaf318", "comment": "Malware payload (DestinyStealer)", "value": "267826dbcb947b0e6c9a7a10afd9d9c7e11f0574", "object_relation": "sha1", "Tag": [ { "name": "DestinyStealer", "colour": "#059BE5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463656, "uuid": "3cfc8cb6-5151-4499-bc97-70f8c870d654", "comment": "Malware payload (DestinyStealer)", "value": "8472538891e649d41824161774d7420ba01f34c9f3e0c6ff265ed386535c32241c9c19c1d1030a9a33a1d4dbc597a645", "object_relation": "sha3-384", "Tag": [ { "name": "DestinyStealer", "colour": "#059BE5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463656, "uuid": "51c7a103-0f45-4846-acc6-db104644b8eb", "value": "T16E510B3017F6131CE6B2AB75A8F9A251DAB3BD14EE319A4E011D02190B13600DC71F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463656, "uuid": "67ff6868-8ab7-4406-ae1b-287b69aaac04", "value": "24:8W0xJLC1n6RwvKiI8W2ALOWkp+/CWWWiPMov3A/ZJPyX1BfuwqyLlhcizriZKiO/:8W8M6Y8tho/A3gme7pFi3MOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463656, "uuid": "caa36185-7d8e-4e53-89d3-cf3580607914", "value": 3114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463656, "uuid": "793472a1-6247-4ea8-bfba-5978bde2707c", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463656, "uuid": "79ccdd90-a508-46c3-af62-35045c8e986b", "value": "Air Way bill.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001b91d6-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1768478091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478091, "uuid": "4d5da3cd-2013-461d-b791-1cbb0f8ab2d0", "comment": "Malware payload (Stealc)", "value": "3a8018968495b6975d04d3a866fac952", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478091, "uuid": "bf34c0e0-2a3b-4aa0-b1b1-601913addba5", "comment": "Malware payload (Stealc)", "value": "26a730271fc63e71097339ae35df04983b59f8323136bd28e5dc58f1f5c2f64a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478091, "uuid": "859f9c9b-733f-452c-9ae6-a556300f5032", "comment": "Malware payload (Stealc)", "value": "d11a2993f2887d34c353a2737880991a3d89939d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478091, "uuid": "543018a0-d58d-47db-8a87-52db78535c1b", "comment": "Malware payload (Stealc)", "value": "8cbd7b2ee9e30f3546eff420f78ee8fe58d729658c29d3a9e668e76f5ea038f67ae0fd2b6d8f71f6e5b38e594470f8bf", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478091, "uuid": "15f66cf3-8ad0-4506-8425-09a004b21312", "value": "T19555124DBB22AA19C75C1FBBC413660980FA445BD536F26309DA1DE20F3A744C99FE93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478091, "uuid": "681a5554-0d5d-40c7-b4f0-dd0c1bedae1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478091, "uuid": "b734dede-647f-4941-bf1a-b1b59b32f6e1", "value": "24576:9Okvt87DGbRB5x72cKNl0/Yq5XhRFOvjvMNiTcPObGyATvWTlL37ZhByTaU9S2nH:93YDGbRB37WNllYF8jvMEwPObG1+FZh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478091, "uuid": "3fe48d15-f099-44fe-8bf1-c53f53278f4c", "value": 1369088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478091, "uuid": "db0ada2a-cbb8-44bb-b933-26f3f210fa38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478091, "uuid": "f3a08899-94cb-4e52-bf94-8b6aa4d114fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee8cb89-f1fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768473526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473526, "uuid": "5006a6a4-709f-4469-9662-e26ed78d96f3", "comment": "Malware payload (Mirai)", "value": "a91a15054e3fe67274b1cbbaf53892a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473526, "uuid": "5e5619ce-ef1c-4c36-a0e5-bfab7f107fbc", "comment": "Malware payload (Mirai)", "value": "26c766a410eb8a03a90c3db7eb6508bb4ab5d215d5735de387e1566c5480d32a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473526, "uuid": "6b48203c-b22e-4227-bc36-84d310c808a9", "comment": "Malware payload (Mirai)", "value": "70838905a6dbdc7f3876fd3266828daa10370650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473526, "uuid": "20d10672-e009-4305-84e1-ee2a13fa9dbe", "comment": "Malware payload (Mirai)", "value": "83b4b11c949be4213153979fe9411e6291f93d27bac57a0d22783aa19b49453400cc506d165a34d0a8a8455cc1117377", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473526, "uuid": "e1f3ba60-c90f-41e3-b7e6-0635fadbf958", "value": "T12531129293D05D79CCD4A0BEEEA243207374BF80E0C672529618BB94BE19EF85D22056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473526, "uuid": "b6a0ac19-8b6b-45e3-a20c-477e340d6946", "value": "24:DpKGpa7Urz/jlfiFXK1hH9Vev3gRGaJ9iM3BBuDC+FiFiFiFcrO+kgzP6eh:DpKGpa7UrLZfI+JhBum+AAAertPLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768473526, "uuid": "e9be0200-1b3c-4b76-996a-63e2dd2bf393", "value": 1576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768473526, "uuid": "9eb860fc-d18a-4fc4-9fa3-2c0b7c418248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473526, "uuid": "275890b5-cc34-4f98-80ee-1d9c957dda85", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6e7dba-f1e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768461494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461494, "uuid": "d0ed7f14-8125-4a6e-836a-670d0d8de71b", "comment": "Malware payload", "value": "0c09a3e8cbdad58653eaf67cc9cf5a38", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461494, "uuid": "f95f6261-680c-4bbd-9902-a51e125dbeb3", "comment": "Malware payload", "value": "27442c5c003af23010f2d4dc3678dcfee80f9cea5ac835ba17d6bead7964dac2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461494, "uuid": "487460d1-714e-41b5-85a4-0d7add69947c", "comment": "Malware payload", "value": "bec53042164bfab95832d7fa40f01027afdc5d60", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461494, "uuid": "7ed3805a-83a1-43f6-8a61-d7ed2b55b4c6", "comment": "Malware payload", "value": "c36277cd3c066bcff5d73a4a035414d89583d7622756dadc3a19df971e7426828bd9aa76afe2baf2e3500869836ade0f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461494, "uuid": "fb98e09b-ea7e-403d-a694-471dbd29ac0f", "value": "T1F5F502C4C8532870AB2D6811CB5F9A3D201F74B366365E296E5872A8BE5C4F3CDA51FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461494, "uuid": "793052c1-6409-4689-af16-77d524bd241e", "value": "49152:WkkjAXFu0cM9U1Njv1bebwE6+noiUA5SBRqvmwdiLoCQbb+u0cS9Xho:Wksj96oxLBR6mjsb+u0hXho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461494, "uuid": "ad8021f2-ca4e-4244-aa76-9623f9e20821", "value": 3334010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461494, "uuid": "0981b461-8bd1-40c8-8445-3bf80e484205", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461494, "uuid": "0a0994d6-a003-406a-89e3-05f00085f658", "value": "BadaTek_New_Order_2026-01-13.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a9965a-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768466108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466108, "uuid": "7b0c43ca-2988-4a8b-bad7-3d1817a2c6bc", "comment": "Malware payload", "value": "87f4493a719c736707b6348714e6a8e7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466108, "uuid": "4437c831-7060-4a92-87bc-ad6f6f5a8488", "comment": "Malware payload", "value": "2781dcf99bbe3aedd7ae2a9f9ca7d097676d1df2bd2fa3878e9874849bd0cbb6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466108, "uuid": "1802b78c-39fc-4eab-b613-4cec8858c278", "comment": "Malware payload", "value": "aacb89382f24bbd6d1ef0573f82b6e9519fad9b5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466108, "uuid": "90aca9d5-0066-4ee4-8228-2d2d054d943d", "comment": "Malware payload", "value": "eba412450318986936ee4936cfa85c63770587b38904df1dac99ac95c0dc978d4da261bb070db1e27d302d34ed2b84a9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466108, "uuid": "710113ac-8300-4b6a-ab3d-63f4548b46ba", "value": "T1F51633109F595DAA0B3C833C30BB7F5EBEB14B966888E4C767E9609B434EB41112FD19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466108, "uuid": "f3446517-361c-4d12-946f-ca5349375a47", "value": "49152:VMo83y0h3Ra1i8ury60EosSmGZv64t5fYoa2hO2f+PP8yWe:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466108, "uuid": "89dfe321-f526-47b7-96ee-ef4a9fab5d90", "value": 4039853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466108, "uuid": "b576eeed-d867-4c51-83ae-7e18ce50d667", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466108, "uuid": "f0f4db4b-e102-45b0-ba2e-d56fd1215ea3", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751020e9-f1e3-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768461967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461967, "uuid": "fc8ae572-9f34-48ec-ad9a-379e73951982", "comment": "Malware payload (RemcosRAT)", "value": "bdd08caad711c183654f6c95680f4f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461967, "uuid": "23d62aa9-64b3-40b5-8c8d-5b9cc2f00bc8", "comment": "Malware payload (RemcosRAT)", "value": "27ec2b5eec31bcba30eb7c61b6d0cd60bb36716a397bdcb40f2061866519cb02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461967, "uuid": "1e08e988-c386-4a6a-a112-075745c4d9c4", "comment": "Malware payload (RemcosRAT)", "value": "789366587d5365571b76c99130d5528edb2b922e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461967, "uuid": "22b08149-baee-427d-8283-9a6753b99dbe", "comment": "Malware payload (RemcosRAT)", "value": "450162b88ec62887a1bb59014dbc0429b8b9ba3ba2618c8192c53bceb5bf7b2a57669e3cf3be2709da894597252df0f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461967, "uuid": "02f3eed7-45dd-4628-854e-b4acf83168ba", "value": "T1BC5501081759CE03D6A01BF11931E2B05778BEEEBA21D38B8FDEBEDB74A57409954702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461967, "uuid": "2c914e60-6c83-4baf-8f07-fce484df071b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461967, "uuid": "9944365f-ac42-40cc-8f5d-c40636a096ea", "value": "24576:69K1+/o7i6Bko2ZitLX6woz5NqWeiXNPVq8iA8uw3nEV+pS:69YDvBIEB6woz5Rjqb6Oq+pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461967, "uuid": "439ef2cb-1ea6-4254-a938-9957b70697e6", "value": 1315848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461967, "uuid": "2cbb789d-4a75-472b-bb5e-26b3265435f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461967, "uuid": "1d8ca162-e791-4009-9aa3-508a81133d5d", "value": "Abkar Elekt specifications dimn_siparis 1000 Metre,H07RN-F-NHXMH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23387b25-f1e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768460541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460541, "uuid": "188b49ea-5438-45b9-947a-2f7afd7a9d7e", "comment": "Malware payload", "value": "1b0e796e5d141b7a95ad0992e0934cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460541, "uuid": "1596a1cd-831f-4c4e-960e-a84cb117bf82", "comment": "Malware payload", "value": "28a75c6bc35b6d5271bc6f88aa7045736322eb7182d2a024b9a1e2a1afb6cde2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460541, "uuid": "2ed935ed-51f0-405c-9312-3ad123dfc4e6", "comment": "Malware payload", "value": "c9ffc1afda3d51650fd6ef20c1d9ad71029ee5bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460541, "uuid": "3bb5a035-dd13-4085-b582-a0bc9c15a968", "comment": "Malware payload", "value": "3990256e3ba325b42a3d381630117f3cb9b909f062a462d927666d0acab499390a804c0caf62fd8303a1dd26f5e1b0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460541, "uuid": "c341b39f-d7e5-4ae4-9701-2e15fcd6ce08", "value": "T1D3A175519A119554E8E165F6D3EB8AB970384711231C01CBA2BC69C93330ADFFFB7E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460541, "uuid": "c72ae8e4-98fd-4548-b0ad-7a6eeb114cdb", "value": "48:jx9FKRhsfcpVMoPxKp+CFco7U2A4Y/+lk3Cr02wiBsKme0MhuS6qaFdyEp8x0FvL:LQ3tLwpF2/2A4Yn92wgmeB6qaXROuD2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768460541, "uuid": "75a1e1a8-9fbe-46d7-86df-54e22c108e20", "value": 4778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768460541, "uuid": "033878ae-2824-41ca-9036-b0411add3f91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460541, "uuid": "024205c7-c65e-4897-9163-0b97a2efd56d", "value": "1b0e796e5d141b7a95ad0992e0934cf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd13ab3-f1b4-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1768441637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768441637, "uuid": "b212c1a0-6418-482c-8922-638710deb545", "comment": "Malware payload (Stealc)", "value": "88fe502adf2060827926b70c4b741100", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768441637, "uuid": "4b4278ac-3a48-4216-8b64-2573b64625a3", "comment": "Malware payload (Stealc)", "value": "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768441637, "uuid": "a57b18e3-2a85-473c-b1e4-7e2aa7da9253", "comment": "Malware payload (Stealc)", "value": "9bd2a64cd5448031ee98b78f4822d2adc69b48c9", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768441637, "uuid": "5319af58-33fd-448c-8b7c-06c9898a275b", "comment": "Malware payload (Stealc)", "value": "958bac9028ea1ff845369ccca0acf837d35f8741a610b0f66fd278bbad544c6de9a5fc184e3a192d05829fb07a16aaae", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768441637, "uuid": "a7764447-3ef8-4cc4-a96e-1b198bd5ce80", "value": "T1B1955B0ABCD146FAC0AA7332C9B252927B75B80D0B3223DB2E50667C3F7A6D45D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768441637, "uuid": "c86c4979-7281-4b78-bff5-afaa85a39773", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768441637, "uuid": "3d4f6ad6-4b48-47e7-8c3e-669959450192", "value": "24576:nOu94WXpDcM/qQZy8268QilMTpiF9O2n5w99CgIdf/DeleNKj4HS7FL:nVKW5DsQlyQ848v7nU9XIUUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768441637, "uuid": "4f49cbe8-6c07-4544-9c1f-ebf2f815d4fe", "value": 1877504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768441637, "uuid": "94c4c6c1-31f4-4073-bd12-61b264df39d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768441637, "uuid": "fc551552-52d6-455b-a42d-88f2545f098c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbb9cda-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463458, "uuid": "e93c49b7-ecb8-448d-81d1-171ca38f1139", "comment": "Malware payload (Formbook)", "value": "951097c2f2c77d148b3627404eccb319", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463458, "uuid": "098bec45-62f3-462d-a9cb-61e1d08f1a88", "comment": "Malware payload (Formbook)", "value": "296a8693f74887b5ed32b429d98d65793f4061ebffb2bf9491171325922b4768", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463458, "uuid": "717552fe-8144-437f-a815-3e3c99691182", "comment": "Malware payload (Formbook)", "value": "7d5fdc48da07288499f2f8eea9f7ebac176a9b88", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463458, "uuid": "6ca7f71b-a56f-4e2f-89fd-502a91d2174e", "comment": "Malware payload (Formbook)", "value": "a164e1d90d3cf38694c518a520b19a830d9122c73ac823eb06252c6cd7971c700b5eed4419ea50ae4d5dd39f19181b3e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463458, "uuid": "191dbf85-5791-4c7e-a4c1-149beb3e9656", "value": "T12B7374DD7BE7F475139168337A2BB05AF22E4C80754C4191D29A6585FA38B08EF3BA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463458, "uuid": "1b5fae3b-8393-4f11-a918-f7787d4ba99a", "value": "1536:e72aviADD8KXPZvFb2Fzf66NvgqgHaRmgsXnHjBvy5gTnHqbxrh:e724iAfhFbYcoR1sXDBvyUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463458, "uuid": "9bf0b9ea-4960-4d90-b4a8-dff930566e29", "value": 79930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463458, "uuid": "aced0d1b-55bf-45d2-aa8a-296861ed2e7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463458, "uuid": "6c546ce6-df07-4795-a6a2-77cd371611f2", "value": "NEW ORDER2-8442026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec586398-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478488, "uuid": "d26371de-6296-46ec-a852-ef284e0e7ba5", "comment": "Malware payload (Mirai)", "value": "b67ecfccf6d34ad1ff129e0041dce7b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478488, "uuid": "aa3e849c-dc54-4c81-a4b5-0d673a6f552a", "comment": "Malware payload (Mirai)", "value": "2bd7e5809ae5ef29ee02eb0c8c3b482d15da03270831ed002489efce7da5f107", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478488, "uuid": "0e9a4afc-8192-40c5-832a-d6768a248946", "comment": "Malware payload (Mirai)", "value": "1b3c36a3a7841310f5f4ae8bd73dcb83ad2f4199", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478488, "uuid": "c21a1779-d68d-433b-8438-aaa79c68f27b", "comment": "Malware payload (Mirai)", "value": "74697e40c56f58e5d677883333398daf3062653adf8b8fc935245da8e93579a4b99efa7281ab103f64d5ac7cf29b45eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478488, "uuid": "e19b2128-9765-4ce2-87e5-a65bf86311ea", "value": "T176F33B56F6405B13C0C32B76FA9F42153322DB54D3EB73069928AFF43F8669A4E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478488, "uuid": "a3448a2f-ee12-4f87-907e-96103d580b5d", "value": "3072:YJXNVieqCyaFdNKWMmneON7cNVdxLpfeEvjM/9QczKyh/M:OnyaFdNKWnneqcjdppfeEbM/97h/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478488, "uuid": "fc42e432-a731-4584-816f-1cc4c8a678a3", "value": 157636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478488, "uuid": "f6aaee6e-5f3a-4ee8-8f0c-aec7c0a5dd5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478488, "uuid": "24aae7f2-ff81-43db-af32-0ebe8beea2dd", "value": "sumrak.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe64540c-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478518, "uuid": "dce31a96-1809-4f42-9a8c-e38badf9c152", "comment": "Malware payload (Mirai)", "value": "80d0c10a2c68d70a94a982b1f6b65d11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478518, "uuid": "be20ffc4-9351-4806-94b1-b753d8d9e001", "comment": "Malware payload (Mirai)", "value": "2cc8420e95d15d4d810fb4399bd1547511e3a6e586e75b2ce0128dd23ffd19df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478518, "uuid": "f804a8ac-a5bf-4c46-9941-c70afaaa708f", "comment": "Malware payload (Mirai)", "value": "65ac3b7d466a4d0004daf0b20571e799f7c5a813", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478518, "uuid": "8324fffd-1432-40d4-9fd4-1bf89cc6cad0", "comment": "Malware payload (Mirai)", "value": "467bb70101cb621a16bd878566417c87d0d68ca9efeee6eb229e52cf2044086cd44e074a93f103508d3caee6d153ef5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478518, "uuid": "471ac747-2a86-42af-995a-e8cbf7ad73dd", "value": "T149D30885F8505F26C6C356B7FF5F428D7B1A4758D3EA320388296F64378B85A0E3B606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478518, "uuid": "6d5fa0ba-eaa4-45d6-8596-3df82ce280a0", "value": "1536:hajukY4/eZWwFkaCa2B984V7gMi1TXyO+T6+7D/0MwRNlvbwywFF6JrA1p1tz4Zw:hQuvawLVCaB4JU7yO+FravXWHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478518, "uuid": "8062dbcb-de15-4cdf-9bd1-c92596f15276", "value": 141504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478518, "uuid": "cc4048de-793b-44ba-90be-25a78c5584ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478518, "uuid": "56334230-9fe4-441e-9a47-0825c0791b13", "value": "sumrak.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d85f252-f222-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768489066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489066, "uuid": "cd31088a-27b7-4c34-bd15-0f76f9e6d51c", "comment": "Malware payload", "value": "ddb5bcf278631d1d801793763d54dafc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489066, "uuid": "89ed5c51-5272-41cc-b5b9-82a2c497e22c", "comment": "Malware payload", "value": "2db6ca8985a7e80ef74a452d2b20c25a573946b8fa84da9e57a578131acea6a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489066, "uuid": "b72a735f-b018-4102-9bd1-06d0f64aebbc", "comment": "Malware payload", "value": "c3d051c44b24f4983041f7326c76dd8d5dce56d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489066, "uuid": "687b6674-8d0d-44f4-8546-25916db4888b", "comment": "Malware payload", "value": "2ff7f88a3826b2cfa24eb0088b07174aa3eba62cce4672971ee2e5beafdd96104597ee21f76e4a06aa4e4ee59eaac8d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768489066, "uuid": "5be9dd26-3870-4056-a418-8551978a0b9c", "value": "T1494302CBD95A8739F8F6C9BC4ED6C8445887022E7147A0BF458CA4BC24797951D8AF0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768489066, "uuid": "c7d6e4b9-bd57-4372-827e-02a736ec4843", "value": "1536:m3LqE6rUQWzVQR7iAGEcUT5PIi7pLqBNs4LOjcwf4n7:mOE6PWo1T5bz4LV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768489066, "uuid": "a174063a-9c2e-497d-bb14-2dd8fad99d2a", "value": 57672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768489066, "uuid": "cdbef797-8cfd-4a25-aef7-280fa7e0cce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768489066, "uuid": "b1ac98ed-c921-4a93-bd73-5ffdfba072fd", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a80957-f202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768475334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475334, "uuid": "8bafc823-851d-43f1-b14c-17b47e14b147", "comment": "Malware payload (Mirai)", "value": "6adb0678e852e7fa55e6bed3b89c258b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475334, "uuid": "746f9357-4a0c-4cbe-b918-195c5a6ea76e", "comment": "Malware payload (Mirai)", "value": "2dd93b0159210e8eed77ffc3664cd5e49cb64e37d0bf0b35a778c4a6785fdb2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475334, "uuid": "2f7fabdb-023d-430a-979b-128636319426", "comment": "Malware payload (Mirai)", "value": "31adf9796b6dc72916da96bacdcac383c96fe2cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475334, "uuid": "79ffc536-1242-44a4-8905-e0ea83fd8663", "comment": "Malware payload (Mirai)", "value": "69d2c30d075a16c8722ff8cf44462904ec91b5304289b71b586e01757928041997a8b230fa4af5dbd1a8d03840ede575", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475334, "uuid": "226aaa37-7b74-46d2-8f01-c85e9dc181c1", "value": "T183335C42736C0947D0A62AB1353F1BE1A3EFEE9021F4B584690FDB4A8235E731586F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475334, "uuid": "7802bdbd-3ba7-44ad-83ee-d38fd42c4ed9", "value": "768:+91wrhEp9R9U8hHcTH/V7kIRUbhi2xCxYruY6Lbpx2s:hhEL8zbVlDurl6Jx2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768475334, "uuid": "d242d554-a1d1-4232-b3f9-04f94ccc4467", "value": 51416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768475334, "uuid": "fb56a020-2b50-4623-a627-5eaf6270e110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475334, "uuid": "8075cc04-8b21-42e9-8b7e-1ec23195eee5", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7ff88a-f202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768475346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475346, "uuid": "3e6c7e5d-9633-4e5f-be85-ed18f078f1fe", "comment": "Malware payload (Mirai)", "value": "64d63d670c3504f1bbad375de4eac397", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475346, "uuid": "d88ca0dd-fefc-4274-a341-761430f90514", "comment": "Malware payload (Mirai)", "value": "2f63ee7135c9b247ad92809e8b468a652b13854082adeed64aae3fc2ba307815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475346, "uuid": "0aba8c04-63c6-48e2-8171-4c9192b4c20c", "comment": "Malware payload (Mirai)", "value": "bfe56548d30cafc514d2f571087746b2e8a0359c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475346, "uuid": "97aaffa2-f8af-4e56-aa8d-bcb99f5d2ae5", "comment": "Malware payload (Mirai)", "value": "0ac451877449d84b60809dafc3d1456a9f4c675b246d262e9a371bd589e84948acf55acb7774453890a6c5c84997b214", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475346, "uuid": "2e916c4f-5e59-434e-a382-74e8e3db66f8", "value": "T19823AEB6C4699CE4C20946B4B6248B7C0B53E505A5A72FF15B46C6A68043FECF72C3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475346, "uuid": "8ce32859-6e46-4d4f-9164-d91f146badff", "value": "768:/cahNHL1mc4tqzeYn/1hKW5nmMN9LPCCoINxo25Cvx:/cahNrwqr/vKW5nmMNlCINV5Cvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768475346, "uuid": "323a970b-73f2-47df-845b-2de5a7be4561", "value": 47632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768475346, "uuid": "eef92d07-f572-42f7-aa86-21fc9bb67267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475346, "uuid": "6bd2b754-78b0-4ecc-a32b-899983b80ab6", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed7b7b7-f234-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1768496853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496853, "uuid": "9fb274c8-9882-4346-aebf-f0185b73beb3", "comment": "Malware payload (Gh0stRAT)", "value": "3a77500f77131f0fb99aa39fe294c607", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Program:Script/Wacapew.A!ml", "colour": "#D728C8", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496853, "uuid": "8a16a2a6-f762-40a6-9dd2-ec0ed63b6adb", "comment": "Malware payload (Gh0stRAT)", "value": "2f9cc5150036a050cb20ce4ed9da99447df1a2e65982ebf962694e562ac39470", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Program:Script/Wacapew.A!ml", "colour": "#D728C8", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496853, "uuid": "35868a5b-69ba-407f-a046-5ff15977224d", "comment": "Malware payload (Gh0stRAT)", "value": "b16ad806625c430f03028b3c14ec2114357fd1f6", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Program:Script/Wacapew.A!ml", "colour": "#D728C8", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496853, "uuid": "14038a3e-d5f5-404b-a8cb-f6ef25f31c93", "comment": "Malware payload (Gh0stRAT)", "value": "6f2a806c2cd72ae743dbf46272cefe22fa03e3053d013a7a60bc71fc5b01898381a34319e51922dd8fcd36502353093f", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Program:Script/Wacapew.A!ml", "colour": "#D728C8", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496853, "uuid": "eb536241-aaba-4264-9ada-da6ac6472b19", "value": "T14B573322A2DBC432E56E0176E858FE1D14B9BE73073051E7B3E47EAE85B9CC18674742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496853, "uuid": "d00b066f-46fb-4c93-b633-7f4b88ef54f0", "value": "393216:XfJ+LqVJEXC8R3eeK839Ask4kp82ervsURRCIAjc9aheuI0gy/P+BBK+xRG4:XQgJcCDBsktpwvnTZEipf0g40BKeRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768496853, "uuid": "125ac645-920d-410d-9741-9c2d60a6b105", "value": 28043776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768496853, "uuid": "a45162c9-3d2c-477c-9c57-877f2bfce2f1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496853, "uuid": "0c965977-805c-49ed-b4fc-bf02d25e9ee8", "value": "Setup12.2-4515.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a30afb8-f22d-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1768493731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768493731, "uuid": "66592d6c-2c54-4315-93f6-ceda0e4a76b9", "comment": "Malware payload (RustyStealer)", "value": "ca83f7dddd37353cc8d7229f0f143bc1", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768493731, "uuid": "61f9b9b7-b5e5-4a90-8205-b29a6adb59c6", "comment": "Malware payload (RustyStealer)", "value": "2fcedee5b1a3f8f31d2e535df688f3cad8e9e9ddc9594e347e4026d4340720ab", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768493731, "uuid": "ae642c5f-bc0c-40b4-8343-081fb0a0b566", "comment": "Malware payload (RustyStealer)", "value": "ded48cd5b224d4a56b8df1ed7a28ac824c4d7212", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768493731, "uuid": "47d3c506-2dab-4ef9-bf60-e814ca42727e", "comment": "Malware payload (RustyStealer)", "value": "1777ae51fb746df3ba25a326d35bac64e825177686c74b3e7dac31a9978c11fbd6c518812e455fb44f5d323e5ed4dec2", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768493731, "uuid": "6e9bb8f9-75f9-4107-95d0-1a1cd283eb68", "value": "T128F51A53E29581D9C4A9C479C36A9B33BB72BCCD863472EA5FE44B212F15F906B0D306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768493731, "uuid": "a2a13a29-96fc-4853-aae0-534f6b9655b6", "value": "44bd78ab40b4cd461b61827198da32ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768493731, "uuid": "0dbe3ee9-6e48-42e1-b616-f82246b9af0d", "value": "49152:qQXz68ZeKLTG4qaYp4GmgTYpd6wwYFctJnnqyEvc0+1S:o4qaYCE16G0+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768493731, "uuid": "4404214b-885c-4b22-a1c1-30c6cba2b6f5", "value": 3380224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768493731, "uuid": "d4a7e2b1-21f5-40b4-a7d1-1a6e1cf29014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768493731, "uuid": "321e2d74-f5ce-4565-ba15-cec6af6dba9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19862db-f262-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768516588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516588, "uuid": "4d79ef37-0863-44c2-931c-3d233946e6ad", "comment": "Malware payload", "value": "40aa538342c4e4065f7fc1fa341ac060", "object_relation": "md5", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516588, "uuid": "d1312046-c1bd-4a4d-ad42-59692f7bcfc0", "comment": "Malware payload", "value": "31186dc2e3fce4d202aa0cab8f4049c0021d2007088ad3dbbe8a53768277b21a", "object_relation": "sha256", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516588, "uuid": "8cf91c33-0d4e-4d97-a081-ea3d03859e6b", "comment": "Malware payload", "value": "4ebb1bba5f1d88bfdad8e30916205cc049ffae41", "object_relation": "sha1", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516588, "uuid": "850776b8-1f59-4ae1-a4fe-7e5a45387f6c", "comment": "Malware payload", "value": "8cbc16c7cc29e711382204821386d9a1f60a8ed0445a1a3271c65a5cde0aaddbb39de7d59443c16872e18a9d85d3e70b", "object_relation": "sha3-384", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516588, "uuid": "d2c8b878-7528-462e-ae65-def2a024a3ac", "value": "T10CF2178E9072ECB12D61CC52DAA13329F4BDE088C5F7BB986E257E7C1571114FA740AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516588, "uuid": "494f8ad6-6530-49fb-aacf-ed881e3c1104", "value": "768:fO6nHM+CdLf1wPzHsIE670f2hLp4zNNVllkTcFb8IwgCQaCBV7AoerpvWVH+:fO6nHM+CdLf1wPzHsIE670f2ht4zNNVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768516588, "uuid": "a1d7993b-e1b4-42a6-be35-e1f75da160ec", "value": 37498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768516588, "uuid": "abe14df7-48d3-4ae7-84c5-3a2c1d49284d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516588, "uuid": "b8b9479e-3576-4b7e-acb9-1d5df38372d2", "value": "xmss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d31c55-f1e8-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1768464032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464032, "uuid": "90140bba-f45f-4cf3-a1a2-d59f4b81ff35", "comment": "Malware payload (PureLogsStealer)", "value": "6361569beab2646d2631fc7272ee91a0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464032, "uuid": "4703e497-6df9-41be-a0c2-227219262249", "comment": "Malware payload (PureLogsStealer)", "value": "316ea2aefdf2539f5cf1fdf4ac483725a708a658b98996e9dfdef48f95475de0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464032, "uuid": "20b48e39-8e95-4dbc-be71-8ac3ce605020", "comment": "Malware payload (PureLogsStealer)", "value": "224a6be5d9abbfc8119fa76722a594cf7c0ce492", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464032, "uuid": "c4cf94fb-89e0-4808-9d8e-5e1da76ce18b", "comment": "Malware payload (PureLogsStealer)", "value": "2cdb5fb19f62675e9a190822dc1489e9bc97606079a56f4583c73414eda68c3bac38211f585a29f2092287fbb5820c8f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768464032, "uuid": "9881e452-968c-47f6-8328-094df9e62684", "value": "T1D96533311A3BAE250230D629397D5D0EEDB01E09C084D4B6F5EEBEE11BBD78095EBC56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768464032, "uuid": "336550e9-d97b-4cd2-965c-cef58ed277ed", "value": "24576:TFjOISaURsAQ7zIhZNyBj12nRLsC9kHXG/+dijCG662QYz6:T312RL9gG+dj67YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768464032, "uuid": "af0375a4-27b7-475c-88f5-4806c8025dcd", "value": 1414407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768464032, "uuid": "212cb9f5-5940-4922-9215-9c91563aae60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768464032, "uuid": "12510df8-7b05-4507-8e26-a6b9301d7346", "value": "ikmero.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9708890d-f202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768475338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475338, "uuid": "07869674-f8af-438d-af7c-e03edfb0ce25", "comment": "Malware payload (Mirai)", "value": "8a91db59fd164951c460d42489800f35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475338, "uuid": "3f0d571d-97a0-4e38-b62c-17a4d88597cb", "comment": "Malware payload (Mirai)", "value": "31efdd5ef3c08cb46e45b9c6321eec40f389b434b8cf0023a3c5bc61d5d518f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475338, "uuid": "88135bc8-0460-41f1-a19a-afb3bb6e3b7d", "comment": "Malware payload (Mirai)", "value": "9b2d1e8ae8b9f70896d87a2ed08786e465351d06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475338, "uuid": "19e8fcec-230d-4938-8e70-3338f66f82c0", "comment": "Malware payload (Mirai)", "value": "1e5adfa15fd7004a238acb06f551861baba0609619bd016a31d4548f7c2eebed4815d30369ab541a1d00206588281b38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475338, "uuid": "9a2d05b0-d26b-4b4c-93df-4d5c3b6d8e9c", "value": "T14B435A25BDB92E17C0D0657A22F70729F2F6134E35A8C62E3D720E8DFF54984A2136B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475338, "uuid": "79862126-97e0-4732-ab71-882953358410", "value": "768:ZFooeIPR8zg/g31FnhVwf1yC/9ZBXSjr5mzYfSOTO+Fcy/vxm/nW:ZFYIPR8zgo1JkRJ2mXOnt/SnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768475338, "uuid": "aa988d0d-ba8b-434a-bf0a-48b98da0d9f2", "value": 56048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768475338, "uuid": "8510c09a-ed1a-4a22-8c34-414b53405a3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475338, "uuid": "c4e426a1-6e00-482a-bc79-e70632adc9d5", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e325a7-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478375, "uuid": "f4b3e80b-9c7f-4921-b296-841ab876435d", "comment": "Malware payload (Mirai)", "value": "e4b315bc023566cc70d4d812aac724e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478375, "uuid": "0ed1a0ba-dc54-48d8-b87a-e151b90baed2", "comment": "Malware payload (Mirai)", "value": "31f4d8a54961da00e387eaf3a45097f18df73f3a7c077743acda2447b792fc60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478375, "uuid": "2a68acdc-3720-43f4-a031-1afa64cfb756", "comment": "Malware payload (Mirai)", "value": "f6a1ed7dcd7ac7a4d5cc63b240ad777ec3ecce9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478375, "uuid": "bb934ed0-f483-493c-ba64-8a05becefe5b", "comment": "Malware payload (Mirai)", "value": "6d4dcea1b357c3ff38e3b9d4fe8901ee2d06f9e6ab6d609e1102619bbe15e608abdf357026bae143cdf588d3bf259dcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478375, "uuid": "ab03a482-a61b-4aa9-b835-31c8347213a5", "value": "T168C36BB3C8256EADD528D5B4B0708F785B13991082471FFE5A77C2B88047E8EF6097B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478375, "uuid": "65c74885-cab2-405b-b2ff-ef7473ef5960", "value": "1536:laiZEHvGmMOexMkICIKcKQm7wJUkyAt6qXWTqkxd0ctX8y1N/Gf:l9cvbM7xM5mcu3ky0tXWmkxOahx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478375, "uuid": "312d2830-4e2b-469c-906e-aef66f0c52c6", "value": 127684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478375, "uuid": "4818ef1e-4b6b-4f37-81c6-16ea0d290f14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478375, "uuid": "37cfc133-70e2-4742-9996-f720b67869d0", "value": "sumrak.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369baa00-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463150, "uuid": "378e68b3-9367-4a41-a8db-eba0acafc408", "comment": "Malware payload (AgentTesla)", "value": "fa8a019a318da34af98304c2e18148b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463150, "uuid": "2837764e-6e56-4d01-b672-5a82578f9e02", "comment": "Malware payload (AgentTesla)", "value": "3348264b67fec67e4c530f8dc215e4fe2211303efceba3e91583d0134ce27806", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463150, "uuid": "ab95b856-c09f-4988-9378-e292df3fa606", "comment": "Malware payload (AgentTesla)", "value": "0ea7ba8e4570c13d0d3d3aa06f9282b7273d0f84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463150, "uuid": "db4cf64d-4419-4ff3-bd24-fd59a12f12cc", "comment": "Malware payload (AgentTesla)", "value": "18696e96f1cd60d3e5fe4fbfab20cab6d676bfbc2cbedada539d2dd330debd74d2551edee3e67bedec00fa1ebb48c70e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463150, "uuid": "c7e74f14-2c68-4a07-8cae-08f640f135d4", "value": "T115935B60D92905B70F83AB98BCA90660C57C9314893354B1F5EE8B0D96099FCF37D7AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463150, "uuid": "6b0401b7-90f6-4fdd-94d7-52cdf8c2771b", "value": "1536:XvhshF/sT+pLM3eV/WMafbZo0o/8OLpkbC05G4vFw:/hsj/sTqLHVzafl7okOVuCCG4vFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463150, "uuid": "9afba36c-6b56-4948-a5f9-dbce2704041b", "value": 94363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463150, "uuid": "53309f3c-4686-4fcb-9ba0-acfb308d1c9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463150, "uuid": "e72656e8-ae8a-4282-8bdb-ba216e254fd2", "value": "2026-01-13-00271.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecb499d-f231-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495699, "uuid": "404b4604-a094-432a-a0ee-3f770446741b", "comment": "Malware payload (Mirai)", "value": "ea663db614382bf9fb20a2b2e52bcf80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495699, "uuid": "4107c39d-8f53-42f6-a5d3-7c683c7514f3", "comment": "Malware payload (Mirai)", "value": "3491f22a5814b3c83ac3e7e68af24c9b4ad2746e38aa196d3f153cf8557bff20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495699, "uuid": "823e21e6-642a-4063-b7f3-7432fa501c35", "comment": "Malware payload (Mirai)", "value": "2d3c5abf71df9ece3af12d8094d13715ca1f4dd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495699, "uuid": "119472aa-f64c-4bd3-becd-9006e2b392bd", "comment": "Malware payload (Mirai)", "value": "eceef20b206831aa2550f356449246f6f260a7798627675ebac801d16b1826bca49b288967d350437c9af6208c7a09e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495699, "uuid": "5b303bbf-3cfa-424b-b425-e71003a1bb30", "value": "T153042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495699, "uuid": "0156388c-b944-4821-988e-043e993f532f", "value": "3072:OjeivZm5INXmmme2aE2zuROqb/ANQLOQ38YhTfYo+M/RTYERqLn:GeivZVNX5D2aE2zuROOLLOQ38+x+M/RG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495699, "uuid": "30495d47-d340-4cd8-a2f9-691775888176", "value": 181482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495699, "uuid": "36f894c1-f1bf-4aa1-8ecb-47b20ea4ce49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495699, "uuid": "058dca3c-95d7-43c5-9058-510707eb2337", "value": "djmario.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a02b248-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1768463183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463183, "uuid": "a12321ad-0325-4803-b677-5759771a2adb", "comment": "Malware payload (VIPKeylogger)", "value": "4a0c89ae90f1497ffaa3319b61aedd2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463183, "uuid": "d712883f-381c-4dbd-8a0e-93797cff146b", "comment": "Malware payload (VIPKeylogger)", "value": "351e6f56df7d8a7b4a6c053650aa02377ae06b4b251e0f91a9396f6842ff1aec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463183, "uuid": "66cd47cb-64a0-4963-821f-b0ee7c6ab7b6", "comment": "Malware payload (VIPKeylogger)", "value": "7386e45409c1f62b9bef073e7186da2e403bba5e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463183, "uuid": "ad69b679-54f2-491d-baac-f4aff98b9dbc", "comment": "Malware payload (VIPKeylogger)", "value": "696cbf072adb68c85d438ac24496a5314fe31ed8d2beb1419e12a788b8a2387a4e58ddd7601f51fbc3c3cf834b664e41", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463183, "uuid": "779603fa-a234-4a41-992d-53d917fbef9f", "value": "T1C95312CE3ACEB573037A3032652BB097F27F4C61750C51D1EA567298BAAC718E636D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463183, "uuid": "82044e3a-b961-440e-b10d-18c47334b6d4", "value": "768:TwWezkwafXRYm3dNNH1EwiToYJgO7dyvMLCrGtknECvbvq/0r9D9aYQygN0:TtezSX13dnJ0oYJ1gvMWiSlpat4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463183, "uuid": "55899591-3277-402b-aa39-c85b9adf6834", "value": 61189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463183, "uuid": "fe597c2d-171c-49aa-b73c-7d29609c86fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463183, "uuid": "e86aadbb-c6ea-4a0c-91b6-b390623ddf83", "value": "New order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4c1ce2-f1e3-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768461841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461841, "uuid": "39666021-1f7a-4088-aa1c-4940bdc2e788", "comment": "Malware payload (RemcosRAT)", "value": "480a0691fe9510d0191dd7766bc1bacb", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461841, "uuid": "ab095e1d-831b-44a5-8811-366d81a34e12", "comment": "Malware payload (RemcosRAT)", "value": "3561a41151669b21c698af43318ffeb99a33ef57084684da03dad88330b32289", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461841, "uuid": "dcdf372a-a668-41d7-a855-7037c7db8be7", "comment": "Malware payload (RemcosRAT)", "value": "596d41b2e28def41e87725d2fec384b6b8075f3c", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461841, "uuid": "2f0d7816-2eb7-47bb-8bf2-2e8e1ee0a8aa", "comment": "Malware payload (RemcosRAT)", "value": "c565dc39f029b4da5eb02df09df558f08af8ffcb948a361dbf31b8e07e2452a27e332d31039dbff5e6f6c142738057e9", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461841, "uuid": "9bd58b2b-f2ec-47cd-923c-2bc3c9feabeb", "value": "T12846941EA9E10083C446BDFD5E2F27948C8A6E5773E22C4BB22DF48B352DD549630EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461841, "uuid": "7bfc6e42-a4b6-4030-8227-a42d297db4e2", "value": "49152:412rMST3LrqwmjMzHyFL5Iw/vHniPGl53APsgXvgRu7oFRgpUCJnXGFj3+nBwE8s:412rFLr7mwzHyFL5R31l53tt1K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461841, "uuid": "5a3c39e2-2a6d-4697-8da8-fe3572914115", "value": 5828814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461841, "uuid": "c052446b-f7e1-4fba-8553-df3a9cdf5ed5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461841, "uuid": "b42b96cc-1c96-4a52-b946-10b814ad867e", "value": "HSBC Bank_Payment Advice Copy.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c983e3-f1dd-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768459438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768459438, "uuid": "f7c4a167-5a73-4396-91d4-b7e1a5e25565", "comment": "Malware payload (AgentTesla)", "value": "5d3570f0ca52d3778da84310f1892e74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768459438, "uuid": "61424318-a350-47d8-a5b2-1670133fba76", "comment": "Malware payload (AgentTesla)", "value": "3693efe08991142e5743da14141aeaca3add10f97e3e3697cff8ccf95d15f758", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768459438, "uuid": "df4ec5ff-b866-4dc5-9811-0e2307d35e46", "comment": "Malware payload (AgentTesla)", "value": "e152859f5bcba6b293d633f24cf06ea3998ce7e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768459438, "uuid": "d91d88eb-71bf-4246-ad63-27945b40c023", "comment": "Malware payload (AgentTesla)", "value": "a7deda495f680515b4a5ff2b979686bff30c6ea92756839896f127b4da34cf104bef9347ce161a1feab6636427249078", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768459438, "uuid": "8830e02a-b0ad-4a0e-b758-c769c2e5be5c", "value": "T135A4B256E660B425F88705713E79B24678293D362680EC1BFB89AF9636709C3B1F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768459438, "uuid": "0b820d45-04b4-412e-a393-2bf334ea8eb1", "value": "de8e6968e6801d69a426166c68691ba8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768459438, "uuid": "d3f15682-bad1-4709-ac76-30d141927d30", "value": "12288:xo1DhozSa4zXtlOCm4WGhAyImeLm/Jy4:xoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768459438, "uuid": "f78708f5-3069-44e6-a9a0-49d92b5bcd4f", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768459438, "uuid": "89c4ab2d-9b2b-49c9-9b07-c1c9c38437be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768459438, "uuid": "55e8b2ab-ef28-449e-857a-11f14aae291c", "value": "sophical.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acd1b0f-f202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768475344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475344, "uuid": "10f629e3-0e0a-4a6f-8a81-c8b0945ce651", "comment": "Malware payload (Mirai)", "value": "2427cf34bb626828d6e7390dbf44167a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475344, "uuid": "b92043c8-0562-4388-a429-6f0bd86e10af", "comment": "Malware payload (Mirai)", "value": "37555ca6e9f94fae07e92ebabe3b25d1b353b993ce4166742a684e10f7e22a14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475344, "uuid": "f08e94ac-097c-4371-84bf-bebc4828b496", "comment": "Malware payload (Mirai)", "value": "3dc4faec22bdefddcbf31a6ac8d3ae94fcbbbda0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475344, "uuid": "5f15511a-7fdb-4ffc-a811-0a495294753e", "comment": "Malware payload (Mirai)", "value": "ea92c63b08eb4a42a00e643940500bfa913c7b2608c819872ea7ad193f926a9a7ec0a13ab3d6a9a7d052456905645dc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475344, "uuid": "430e7cad-562f-40e6-b9d9-9d4855a4ee15", "value": "T1B2530996B9818F11C5C512BAFE2E118E33132768E2DEB3139E146F24778B92B0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475344, "uuid": "9dd69d61-3e9d-4778-9a0a-ce4cd1158d7d", "value": "1536:Q8nXG7VpTJ+NAE5SCOBpRBndNWfquno6lyIuiAMvFSPG0:up1+Np5fOdBTuqnMvFSPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768475344, "uuid": "66772c47-94f6-4084-9bea-2224af4e23bc", "value": 63524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768475344, "uuid": "ee3a0909-b08d-4372-8999-81351e789ec3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475344, "uuid": "e2209210-0ea1-427c-8966-9b67003f7ac3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c5104f-f1d3-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768455126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768455126, "uuid": "447f0759-26bf-4c4c-bcb3-a98402dd9768", "comment": "Malware payload (RemcosRAT)", "value": "8456bfc8d524f4f95023e0d2b86295e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "SuspiciousPE", "colour": "#52132D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768455126, "uuid": "e0e54328-de7f-4f31-86ce-1ccc6b3b6504", "comment": "Malware payload (RemcosRAT)", "value": "37dca3cd3af9524b439678f344f96719c87bbfc722673e79b6de541ce30d5555", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "SuspiciousPE", "colour": "#52132D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768455126, "uuid": "30f2f9a5-2bb0-4290-b19d-5a34fc717d86", "comment": "Malware payload (RemcosRAT)", "value": "dae944c52ebeebbd5655e2c78cdd4da45714c5d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "SuspiciousPE", "colour": "#52132D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768455126, "uuid": "3e7a4302-f19a-4531-851b-ef53acedba03", "comment": "Malware payload (RemcosRAT)", "value": "7ebd7b79def6194a36c61356c7c1e66472b9a700d637a7c1e5bf82085a3bc9d7e9075311573a40568b04df669cff816e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "SuspiciousPE", "colour": "#52132D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768455126, "uuid": "1be58bf0-01f0-4bc2-b3b2-4f055d2f274c", "value": "T15B33CF50B7E0C4B7E8230B701D3A5BBB9FFAA52215A8670F17006F5D7D32682E91E791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768455126, "uuid": "f55bae8a-16b5-458f-8221-6dd04ad2795e", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768455126, "uuid": "7c03ab1b-be4a-4c97-ae80-accaa157e070", "value": "1536:ZrnHvdmBiuK8Uidw4TCRIuJw3uOb9D4asTtfh:BnPdzuK8Jdw4TMJw3uObl1sBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768455126, "uuid": "9de764f4-e6eb-47d1-8f82-3c342d0edf9f", "value": 54262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768455126, "uuid": "0934c4e4-baf5-42e3-850b-581c4afa73e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768455126, "uuid": "2f28ff20-717f-434c-b5b1-d79135b63350", "value": "S.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dd8eb6-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768466189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466189, "uuid": "b02bf4e1-a307-4284-8a9d-90ac911bc93d", "comment": "Malware payload (Formbook)", "value": "cf158df022c3ff5363002d30ce301d29", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466189, "uuid": "51f8a9a7-1a63-4229-87ed-f528211e2438", "comment": "Malware payload (Formbook)", "value": "39354244a03fbf08298683ccba89189f18101b2e7a8bf47e2d7f22759d1e35cc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466189, "uuid": "f72a4cda-c6a0-44f9-95e7-ecb5b7f3b926", "comment": "Malware payload (Formbook)", "value": "4820d93c34c9a37aa59c59e0344214ea1c792a2c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466189, "uuid": "ac07c123-2cc7-4adf-859d-b7890a8da7df", "comment": "Malware payload (Formbook)", "value": "934610dcc0b62990fad707aaff98de63c265ef6751b614c6452c22487dd4f872d1bedd54b99a2d4d82978688c6f6cd79", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466189, "uuid": "3ee86b7b-1c7c-4691-9349-2ceef91843b1", "value": "T1785533B47EBA2D7989E8F63810ED3D2E7A820B259401D7863BBB15CB035DF151523CAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466189, "uuid": "8f1b07d4-b607-4541-aa52-f22e3faa5280", "value": "24576:3da9UYuXaNISrTh1cmx1NPwFA0HxMkMEFijLF9A0FIQK+IpYRVMOQxg40XTGYnv:ta3P51nJQ7HxJYL3AK6iVzmiTtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466189, "uuid": "7dd7ac6e-e48e-4038-88ae-24361b79b089", "value": 1395693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466189, "uuid": "29dbbdb5-d901-4661-9e92-1163e1c78439", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466189, "uuid": "cb0a6cd1-03a3-4e46-a09e-7c281e13412c", "value": "lfbrgm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcf6f2a-f238-11f0-a129-42010a9c0007", "comment": "Malware payload (MeshAgent)", "timestamp": 1768498485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498485, "uuid": "38174b5a-c78e-4004-8932-384149ada3d5", "comment": "Malware payload (MeshAgent)", "value": "6f5d18157425aa9697913ae1310f588f", "object_relation": "md5", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498485, "uuid": "21442043-ebea-4146-b590-ef66a5267248", "comment": "Malware payload (MeshAgent)", "value": "39c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e", "object_relation": "sha256", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498485, "uuid": "7ff91dd0-2565-4969-b71c-b73aed677ef1", "comment": "Malware payload (MeshAgent)", "value": "bfd864ec0e6bd912f932e4f3ed80687736ee16e8", "object_relation": "sha1", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498485, "uuid": "e61d1e75-9bde-4694-964e-a9250caec4b0", "comment": "Malware payload (MeshAgent)", "value": "fe529ddbb81019f6a769a4f28e10951b0c7cb106318be17ba3eab891e635ae49f3caedd067757b4a7597be3921fc1bb9", "object_relation": "sha3-384", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498485, "uuid": "fa5601b7-41d2-452b-9d48-affa38fbd7ae", "value": "T17DF58DD2A3A600E8E9B7F23C85568517E7F1B81753709BCF16A44A761F236D12B3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498485, "uuid": "2ab88114-d7f8-45f2-b02e-02dbf042ba16", "value": "fb0a8b4a81655f744a37af985e009476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498485, "uuid": "28a7833c-ef58-4a21-bebd-09a9c037806a", "value": "49152:rdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxM5Smy:5HvfGfZvZj1/N/z/oMkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768498485, "uuid": "9c2b98bb-0c3e-4aa9-9247-34a5163020a6", "value": 3519176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768498485, "uuid": "26cfe391-e495-4aa7-8915-123649f90b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498485, "uuid": "69907ba4-22cc-4015-9e2e-4e91eb2f03f1", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d99de82-f24e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768507857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507857, "uuid": "80ab1a0e-ae78-4200-81c1-0038bc7c3007", "comment": "Malware payload", "value": "32b4dcc611b2d434714a43b1bcaed37e", "object_relation": "md5", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507857, "uuid": "41056691-eb99-420b-af70-8bca49a7d9a5", "comment": "Malware payload", "value": "3c51a2adf0146fe17a2202beae4fc50f412db6b822cc167bb8b4bfaa35b4ba0c", "object_relation": "sha256", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507857, "uuid": "9ec8730a-419d-4130-91aa-ebbffb4774d0", "comment": "Malware payload", "value": "6ed3e4cb8f5bd714dec6a72c6f5e0024443906e3", "object_relation": "sha1", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507857, "uuid": "1b50faa7-8dc2-4c04-a0c2-19f8ae688169", "comment": "Malware payload", "value": "c5dbd8798bdaa446f690d4c4a9bdd332d84368093baaabea673d4307c7398d00da8249610ab31535a2976a83f9f35f5e", "object_relation": "sha3-384", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507857, "uuid": "59c8fe8c-db3f-4aee-b3b2-50d2d64b6cd9", "value": "T16F835CA56A6950A5CA968238C677C71BF9F5B08533A092CF4390D0BC1F733D46B3E729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507857, "uuid": "5bd6c589-edc3-49fc-92b3-9121bfe88f0e", "value": "1536:QKoLT7udQXngTrX7WL423Da02Rp0eIPEzW:a/7tXM7923Da0yqMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768507857, "uuid": "1ce4136a-1d14-4217-862f-8a627ad1dbb7", "value": 87440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768507857, "uuid": "80dfc945-fe9c-4505-8ac4-5b82b1dd63e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507857, "uuid": "5c052a6c-4db1-4db5-b187-c9c55a9ce2e7", "value": "kd_0C_8086.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cd578e-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768466125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466125, "uuid": "6485e5db-1099-4f68-bc84-6284de2332e5", "comment": "Malware payload (Formbook)", "value": "58265e252b1a115b7724eba70b713384", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466125, "uuid": "98e5e591-5ed2-461d-8cd5-9828d7d610b0", "comment": "Malware payload (Formbook)", "value": "3cfece15de5fb0b83d7474185dc8860f39cdd123c05f2546ada90a2f94f355ef", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466125, "uuid": "d2d0507e-dc5a-43dd-a98d-3b8145a6ddaf", "comment": "Malware payload (Formbook)", "value": "e247efb70039baf1b36a8c57398e8347d47389c0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466125, "uuid": "7c0437d0-ed8d-4a8d-811e-cf9b7fefd186", "comment": "Malware payload (Formbook)", "value": "dc9912c63a1d16a59735860ea2ab0af05cd8b7f8edb4a76a92e8ecf9bff97ec337daf9db148ba88a099cc18e0b555b4f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466125, "uuid": "c26be624-2d56-4fae-a2dd-ddbddc9cdc01", "value": "T1BF6523641F6EB9BF073C8E35A4B79F0D5B884A920444E1983BCC125267BEF90BF27516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466125, "uuid": "778313e9-0496-4e89-85f4-1210c686a1d6", "value": "24576:Xu/yUZ+1WOWPyePEPv9UJYaTSRxmG3X7Q5gYNTs9zfMMDOQZmVAMVnEvd:RJoLeeJVSp3X7RQoOumVxB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466125, "uuid": "c0059c5b-a129-48a4-bbd8-0648a046a355", "value": 1418483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466125, "uuid": "7289191b-2d36-45e9-8005-f63c1bbe7de2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466125, "uuid": "4dd85b84-1daa-4131-8682-f3eb321eef33", "value": "qg8ffm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14789162-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload (Kaiji)", "timestamp": 1768500459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500459, "uuid": "f6f24ab2-6c3d-41ab-b2a7-995a7c0c2adc", "comment": "Malware payload (Kaiji)", "value": "c233fef0db79c974ad815236ac84385b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500459, "uuid": "a3e782db-fc2c-4cf8-9404-439ee85981ef", "comment": "Malware payload (Kaiji)", "value": "3d028580601e9b614ed5074741ad0756c9c383e353924c3a023dd78e867e7f92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500459, "uuid": "7c857a24-0be9-4b45-9e94-9eea5c7c5433", "comment": "Malware payload (Kaiji)", "value": "c015e06434360f126ed7854c92c4e5215366077e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500459, "uuid": "b9682cd6-98e1-4b99-a381-8e6631303e60", "comment": "Malware payload (Kaiji)", "value": "1658b3459318b902a6c873632407150c6844e4b92b020944eb989ab0295ab2037371090692c6393ee193d7e3de1baa4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500459, "uuid": "f90c6a5e-654a-4563-b316-fdf879c16869", "value": "T124B5F8117F49EE5FD69422354EA6C33833967C14C2A03133AB51F7292FBA2B88D5ADD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500459, "uuid": "d50ac65d-ccf2-445e-8190-67875546e2fb", "value": "12288:WY8Zinp3M6B0XBgI19CUdMp3LAQh1CWpAaxVX4ltPuMFLgbM8yn+kvgftZAMcq+:bm6WBkjXVX4lRuMFL4o+k4fcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500459, "uuid": "f983a007-50f3-48db-86bc-1002e5cec273", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500459, "uuid": "52d8c40a-83bc-4412-9be3-841b2b347ecf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500459, "uuid": "1161daf4-b414-4918-a14a-89779078a51f", "value": "linux_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1668171-f225-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1768490415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768490415, "uuid": "5fb24565-f0f7-415e-9742-77f8be0002a0", "comment": "Malware payload (Amadey)", "value": "0c4a156f97ced3bcc9e551222b0d6a32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768490415, "uuid": "c932c495-be71-4f4a-8307-40e05339b7a7", "comment": "Malware payload (Amadey)", "value": "3dcb5e15e1575b2996202710412e308a0a82642a4a2c6cdf053e919a7c1d4354", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768490415, "uuid": "334d5b25-ad71-4f96-8b27-595515272894", "comment": "Malware payload (Amadey)", "value": "cc4edfad69266a6358cf8218afe94cd5cf23cc53", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768490415, "uuid": "7f900c09-ac6b-4038-b92d-470c122123b9", "comment": "Malware payload (Amadey)", "value": "4aafe26dc14004f17142af442d5e715bf69f31422d16532e6e030f6d7719d163d3f3e9e92330e9e4ea888c2013a8fef3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768490415, "uuid": "25a20de1-0946-4799-a3e3-b21c1e9ababa", "value": "T153B45A4AA26943FEE07BA07CD9475E42F639744703B18AEF039105B71E571E2AF3A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768490415, "uuid": "97ebf0e7-518e-4ac1-ae07-4e9dfdb33862", "value": "dbdd68e345c789605b7642f23459488e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768490415, "uuid": "2581e060-44d3-4c35-bf1e-2c1be68b16ea", "value": "6144:5d6hX5H5nbv+n0pmQqs07mP0DL0u2uYkNdOQAsSUvMziRdO1ohhBJcAZrvHa4C9:5d6RbO0jqsZSLX2QA/fowAZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768490415, "uuid": "457126c4-3d7b-470c-a17c-21fb49d32a03", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768490415, "uuid": "63843b73-e9c5-4736-b957-6185ed14f7cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768490415, "uuid": "b72c3598-3251-479d-bf06-fe13fe696a8e", "value": "0C4A156F97CED3BCC9E551222B0D6A32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b53a2f-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478497, "uuid": "4dcf8955-436d-488a-bf1d-48119c20fd12", "comment": "Malware payload (Mirai)", "value": "92f3e866b8d0b79771258159ec3f365f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478497, "uuid": "82801e45-12d8-4820-88a4-634e939f1bec", "comment": "Malware payload (Mirai)", "value": "3df6253cda8376e2696fd41ed17b744e00beb798442b3c485b7046820454ddc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478497, "uuid": "b57d8a2a-50c9-4582-88fc-fddc6fbd8bd7", "comment": "Malware payload (Mirai)", "value": "6d36198eaf825cbb961c98b81dade84dfd629334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478497, "uuid": "9b49a35b-c407-4fe5-a6d6-bea3c4d678ec", "comment": "Malware payload (Mirai)", "value": "5a9d07c05ebe1d7005ffacc399971b5d1968c90fa56c5c61cc464805dda084ebdaa09b22c11a6fc02c7a9c1a5e603517", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478497, "uuid": "f3363c74-ac35-49fc-b8fa-a52af04c41a1", "value": "T1D3E30A46F8819B25D2C255BBFE0F014E33171B78E3DE73129D246B647B8B86B0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478497, "uuid": "5c2db78e-3f8d-499e-bf95-a0c06fafac77", "value": "3072:MjXX2sW9/XM8jsqa9wipp0Zjd9h7d15DlV/y:/sWXPjLaREZRLd15jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478497, "uuid": "437f0a8b-1d0c-4fea-83b1-db497655f437", "value": 155804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478497, "uuid": "e99c408c-50ec-4025-9abc-5ade4e69a3bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478497, "uuid": "75a38a2c-4e27-45fc-92b6-490a654c0c8e", "value": "sumrak.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28cd28b-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1768463439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463439, "uuid": "10456658-c4a3-4032-b35c-fabe52b01a8b", "comment": "Malware payload (PhantomStealer)", "value": "e24608034c7ef2351a8bdb38c4e7a95f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463439, "uuid": "65550ad4-e87d-46c1-bc41-169d3a8e989a", "comment": "Malware payload (PhantomStealer)", "value": "3e24bc53a54d730bc18f29a09e5bcbca55fa332d67a983a62bb39b12b4514f62", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463439, "uuid": "266c8680-cff2-427d-9ff7-1c5caebca022", "comment": "Malware payload (PhantomStealer)", "value": "5f8da40e01c258b765b09e9f255abccbb951e566", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463439, "uuid": "9d6d0bb4-2ae1-4c56-8aa0-d360b145560d", "comment": "Malware payload (PhantomStealer)", "value": "8f22637e9236674646bb951126c4e35d82c1dbd80a0579dcd60774887454a4133a8d1101b2bb687ce7cce5db458b3fed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463439, "uuid": "b95d51c0-27ac-450e-97e9-9969edf05e44", "value": "T1A8664A4DEE098D805F926E353E3179E542D677636CCBC330A43E1CF16DA7381EA2592A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463439, "uuid": "10b15333-3a76-40eb-a0d3-fb09f6bb4d3a", "value": "196608:qUsWaGwe/T9Yk9OWIiq7CnCTIC7F5XOoCbA7Q53xk8o0GNVKQkJtCpjMRaeaukGA:qUsWNwIYqVIiyCnHSFUbA7QTk83GXKQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463439, "uuid": "380ca0d1-e367-45ed-ab51-ba0779a51d91", "value": 6522444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463439, "uuid": "9c2258bf-ad43-4ae2-a22f-d3f6f69fab7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463439, "uuid": "b43d4793-94a2-4035-bde6-834ce88505a1", "value": "Specs_UG140126.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66fccd4-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478478, "uuid": "bac85250-2ae1-4b51-909d-b0c524a97074", "comment": "Malware payload (Mirai)", "value": "b286f934d71afa2bc531d7595d01189b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478478, "uuid": "867ba47e-513e-4f58-acfa-0ab7a2dabb29", "comment": "Malware payload (Mirai)", "value": "3ee7ab81e798ed56e2b8fe23e88d7085b48bf2029473508259e2c73b7ca3443c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478478, "uuid": "8bde45cc-9072-401a-b04d-a507e208052c", "comment": "Malware payload (Mirai)", "value": "7da30a250f71b65d00789381322455b695747816", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478478, "uuid": "5a14733b-4baa-49d4-abea-9b8ac523d1e4", "comment": "Malware payload (Mirai)", "value": "f035bb174e0ac182fc263392408926f3aa028ed76467bca2ee30009e53b562946b2612102b9a4cd1d33c82f589811e1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478478, "uuid": "d2ea34d4-ecce-47c8-8c4f-67ef67c4228c", "value": "T1ADA37EC0FAC7D1F1D4130478902AAB7FCB33D8255036CA6ADB9A9E33DD67601961736A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478478, "uuid": "71873aa6-a86e-4600-b44d-ac01feb83510", "value": "1536:dbgCj2xNs5mpM5lWz8j9j+SYVwNyvbwR8nBN/iS:dbgGMnAj9j+SYVlBN//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478478, "uuid": "65350508-d50b-4456-b020-5a4c2777b79f", "value": 98668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478478, "uuid": "bf7a4843-c9d0-4767-b1dd-22dc3b4a8c55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478478, "uuid": "5223a733-9f15-4e56-932b-4eb9309eb323", "value": "sumrak.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e5f419-f245-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768503950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768503950, "uuid": "2bd54151-b689-4c21-879f-10b4e00fb952", "comment": "Malware payload", "value": "bcf175ef3d1c6466a93c193bea879c7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768503950, "uuid": "03aff834-de08-47a0-995b-7c67810ef207", "comment": "Malware payload", "value": "40a29148d2e08951e397a5fe071820bede637288594cf7e879bc924b441162a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768503950, "uuid": "683c5f3e-eaeb-43e9-af3a-07eea8bd1814", "comment": "Malware payload", "value": "b00dda876a768b38c6380dc79d028e66cf23a772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768503950, "uuid": "8acb5518-d7a7-41e3-b97e-0d88724a78bf", "comment": "Malware payload", "value": "a263beb4120baabe231f90916a51edb34315575d8d6fec7ccacdcd2c945cc1057953ef4a5a8a3bf90af311cfe0d8ac7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768503950, "uuid": "329d8055-bf30-445e-9d5c-97cb6c088069", "value": "T1AAD2F11B06386DDBD7C5F9F20A2267D45E023C5D4A5D2E89DE47C7ECF48291CD943485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768503950, "uuid": "99611d95-fea1-48e5-bbc3-053608049a9c", "value": "768:oLR995IDakM3OW0tkWKQrHqtltBFvhuFVGFy9rFsuI8scZzxXrN:od9i3M3tUVKQrHunFvoFMy9rxjxZzxXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768503950, "uuid": "ce6c20b8-3c60-4c42-a247-29104f2c689c", "value": 28888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768503950, "uuid": "2abbc285-c7f3-4160-a3a3-280cbeb4e901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768503950, "uuid": "d57f90f2-4a1c-4eba-9524-c024e1707aa9", "value": "sdxkzX_UXA229x.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106b238d-f1b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768442900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768442900, "uuid": "fb97a708-3f23-4b36-8e8a-73db904d7eeb", "comment": "Malware payload (Mirai)", "value": "81fbe7f417178e091686260abc5637c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768442900, "uuid": "7c4a8b82-7b0f-4f1f-8561-730fc40b2418", "comment": "Malware payload (Mirai)", "value": "40ee4b2d7cdb0e3181f62b9a1a9371346f7bf9993cae9524c0dc8ccae875cdf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768442900, "uuid": "732aa39c-c968-4933-bc8f-c33e8f10edb0", "comment": "Malware payload (Mirai)", "value": "8dae197aed155f859433463c2b20f40aba4ef1ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768442900, "uuid": "aba64686-71e7-44a8-94f4-4bfa515a46b3", "comment": "Malware payload (Mirai)", "value": "8c4a9195dd76586bf77df02f22c51c4a75c25ee6e45dee4424b3096d82cbf0446ab612e41a5a6135715f7b33ef136da9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768442900, "uuid": "92bb0d7d-691f-4001-8100-a1e715eedb05", "value": "T18BB31955BC929A22C6C256BBFB1E728D332733E8D3DE7213DE145F22278755A0E3A051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768442900, "uuid": "cc9f052c-65e8-4072-b070-c92c232cfe7a", "value": "3072:hyzUe+cUodRmwXu2pY0YFFM2Fv9EihFfBQAPCpBN1l:hob+c7dRmwXu2rYFFFvi21PCvN1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768442900, "uuid": "7673eb6d-dbc4-443a-b416-0281ed156085", "value": 111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768442900, "uuid": "eb1f6cbf-a22b-4587-82dd-e379fef5ff27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768442900, "uuid": "4e1e101b-ca06-4f72-9d79-56392feaccca", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9077742-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1768463826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463826, "uuid": "b6ca3dfd-b455-4fc5-9f55-5fc1d160efee", "comment": "Malware payload (XWorm)", "value": "2e9eaf83bfa5f3c47444b7334a345cd0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463826, "uuid": "f275caa8-ac02-4407-8831-ab1fa038bed6", "comment": "Malware payload (XWorm)", "value": "4127a4079f7e6e5eea6b7af83bf549afc542618cddae8d8b1003fe2baf9f7126", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463826, "uuid": "df840879-d41e-4109-8267-8622ccbd56e9", "comment": "Malware payload (XWorm)", "value": "92d9beb4b9877e49fc152015b411ffd36d30b549", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463826, "uuid": "45413c87-c826-4584-ba96-873f26d147d9", "comment": "Malware payload (XWorm)", "value": "c85544474be5849beb85a2b375349a58e35bc4a8e77c6011dbcf9b47c92738500f9ce924960f05a7d1d36dd8f2743ab9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463826, "uuid": "86feaf14-182a-458f-b22e-46a96aac512c", "value": "T1E745017C8304042CDFC25306BBA1C4BE93A01D65E2135677708EAC9A5F7F967BADA790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463826, "uuid": "c377a4d1-80b3-457d-b20a-2e0e401b5020", "value": "768:uBahmw+obWfDI4GkvXwQE4iAI4YbvYjsvN9GTYdwtggJsBsmYU5dBwirrXAwQnbG:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463826, "uuid": "6c47b884-e1dd-4a38-ba20-2b60ab344c2e", "value": 1264403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463826, "uuid": "80523d4f-1939-49a1-aebb-c142150b57ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463826, "uuid": "47c01f39-61f1-44ee-85bf-3f48f4d0a756", "value": "ESTADO DE CUENTA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db442e60-f206-11f0-a129-42010a9c0007", "comment": "Malware payload (VanillaRAT)", "timestamp": 1768477171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477171, "uuid": "09ba79a7-65ac-467f-aa96-52d879142304", "comment": "Malware payload (VanillaRAT)", "value": "3a7e7806e67cd3fa58647829626d25a0", "object_relation": "md5", "Tag": [ { "name": "ads", "colour": "#2D2B87", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "ntfs-ads", "colour": "#95F616", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477171, "uuid": "6bfab6d2-4d68-4602-b933-bb93d2bab901", "comment": "Malware payload (VanillaRAT)", "value": "412f5dbafb3835f77db35ca42da0a00f828fe67bdcbcfb04ef8f102c2f462b70", "object_relation": "sha256", "Tag": [ { "name": "ads", "colour": "#2D2B87", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "ntfs-ads", "colour": "#95F616", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477171, "uuid": "73a107c5-c598-428b-8404-35ddf9383e6f", "comment": "Malware payload (VanillaRAT)", "value": "033bdd9cd643a06b7f7fb35c948d1e57a08cc592", "object_relation": "sha1", "Tag": [ { "name": "ads", "colour": "#2D2B87", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "ntfs-ads", "colour": "#95F616", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477171, "uuid": "172bfd04-3659-4754-be2b-d07e740af6ce", "comment": "Malware payload (VanillaRAT)", "value": "a07e1a73be0bfd363a0e5bd4c8a0877996d1cfd340f3ce158a75930a276c13cae06950c3c59f79240030c7908a50233d", "object_relation": "sha3-384", "Tag": [ { "name": "ads", "colour": "#2D2B87", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "ntfs-ads", "colour": "#95F616", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477171, "uuid": "d880ebd0-3d76-4a20-878c-bd878e691400", "value": "T15A65229893EA5B45F2FF6EB43929505195B0BA16DC13D75EA3C020CD0EB3B05E636E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477171, "uuid": "b6b58250-5d12-429c-84ad-b9d2dea3a67c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477171, "uuid": "61749ec8-a178-4c33-bd7c-a5b67b8d6e73", "value": "24576:s+JEfJhZ8j53sY1jCeqm6qv80MaooQajSMpHYWOkEfW5EQJZrUVvsgMYHQgdUU2Y:s+a5csqCeq08moPajSQY5HYryHACWRfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768477171, "uuid": "99294d91-e038-47c5-a5f5-ef948544496c", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768477171, "uuid": "565568d5-1a54-495a-a3d9-8820abe727d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477171, "uuid": "80c374a6-4d46-47ee-8b88-3c363224c1f5", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612da037-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435734, "uuid": "172281f5-15b6-4d4b-81f5-595f703614e2", "comment": "Malware payload (Mirai)", "value": "ec7d404692d80347a5af92657563fabc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435734, "uuid": "e89c51a3-8dcd-43ab-b9d3-d5ea083523d8", "comment": "Malware payload (Mirai)", "value": "4131732816118512336fd9c5724099454d6ca9414e6ceb7b8f0d73fb45117277", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435734, "uuid": "3e2e80a1-c09d-44f4-aaf5-d6d242175f77", "comment": "Malware payload (Mirai)", "value": "3e0f5e93c67cf402ca2cf4341191a3132ea4be14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435734, "uuid": "e62bd4a0-2d9e-4c67-93ae-b5e36dbe0a2f", "comment": "Malware payload (Mirai)", "value": "ad31a66b76f666ed071e78076d0a4da8ecf9c8c5b7802c5058a4368ab72f73c3e1290a70080c7cb4ea0ab0bc2a8f69c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435734, "uuid": "afc27f87-d74f-46d0-9403-fc89ddf8dc51", "value": "T14BE35D86F802DE7EFC0BD57E44670E19FA30A7613243172E569BFDA3AC321651D16E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435734, "uuid": "8d536d6f-354a-4672-aa96-cc3b0c8127dc", "value": "3072:TowRJaJQMUmfh6qo76o46CikshvXMMBqrTGQSo:B0QMUmfLN6hhXMMsGQSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435734, "uuid": "21f5f515-1580-4958-be15-454010bd5c89", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435734, "uuid": "b64da4b9-8410-4f98-9e62-854d495c6ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435734, "uuid": "d53d895d-ee88-4de2-bd0d-88a53fe9ef3a", "value": "systemx64.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17cee923-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload (Kaiji)", "timestamp": 1768500465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500465, "uuid": "ba3e3a8f-28e0-43e2-9f46-e95b64c2c120", "comment": "Malware payload (Kaiji)", "value": "b94b808f86fa29dd3868035f200ed206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500465, "uuid": "2b55fb0c-3c72-4271-94be-3a173e8d979a", "comment": "Malware payload (Kaiji)", "value": "4134fb3554e6dfa82d4822886968f50a008bb66b46f54f3a28dfd0ce167b1283", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500465, "uuid": "205d1ec4-ee33-405b-bac5-01555ddddb62", "comment": "Malware payload (Kaiji)", "value": "1258f92a95a8096ae50fbdba313946b292d8b3e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500465, "uuid": "52a395ba-87a9-47ef-8135-45e88b02f9a2", "comment": "Malware payload (Kaiji)", "value": "da7be60be6af8008c39dff1a75c9b8339f44549dc7ffa1a34ead3af882045fa7299437350ff051185cc64d54ed852014", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500465, "uuid": "1360bb45-9e7c-4ba3-a7fc-5792e1496c50", "value": "T191A50857B8918582C4E42677ACBE81C833635EB99B8653266D04FE3C3EBF2D90E35354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500465, "uuid": "08270b52-3887-4084-9b19-f6d8fb5067e6", "value": "24576:gNwGGRggwEGpD5IaZIJzIDgliOAMUh1Rskiq1zpQHCaRU7axVL0rK3k3dVh/cviW:VrcNoLo3z82T16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500465, "uuid": "ed58f56f-104d-443e-a100-e6f174e02b94", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500465, "uuid": "4f998759-750d-4a06-81f8-b1a84a9a225c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500465, "uuid": "0aa65f63-6bf3-447a-9498-504048ad5376", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8462cf7-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1768463771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463771, "uuid": "d6569ce8-d1f2-43d6-8e1b-8eddc790ed00", "comment": "Malware payload (PhantomStealer)", "value": "5344445546f1095b96a98cba4dfc963c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463771, "uuid": "c812e9d1-976e-4b11-b546-1754f1b3308c", "comment": "Malware payload (PhantomStealer)", "value": "414557952c390312ea3cafa3cd3c069ff072c40840277921391565b79c800456", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463771, "uuid": "c70b7c9b-eb42-4415-ab07-1db02722ea32", "comment": "Malware payload (PhantomStealer)", "value": "5c2f497d0e0a6d88f47f6ebda9bc773594b512b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463771, "uuid": "4b906e5b-1b3d-492c-9aa4-0673db446e19", "comment": "Malware payload (PhantomStealer)", "value": "4f95cbe0803a949902445d2270087c1d5ec954d2bbc6128f3cd73796a2f96344b4ea7c11d5e2abd623f95aa864ae3b6f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463771, "uuid": "b3c6a1ba-bf93-408f-ad0a-884bbfd94d31", "value": "T1C4661A48EE048D881B568D393E72F9F541E7655BADEB4238F43F54B17EA3280F921836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463771, "uuid": "1c039393-ecf3-4262-9c96-39d5b2da8d8f", "value": "196608:OHShwLuNkXq+Ld8MonK/i7zfr+/jyFJkDVlBsCqfTYUHdZgb1RTt2GYOkJjz51tA:OHSyLlXH8MonIizolxvsCqfTYAdZgb1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463771, "uuid": "4cb81728-49f6-4d41-9def-d8c08853d80a", "value": 6522444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463771, "uuid": "9158ce48-ebdf-4835-a1cc-d55958280fb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463771, "uuid": "83f11e12-eaac-4049-92fd-aa1fb2a9b573", "value": "Document-66700007.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b843280-f24e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768507907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507907, "uuid": "5499de8f-06f5-4711-a84a-d810df07c152", "comment": "Malware payload", "value": "69145e1881c9bb21e19e37c9a634bdf4", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507907, "uuid": "a6cb5e03-76ab-4cad-ae4e-b19b572576fc", "comment": "Malware payload", "value": "41aedd60bd7c3e3a42260b470c4c48cfe3d55ceb13f2be70ed6b7548add364e6", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507907, "uuid": "fb0dbe93-ad3c-400e-a0c7-d1b88742357f", "comment": "Malware payload", "value": "a6b68e619187a869c0e1f25bb6fa9c80885033b7", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507907, "uuid": "25ed53d2-468c-474a-988a-8439e2d8c0ec", "comment": "Malware payload", "value": "0e4c4a5a9529170000630ef6c318cc19077f1e454806f5b6bfa82ab9047a40832a985c1e88710572b470d01b74502e88", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507907, "uuid": "cabcf762-ff72-4113-a4b4-fefc2861b8bf", "value": "T1C257333784061485CCBAB8F57B135FEB7EFACE90576DC823545182C25D1D26B2AF08AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507907, "uuid": "00721c4c-763d-4928-b03c-668b3f4789e5", "value": "786432:vkQxH2oDZEXfQGakPVjk3VDqyO/uvqzwyibzqbiy24j1:vkmGXIGaUVjk62vqCbObbj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768507907, "uuid": "710c1acd-b46a-473f-b754-54ee23d10dc8", "value": 29290118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768507907, "uuid": "bc016a09-bf6e-4e65-b61f-5647d70a1ad0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507907, "uuid": "ed2b3e0d-129c-4cbe-ba48-369bb1186b8b", "value": "number", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5314a0b7-f252-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768509584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768509584, "uuid": "7291c2c1-d2b9-424c-b4df-eaba9082fa7f", "comment": "Malware payload", "value": "f176b4b5967a9bc7b41cdf6976d7a180", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX3.file", "colour": "#28DFCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768509584, "uuid": "52260a05-14c6-4e10-881c-cbd241926d27", "comment": "Malware payload", "value": "4228e040d053a0158fb70157c73d72fc7402633c7fc6014cdd50bc2a37d31350", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX3.file", "colour": "#28DFCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768509584, "uuid": "466ef2b0-f319-4eb3-999f-9760e58f1b6a", "comment": "Malware payload", "value": "3df81eab4d40cb86e367a43e1a71678a85241ab7", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX3.file", "colour": "#28DFCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768509584, "uuid": "a26e5525-1dd4-4444-b447-97d5f4ed6928", "comment": "Malware payload", "value": "97e29340418a9836118b6db2782c21514f64fc1f45216cb1b725d747ad875ac2c48e07c557a391d4268824f0a73db355", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX3.file", "colour": "#28DFCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768509584, "uuid": "e2f2ca54-3b40-4c5d-86ae-4dbb4ce8fb13", "value": "T15A93191A53F620BBE4B6577999F202539A3179B15B7A96FF22C4C0BC0F236C0A531B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768509584, "uuid": "a7ba9a90-7023-490b-a89a-9f74aee3bfeb", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768509584, "uuid": "4666b638-e21c-47b1-a5d8-6d016579192b", "value": "1536:Trae78zjORCDGwfdCSog01313Ws5gfyCAbWCbT5:ZahKyd2n31P5SXRCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768509584, "uuid": "1ccc68c2-577d-4f1a-a0d1-7022c8a6eede", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768509584, "uuid": "46caedc0-b2a4-4ba9-ac29-e1490188790d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768509584, "uuid": "c3d1d7bb-98e4-4cb2-ba77-f7a1f7c64497", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4180a46-f1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768449617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768449617, "uuid": "118a3fb6-c622-400a-8765-b7c22f2ab693", "comment": "Malware payload (AgentTesla)", "value": "0626bb5f9dfe442a118861f5956c8f1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768449617, "uuid": "619f27f1-a6fb-4914-af67-6b0fa80ce5f9", "comment": "Malware payload (AgentTesla)", "value": "42886a79490320b8fcde15409f8e7bd811d4da019141ea47030fee1d6b4f6519", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768449617, "uuid": "fcb73962-e279-4d6e-91fb-d2edc1d0af97", "comment": "Malware payload (AgentTesla)", "value": "4589246ad99d6c61be2fb4874017d82b4d40f3f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768449617, "uuid": "dc7b5287-998b-4c59-9805-733d18db354d", "comment": "Malware payload (AgentTesla)", "value": "ae8e007c542124ee32b265d800c10d9926594ccd44b1a5f467463460f4240ffea75e88e70a56f7bbf06bfb1b00a85e55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768449617, "uuid": "4a24c70c-ac5b-4176-bda1-91b17abd5762", "value": "T18E15335DEEBC39C136A434D133157AB70C8D46C8E6E8B83BB0B60BC489AB574569C4E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768449617, "uuid": "a27646d4-3797-4be6-a08f-434419c4c2d7", "value": "12288:ykph6/w+FUiQGjVEZy8k6mFGdMYs8mOIvkaAHJJ1j3j29K/hBmH4e12FEG:ykM6/cb63dFs/OmkX1ja9KjWD2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768449617, "uuid": "8ec7476f-1970-4d9b-98c0-49f784a086f0", "value": 878603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768449617, "uuid": "32e1905b-d8d4-449a-8bfd-92c250c00e06", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768449617, "uuid": "6c7c0dc7-52c2-4804-9b5c-cfbd51e1fdc3", "value": "nAWB_-_TRACKING_Shipping_Documents.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f51544-f1f0-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768467493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467493, "uuid": "8988fc73-a7b9-44a4-9260-8d16323acd5b", "comment": "Malware payload (AsyncRAT)", "value": "b886c8d8978442b453b7e0c7b8859a67", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467493, "uuid": "189beaf5-3e92-4918-9534-fcf22ee1dd53", "comment": "Malware payload (AsyncRAT)", "value": "433aa1a20e6ecbe0a72255ec7528f2a4cd7ce42ae5973e1f1b69ec26f9d767ab", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467493, "uuid": "64b8faa6-0866-4869-b2a1-e5b4787f709f", "comment": "Malware payload (AsyncRAT)", "value": "2d40395cbe3543f815309a654ccc11a6b747e56f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467493, "uuid": "060397ae-aa2b-4296-b617-7e820b3eb125", "comment": "Malware payload (AsyncRAT)", "value": "408ff3092b638bf06264a2846b016b73aee9ce133ab4cdb774132a290f0c55bd859d1ccd3712a7d0a635d55468d7f7fd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467493, "uuid": "2750dc8a-05a2-4e78-8f50-a6ba1368feb1", "value": "T19E535C103BE9822BF2BE4F785CF2624545BEB5636603D54E1CC411974A23FC6DA42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467493, "uuid": "c8d56f40-9afb-4acf-b108-dc6e068dff1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467493, "uuid": "a586b500-a733-4e52-9a8d-2e378254ea37", "value": "1536:suQDZTnl672344EaxSEbSXSFKyUVdtbnkTU+6:suQVTno72oSSEbSIKrVbbkb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768467493, "uuid": "ba08f22e-a046-46a5-ba53-e48db6a1516b", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768467493, "uuid": "e58e49c3-93ad-49a5-a47c-0a36191e1a1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467493, "uuid": "41e87ba8-ab0f-4cba-bd8e-b2a106c063c3", "value": "Opera.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a9316a-f202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768475438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475438, "uuid": "22403790-6e03-4309-956b-0bf534b54a3e", "comment": "Malware payload (Mirai)", "value": "e1ade53c244344a3ce7af320d4a94525", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475438, "uuid": "8bbe33b9-397e-4e1e-a56e-dc48ce41c3c8", "comment": "Malware payload (Mirai)", "value": "433b22d173d940f1cfc9a1231404d93bb76e16a2fed7dcddf3c5a99a99ce3beb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475438, "uuid": "49a7f95d-bb9c-4b61-b9a5-3b4ae8d5f3ea", "comment": "Malware payload (Mirai)", "value": "b4a43e17e9411cc3d1a744dfd9db003c89595bfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475438, "uuid": "7fea5653-ae48-44d8-9782-5033b106312b", "comment": "Malware payload (Mirai)", "value": "69e0fafbbc969480e161ee91a945f7138c6f3e4a753ace95e0c75cdc284444b08e7b689e512025d6993b2da435ebe231", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475438, "uuid": "8a358ece-cff3-4088-8e6c-15d4a367913e", "value": "T145234BC89593DFF5DD110AB53177AF328B36F03F216AEDD2C355A932A942602E50729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475438, "uuid": "e43e01e0-f73c-4e3e-949f-5d23be22b5a1", "value": "768:2Hs0IKoqqwOMi1/hUMQozES2U7E8+Hyt2/1PKmrrr+AlxcKn+Gqixfzh6n:2HsXqqJMi1/hUMQj9A2/1Kb++/i9zh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768475438, "uuid": "bd09847a-a63c-4b0b-87db-a8e316d858e4", "value": 47216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768475438, "uuid": "298d1144-ae31-407e-80a6-c70663de343b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475438, "uuid": "c94bf18f-ff4b-4175-9d4d-4dd2d1cbb94c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21d75c8-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768463841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463841, "uuid": "92deb5ef-29af-4bb9-a294-8a1ea4d7dfab", "comment": "Malware payload", "value": "bcb14f62964fd127051fda5b18efc871", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463841, "uuid": "6ff778df-8c44-4f1d-96f6-8cb85d7442c0", "comment": "Malware payload", "value": "43efd9ed44086c33dd6e89e79d08489cf7113037fe9ac9e4a6f888b792713ab5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463841, "uuid": "151ce89f-29c3-4d6f-9d8e-0a8c6c920692", "comment": "Malware payload", "value": "6a16117a308a9fde33a0bac743e930002ae7ec05", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463841, "uuid": "e1c73497-0082-41f7-8bbf-e1a1dd35fe13", "comment": "Malware payload", "value": "862e27e4959c83deb79b9bb0555ce36af3f9920dfffdb36f180867630a137b98145feb4fb636e561727c04460bfe7086", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463841, "uuid": "12cace0e-dc7d-4952-9c18-426a9a7e13fd", "value": "T1DCE02686A63BCC3A4E97C56641F59C0DCAF1F7046136C42A6A61AD1C22062704366086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463841, "uuid": "89dc22c1-c509-42b1-afcf-5462fa78a310", "value": "6:j+DMN+7yzQNARkVYs62zq9NqhusnytGQO0cmws+KqGUriDtRUrv:KwApNARkKs6KqahjnGHpcmwFKqre3U7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463841, "uuid": "b1b40f9e-1552-44b8-98d3-b6d44b19d90e", "value": 348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463841, "uuid": "a9f728ca-b627-4312-bf9a-03c0a9c0e4ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463841, "uuid": "1ff1732d-fdf1-42ac-910a-c2126de541d0", "value": "tuananh.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675fe94a-f1d2-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768454642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768454642, "uuid": "34a85697-4a2c-425a-b466-86b0baed88f1", "comment": "Malware payload (RemcosRAT)", "value": "2879058452ff1a5c7607ae9d0d42aa2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768454642, "uuid": "627f1284-0fb0-400f-a80a-3e9880029698", "comment": "Malware payload (RemcosRAT)", "value": "46018fbcf205ace11c502a5cec83c19c69d3849c2bf99cb977e8ab8de905a5d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768454642, "uuid": "e52e60e7-35b0-4db1-bbb2-7d69ee6d70a0", "comment": "Malware payload (RemcosRAT)", "value": "252a3417d41a2df9e4e9e877388f518d6f19781a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768454642, "uuid": "b75c13a1-4056-4e50-aa63-69ba0e138846", "comment": "Malware payload (RemcosRAT)", "value": "2d1a1106f5bce93992ca7228e8f62bdbefbe7d7e528dd74b06e9281a0643b4248e41ef74612c4f2dd2572ffb566094cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768454642, "uuid": "d42b9821-ad3c-4793-8a4d-1e71d3fbc6bc", "value": "T1B9441215DE909C94D949D336F069C71A076E5CAA289E02DCCBEEB9377973AC4782D033", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768454642, "uuid": "068b4b8a-dfe0-4983-8f75-19656eb0469f", "value": "090524468b2e1476c8a253edcc4528aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768454642, "uuid": "a4a57b48-8043-4e30-a286-5ae18acfdab9", "value": "6144:0bxaLacuw4LOUFubxYlBszuASi0yowfhQxDuxr6SE:0bxGYw4LxlBY0yowfPFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768454642, "uuid": "441ca93b-0a9f-4146-9f9d-448d5a7390d2", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768454642, "uuid": "e8156b0f-bce6-4f45-8201-f911570e1feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768454642, "uuid": "18b9a1ea-aa5d-484e-94b6-64d07fe83aba", "value": "w.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd655be4-f22a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768492609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768492609, "uuid": "67f4c9a1-69e6-4079-a7af-ddbca5f41601", "comment": "Malware payload", "value": "18f34c3abe0cf17ba19f55b213fb6de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768492609, "uuid": "887ac32f-d32e-4f4a-b58b-5bb78a4993ec", "comment": "Malware payload", "value": "463cf5ec206771d24077403cdaa1bb2d590bd04c07f0e30676437e2b341c77e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768492609, "uuid": "0c848b75-3a75-4a50-97c1-96b2b648e817", "comment": "Malware payload", "value": "26cb9e7bb7f4d130fc766d177a8c4e55db268dbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768492609, "uuid": "95bf3bbc-29e2-434c-983d-fab48ca1302f", "comment": "Malware payload", "value": "d6d6631a4a16d81120cfa67917b27a7250e85391a6e85b3dede42ea3dca6733d8835c554289a2c5065e3450797d39a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768492609, "uuid": "7cf0d48b-96aa-4c96-9c7d-36e5a26b1c8f", "value": "T161B5BF2639EE401DF1B76E75E6F475AA4A6EFB232606964934C1434E0E23640EDC32FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768492609, "uuid": "190bae5e-5db6-4e92-ab99-de7dcde9342b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768492609, "uuid": "fa046a3b-3373-4ad6-92cd-7acebc6de0ed", "value": "24576:u+SWeWBRYRR1qJ10m8yXP8oc5R2NntxO0KKSb7yviUSQaBaOwIRxl2S62/90yFoV:h7YRnirm2NnPlKKSb7L3wip6MaRHYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768492609, "uuid": "f8b4c569-3256-4211-867b-eb052e94c8f7", "value": 2351104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768492609, "uuid": "f492cadc-1b76-40e3-869a-ca022c5339db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768492609, "uuid": "6291b959-ac8e-4159-9012-33e60ddabcb1", "value": "18f34c3abe0cf17ba19f55b213fb6de8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff74732-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768463649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463649, "uuid": "6fceb179-df60-4d1c-b5f6-b3b42facd803", "comment": "Malware payload", "value": "9c805b1b4934057d03da76f2576eefe4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463649, "uuid": "b1770730-1d7f-4b56-9c01-f976618b8d5c", "comment": "Malware payload", "value": "46f35d9ab18fbb2aba0073e8dc81b8d28776529c0fd8b55fdfec4f265fd620c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463649, "uuid": "4701c893-09f3-4b60-a8e6-81df7ac4e707", "comment": "Malware payload", "value": "94fc4182207f86954763d2f16f352140b4bdeeb3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463649, "uuid": "c36e00f4-c781-42e0-b101-451acb929e34", "comment": "Malware payload", "value": "5b1d603b58d0ff8450e048235a3d89b88555fa9d513630b1747c14779d67e8b840596b85dcdc91b7293b68504983f8ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463649, "uuid": "69ffdc85-5b5c-4d58-8a3f-c22a75ff79c4", "value": "T123557FF677880DF8E9111410D8592847BEA4B1B3AA950F0F6AF0E6CF97414BE46DE393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463649, "uuid": "533a77a6-b8c0-41bc-a7f3-87e87fc33d8f", "value": "192:m0I9vmI9WmI9oQvsI9W4I9PmvsI9t0I94I9I9II9aI9I9h2vpI9t6I9JQvlI9W4V:mzuSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463649, "uuid": "abc66213-03ad-41c8-9092-dbe7a9a7fe86", "value": 1281624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463649, "uuid": "11fec9c1-4e8b-43e2-ac26-e8bbf5e894b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463649, "uuid": "436afdf7-6c1e-4b9a-b876-fcc68720554a", "value": "SWIFT MSG0102623.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b66c49-f20d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768479817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479817, "uuid": "45631f8b-97a6-465b-9853-197d64366f35", "comment": "Malware payload (Vidar)", "value": "34973fd072588f84bd836d754486efde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479817, "uuid": "ba4a1066-3956-4a78-bb86-25fbe09e344e", "comment": "Malware payload (Vidar)", "value": "47455058ad23eefbe58bcd390d2332c3cacfd3dcce6af9753049ea1dbbbb217d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479817, "uuid": "ddbee594-9fbc-4cc0-80c9-5fa9d72bfe1f", "comment": "Malware payload (Vidar)", "value": "4a74ca12355f27b252b21f4dd9a4c6b9a88876bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479817, "uuid": "f7ff854d-1f2e-44d3-89fc-0c6186b0a015", "comment": "Malware payload (Vidar)", "value": "2aa13f6e42b9b65933bb1f46edd8645c0fda5ca5933e2463c4b7e6a5becd515d2f577d1a30c17cd95df2fe4b22313435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479817, "uuid": "5d325961-cfbd-49ff-89b5-69bcdf300e49", "value": "T1CDD59E06AFA00AA6C53AD674CA634732C771BB915334C68B165AD74A2F33B904E7F731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479817, "uuid": "524095d5-5a7e-4722-9e45-2e761396ec62", "value": "17702ed66bbbb38da685a4e5113c9b59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479817, "uuid": "82f0c99b-6103-44c9-9c93-1a732803d35a", "value": "49152:qozvv55mk+BWXYc5sggrYsa/7akziNlYxFkYWqdmUA:lDmkXADI2kzic3xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768479817, "uuid": "b0d04bcf-2bf1-4cc9-bd26-17d9c891634c", "value": 2886144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768479817, "uuid": "0c2a9ce1-3fc3-44c4-859e-97549c7b7905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479817, "uuid": "b206faa0-83b3-45e9-8bec-b89ea503b1a4", "value": "tcl86.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615c66a6-f231-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768495434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495434, "uuid": "b6cbdef5-fee7-47d3-9cd0-95a8bbe55fb7", "comment": "Malware payload", "value": "2035f1dc8b8d6d2c71be47000baa9c63", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495434, "uuid": "39c66ca7-46ed-4ce9-a40f-0c0dcbd2eeec", "comment": "Malware payload", "value": "47a6340fc064210442922ca608f18275db019a142f2971b3c2b067e2ff11221b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495434, "uuid": "e67200b8-28c9-42b3-93c0-86356bfa310f", "comment": "Malware payload", "value": "f761b48510b0bc67ea3847cbbd83353356ab1bc9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495434, "uuid": "241c8149-7dea-4179-aef7-734a37ea3cef", "comment": "Malware payload", "value": "4884c3dc832ce874187c3ddce4bb8f9bad6063c0de12ccad77827e326bdb030f1b2c12aadc436cbd479acebf088e1843", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495434, "uuid": "2bdab957-c9be-4bcc-b3f9-b8a44ccf4b0d", "value": "T1A211298E2014493DC8FECF6C7CB685B0A040EA96B9C41B344DE818970884778FB9FD2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495434, "uuid": "0750fe0d-4126-44b1-9df6-89b6038ed043", "value": "24:MZd+didLd6dydhdOdO8d3doQq7yFxdhDqr:+Egh0crAt1efOFxGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495434, "uuid": "f2a1a6aa-5525-47a0-85f9-16b4d9acff84", "value": 910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495434, "uuid": "11389bd6-cd51-4d61-a1f6-f2b0621aa667", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495434, "uuid": "65bf1eca-1be3-4eb3-875d-839f1c5ce1f2", "value": "nigga.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a19327a-f1db-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768458432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768458432, "uuid": "ddecf995-d75e-44dd-a739-53d07aff6d36", "comment": "Malware payload (RemcosRAT)", "value": "bca369c9295a3b29cfc25ac8963da281", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768458432, "uuid": "5cc70632-54bf-46a4-9837-3a9286ab3cdf", "comment": "Malware payload (RemcosRAT)", "value": "47cf8deac585b838fe099e469370c7e0ed3f04a5e6f8e240d9d83da6d9624a19", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768458432, "uuid": "b72035a4-0641-4ea1-b2b4-b83c33e578e7", "comment": "Malware payload (RemcosRAT)", "value": "feda65109797ac28f4d8c417e0367ccc4eb928ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768458432, "uuid": "fd9f61fa-ad3f-4a95-a29e-96be847cd4e1", "comment": "Malware payload (RemcosRAT)", "value": "a2d497a2bbbde33dd1e9493855d226651c24040edf203fc83eb000bbefe3a0b569d8d5a732e919338340bd621a8ce2e8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768458432, "uuid": "86485c52-8e54-41a7-8f72-1d7396e91012", "value": "T1F41495BC79B23BF42885D27E18E4CB11F4225FD2E0756B2269075EE09D4B5900E1F6EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768458432, "uuid": "7d26310f-acdd-4103-afaa-6a1311f42330", "value": "192:25yP5TNaLqs6ROplN9nhF92+4tqBysbP0RQlTlTDsdWU3r1pkiKl:bhwzeOx9nhFxxTodWU71KiKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768458432, "uuid": "c85788ca-a0f3-4431-9f84-d61c4e426486", "value": 196847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768458432, "uuid": "5b7d550a-70db-4480-8fe4-f02e0821f27f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768458432, "uuid": "46afaecb-83a9-4fbb-88be-0acd988866df", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4a6185-f1e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Blackmoon)", "timestamp": 1768460803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460803, "uuid": "5fb12f10-fd12-4f61-b11e-a8d3f747fbd8", "comment": "Malware payload (Blackmoon)", "value": "53fece8e74217785ff010d913b1bc20f", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460803, "uuid": "d8f0d92b-5743-4222-bfca-bdf3bfedfa77", "comment": "Malware payload (Blackmoon)", "value": "4978dae74e4a635c3bc0c2c4efcab7d6f0e4dea849f0e3da6de8f29245986bda", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460803, "uuid": "c594d7fe-3aac-4971-9b87-62f30a167437", "comment": "Malware payload (Blackmoon)", "value": "0099f573934f0a227f4965db70c1fb3d42fa9621", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460803, "uuid": "07110274-7bfb-4195-a021-3eae05c4521a", "comment": "Malware payload (Blackmoon)", "value": "ee91225b66adba90c92a12fd0e9282ad184f4db00df0f225713ad66fb486813a24baeee7c1730598f40c4c849835d76a", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460803, "uuid": "38e32a88-9a16-4c4f-a49e-6d914e187191", "value": "T1C336223375E28432E9A610B15AD81B15AFFAE6330439CC4B57C46E487B71DD3E61A3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460803, "uuid": "e4cd0f8f-ee99-4cf6-bddc-50da84781ed6", "value": "67854b432b1ba315fad64aafa502bfbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460803, "uuid": "695cd122-9a46-4251-acf8-f6dbed7a6850", "value": "98304:JIviGjZQK56CAtyIPcNznBoyxDYHLrEYaP43LG9Q2LfnsZc9QXFkxfGcAgqZp:JsiGQ1jyKuzBxx8vEYEyLFWz96YqZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768460803, "uuid": "6721280e-b2a8-4d33-8552-1cb99afd9fb4", "value": 5300136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768460803, "uuid": "4446aba6-3979-46cc-8955-209f52a9799b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460803, "uuid": "ebef300f-d09b-486f-82c5-37af96e01f12", "value": "d9bee44b595289a3aaed6997542652f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116b640b-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463518, "uuid": "554d99bd-c046-4a34-b69c-94a8f5ff29cf", "comment": "Malware payload (AgentTesla)", "value": "facd130a9f53e973801d830bde3c1c7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463518, "uuid": "d06f238b-df51-4fec-a1a3-d0f29dde3c89", "comment": "Malware payload (AgentTesla)", "value": "49e2a039a4f15bfd5d74464400cb5461f93096fab61b3ca0fce33b29fb3c75e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463518, "uuid": "9c3a75f0-8c4f-4712-ae41-a35d21ee3646", "comment": "Malware payload (AgentTesla)", "value": "e2b2ca38189168bea7071515cc3dd3df2908fbc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463518, "uuid": "fe34286f-88e1-41c5-87af-e9f63ff1c021", "comment": "Malware payload (AgentTesla)", "value": "c8a3c6087272eb070bb22b83bb375b26b368dc67382171ff9c382c391ddd1087c6abd4258dc3230c3eb320a2a0afcf46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463518, "uuid": "8288304d-c527-43aa-a50c-c405395ca0d4", "value": "T17F83329E3BD7B462535320337A3BB05BF23E4CC1754C80A5D6B96688BB3871CD639929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463518, "uuid": "029b1406-0ae9-4d7c-9bd6-8047dad73d72", "value": "1536:bHriHw3oX43wvc1aBcYYrPjBg3y6vdU7BTy6xjBk2u1xCC1sR6v:ffgB+jBQrMBTdFkzxPsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463518, "uuid": "626349cb-fa05-4cdd-8037-60268fc302a7", "value": 83726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463518, "uuid": "71a8df5d-33dc-4149-9cd1-85a5799cfbc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463518, "uuid": "53d6dcbd-3cdc-408f-bd9f-129924db2344", "value": "ANO2601130010-GUO XIANG.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341bdd6e-f245-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768503948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768503948, "uuid": "7750f5fc-026c-4bbe-b9d2-48645ae46faa", "comment": "Malware payload", "value": "f6f51f630764c20ff6e39996ad4e11f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768503948, "uuid": "040836df-3dad-4111-a5ad-a34cb57bc44e", "comment": "Malware payload", "value": "4a1dfdddfcee13ba78e8e21ed9f8ef1a5568fb241a60149e6cc9791f03ea8527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768503948, "uuid": "f5cab801-8ca8-4d96-b8f7-afde1dec3915", "comment": "Malware payload", "value": "41a9f72490b10ab3469388b3e2aa5bd23513f2cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768503948, "uuid": "f5b076ea-82f1-439b-b8b5-034eb2b283cd", "comment": "Malware payload", "value": "83f99c060f1c11ebd8f88c234900f4c7e4a64a5b1f515934f808bfd03f6679364252ecc282a7eff17739a5d3d4f79a9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768503948, "uuid": "2582a6e3-c767-4244-aa97-9abfa4961c85", "value": "T188B45C46F387A2F7C82705B0134BF77F4620F6369461CE86A7989D5AB8339F21A4D352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768503948, "uuid": "1fdc8573-b704-4c17-a6f3-c2b37383cad2", "value": "12288:4Ufrcn+vwK5ripVuL/pVbzf66ySjQn36Eoj:/fUywKQ7uL/p5ffjQn36Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768503948, "uuid": "7840525b-1b7c-4730-abb7-861c894cbc33", "value": 502280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768503948, "uuid": "69235ec4-4719-40fd-8f1f-ef64b55c0f89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768503948, "uuid": "cbe0b94e-20f4-477c-a806-88960b116fec", "value": "p.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155c1b27-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload (Kaiji)", "timestamp": 1768500461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500461, "uuid": "c901d9fa-4089-41af-a0ee-ef9c87c4059d", "comment": "Malware payload (Kaiji)", "value": "79dc34192b82d7242cbaed1b9efcef01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500461, "uuid": "4e5cbe6a-0f82-4e09-b3b4-5a081e45a08f", "comment": "Malware payload (Kaiji)", "value": "4a97b1c545ae2f9f5e3b5aad2db93a763aaeed9678ef6fbf3d5149f912a31e93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500461, "uuid": "d6c53538-f159-43fe-bf60-ba518138613b", "comment": "Malware payload (Kaiji)", "value": "cc168af72ffceb3004323ed4ad42b28c82c1e85b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500461, "uuid": "87d616c3-6091-4655-8749-2f5d6257817b", "comment": "Malware payload (Kaiji)", "value": "ecd435a28f5843524ad30bb613011005c80341d26795c12f2fd6ecff42da2415cc08399e9d448040296570bec3fad524", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500461, "uuid": "54841819-c86d-458f-8a90-48a8c4c591f7", "value": "T18FA50857B8918542C4E42677ACBE81C833635EB99B8663266D04FE3C3EBF2D90E35354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500461, "uuid": "31370273-4822-40bd-9972-d57579bab7b6", "value": "24576:JgCbFbDVZ7bVCj3ozPQPTUkrtQ05OYRWNOrdErF4ff1kRrGnyVhv8uofvsRWA1SH:VCWcuM2T1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500461, "uuid": "d3d91fe9-4e33-4b3a-a485-88f1e37294b5", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500461, "uuid": "ac7f4d7b-78d3-4c51-b53d-b2941c1ac09a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500461, "uuid": "a3dab4d1-41c0-468c-ac48-ebb7b233b8bd", "value": "linux_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd92916-f200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474650, "uuid": "5a0507ab-1f21-4370-90f4-c89462ccabff", "comment": "Malware payload (Mirai)", "value": "504c11229e2ae9f4062038371d26710a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474650, "uuid": "4a11699a-9333-4dc5-8501-32f8dbde8a61", "comment": "Malware payload (Mirai)", "value": "4acf40b8eb999f5231f9c614e74fa05e1bd2db5fbceef35338c91470f75591bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474650, "uuid": "5c2c01ed-ff9d-4267-b596-b131f1f4fc39", "comment": "Malware payload (Mirai)", "value": "8d503d26ec710f3278ed526eebfd0a5c62740d12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474650, "uuid": "6a0bea2f-375f-432d-a2b0-fae011793bb4", "comment": "Malware payload (Mirai)", "value": "a3dfbeeb706c710373ada432eba39509a73a6feef096bc90b4e2ca71826ddbcdb6d792bd6e03757275967f0c063bda1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474650, "uuid": "3966a331-b4c4-4cf6-91aa-f656956e50b6", "value": "T105633AC0A193ECF4DD1507B53077EB374A77F136612AE9C7D3A8A923BC82A41950B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474650, "uuid": "1d8e5d53-0387-46fc-9aba-98097fd18a92", "value": "1536:h4uwwSB8qv117K/Mn9O/Eb/vRkWNZLF/EfNatGWkffal6t3zzcS5KfXQE:hBxEV3Db/vRkWNZLF/EVatGW6aolcSQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474650, "uuid": "a765b4eb-f972-4de8-abf6-f93262ec79e2", "value": 70672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474650, "uuid": "fc867ecd-8056-4931-9326-c75340161e90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474650, "uuid": "a8beed0a-de9c-44f5-bd81-d85b529083cd", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178b10e7-f20b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478990, "uuid": "ccd5be21-8ae2-4b1e-8dbf-c1805240ccff", "comment": "Malware payload (Mirai)", "value": "284857f21271818f639608357f254137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478990, "uuid": "47c69ef6-e797-41dc-b83f-e056e50193d0", "comment": "Malware payload (Mirai)", "value": "4b31ab02ed3e3f6074f999c9d573a5db483674b8259a3ce1be473d62a9432684", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478990, "uuid": "b7bf825c-159c-47d8-94c6-78f22a33d944", "comment": "Malware payload (Mirai)", "value": "466362fffe96872f4c5402d5ff9b28eb1fa72bc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478990, "uuid": "fb34061e-35e4-48ee-b673-184cf7069eb2", "comment": "Malware payload (Mirai)", "value": "9284d5ebe3c59bd7360fdf5e2b3a48e7fb622c088d4bdc127142d4df4b6f54da43eee4319a53c9fbae93d0b68e08250e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478990, "uuid": "18cce461-448d-45ea-9672-99305e996e49", "value": "T18263B309BFA10FB7ECAFDD3749A92B45248C651A21A93B757934D428F30B24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478990, "uuid": "dee4c4c2-edd5-4cd5-9ac2-1fcaf0c58f9d", "value": "1536:lpwA9WL4oyVh5X39DZvBfCwcnpZcBWOgVw:lpwA9WL4oqnNcnpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478990, "uuid": "5f7b9f03-904c-47fe-92d9-f97fbc7807f4", "value": 71840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478990, "uuid": "861f6ae9-c00e-4233-8a03-0bbad10ad66a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478990, "uuid": "5a2ced00-1ab1-4352-b974-63e0f0219323", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d2d11b-f1bb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768444604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444604, "uuid": "445b7d0e-a01c-4f67-8966-b929fda3db2e", "comment": "Malware payload", "value": "035bd6b172da46d12639e72e0f253d66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444604, "uuid": "af2ab16d-7b06-42b3-a9a7-c7450c330e19", "comment": "Malware payload", "value": "4b41dc5c5b2b865c14d259702caea11f5eacee2bfe287a3fe24560a7455d2faa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444604, "uuid": "9a86fde2-eda1-42ab-970e-7a006d58a197", "comment": "Malware payload", "value": "ad6c8baa7f946bdce44120e2c958d4a4774e29b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444604, "uuid": "f34884fc-b6ce-48f1-8063-36c9dad28596", "comment": "Malware payload", "value": "ca4c92c91a219d67fc3fdc09a188bdacd394a6cb46bf41d3e9789c4ccbd5784f4b2cb9dd371d7ff4819c2d1333d9b6d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444604, "uuid": "a92c21d6-c869-493e-bdaf-6464bddd6754", "value": "T1135422CD840C1E92FAE3A074A6209474B27E4F4F97F626F590644A7F0EE2616782CFD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444604, "uuid": "b292e0dd-17ef-4af5-b9e4-fcf6a50783fd", "value": "6144:TJ3vfr6BT8ppgxscOeC/X/9lxXXGLrKJaU64SQbRgMqWd+IHOeIGNl:VL6BT8wGLbYLrixxSkgT8+MIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768444604, "uuid": "3ece86f7-4b4e-4124-ba1b-51fee8429ab7", "value": 289168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768444604, "uuid": "96ccaa68-6c27-4859-9a77-75ce987745b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444604, "uuid": "1962b03e-ab3c-477b-9dfe-5e75aeba7082", "value": "app2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5add4a6f-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435723, "uuid": "eec78139-da85-4a2c-be0b-ee3b42c5e849", "comment": "Malware payload (Mirai)", "value": "e9588b69fdccc1eaaf9fe6f9989a24c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435723, "uuid": "e9aac29b-337a-46af-a560-112537c519f7", "comment": "Malware payload (Mirai)", "value": "4ba50ad5182eb4407139c0acf6a15a2217b8461fb0f0fe7b49868ea768051ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435723, "uuid": "c6539276-5ef0-4506-97d7-71b6b405a234", "comment": "Malware payload (Mirai)", "value": "ee426aad7c26e68f3dc5b986c5937dc17e889146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435723, "uuid": "d8d5169b-7589-4bb8-ba3c-9a409e0ceed0", "comment": "Malware payload (Mirai)", "value": "7f8cc4a8d04c28e728a80e793bf425db77c3a5ae787c2b49c8c938e3d45e3a443dca56dfff8f5d76a6fb3feb7ed3b78d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435723, "uuid": "40cc6ef1-23d3-45c9-a828-99b0151e5af7", "value": "T1F593E651BC82562BC5E423BAF67E668D33A577E4C2DF722BC8214B14BB8550F0D63B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435723, "uuid": "d77821ef-391e-408b-bc52-4ad8c268ed8d", "value": "1536:Nnd+RS/fk8Tq/hCaNV+A4yOeCLiEslKwczHMWLLRvAHLBvt:Nd+RSk8TMVGVhw6LRvk1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435723, "uuid": "b8462b12-b61f-417d-afb7-1dac121b44b2", "value": 93756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435723, "uuid": "ff29cf35-c2aa-44f5-b3a7-cc4ebeee9abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435723, "uuid": "308a8719-ad9e-41aa-a15c-bfe325910d14", "value": "systemx64.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc9a39f-f1fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768473527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473527, "uuid": "bfe7e3ed-5f47-4a2c-8a6b-9eb6e1e405ae", "comment": "Malware payload (Mirai)", "value": "19a983731c6e40445600725f5afc8d82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473527, "uuid": "a7848e0e-c0a7-4070-8f49-8c104c914769", "comment": "Malware payload (Mirai)", "value": "4c786bdcde7c976da82b493567df97d39783689f560a0fe8945738b64ad2b3fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473527, "uuid": "b15724e2-ae1f-439c-a6dc-6ad26aefb182", "comment": "Malware payload (Mirai)", "value": "5fd497cbbe3b2afac2a5dbef97d5e77eb593906e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473527, "uuid": "a98b0da1-f455-49fd-a05f-86c5d75a9e88", "comment": "Malware payload (Mirai)", "value": "d0bcd2828f864d759aff4bf4ece70f8da56bfbb57eec878e9c4100f42463537afe291f4b4d3b724f98d607fbaaa4a536", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473527, "uuid": "eb5908e8-0b40-4d02-aeea-fd21726ee9bc", "value": "T10641158A1F329FE5F057D53847730B39376A651846D04289E1ACED405EC034D499E7E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473527, "uuid": "8c6c3d65-e008-4a52-8eda-ea44c0d6e538", "value": "48:G5E4GYg2H7c+1EXD/9LuEpgn3i/UUUiJDG:G56WHw+iMEpk3iXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768473527, "uuid": "7aebb041-036e-4ead-a0b4-98e61af772a0", "value": 2120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768473527, "uuid": "1b581bc5-3ec9-43e8-b123-a6abebdf481b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473527, "uuid": "eafa84ac-e064-4325-af95-f2758b27704f", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75b9954-f269-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768519711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768519711, "uuid": "88d69c2e-7393-44b1-968e-4584235351e9", "comment": "Malware payload (Mirai)", "value": "e43886824e9429b21fc6a5107970c430", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768519711, "uuid": "16bc0424-1a3d-4f49-8cdc-5ca4c981ea3f", "comment": "Malware payload (Mirai)", "value": "4d44169088b959257b3709cd0173405492daa384dfe0d71eb14b4934418b0aad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768519711, "uuid": "86ba213a-c18c-4cd6-b1ed-4265643b2be5", "comment": "Malware payload (Mirai)", "value": "3c2517a674136747e1218316efb01468b19b24ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768519711, "uuid": "751ef1bd-92c8-4815-bc17-5c1f984cb3ad", "comment": "Malware payload (Mirai)", "value": "9c99e460babc0eae5fc5ab5ffb10e526726d3636e08ea8e316dd4078ba07e5ad4a845016cac4ad390aa7a74f5b6a7b06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768519711, "uuid": "e74edf0e-78e0-49d6-a3d5-a63ec1257f4f", "value": "T1DF8312691E7474AFF807BBBCDADD9CCBB7056DF6506B42898E44D385E6EC26F2000542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768519711, "uuid": "23d63c3b-b89c-480a-83d7-b30023b41e70", "value": "1536:FNr7oW0c0Xw/g0vJoA5EIjcLUF8+KUhRxvTCjlevgYd8TC:fabKJoA3jcytKc1O06TC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768519711, "uuid": "0a036193-40ad-4dbc-9ad2-a3dd8d19039a", "value": 84996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768519711, "uuid": "66eda4ff-c6f2-4fa9-8e91-88fb0b6a6aa7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768519711, "uuid": "23dd7a99-504c-4350-9943-5391cad9c537", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7adecd-f24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768508174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508174, "uuid": "124b7234-8a40-45a9-bcd9-8118eba13b25", "comment": "Malware payload", "value": "a3c1000b7dc9b87c31185b14c178de3d", "object_relation": "md5", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508174, "uuid": "db93743f-022f-462d-8068-904ceac4f43e", "comment": "Malware payload", "value": "4e1456f5ad55c3eebd3315c37492b0e5406d9558d434f203dc1473fd83b3064b", "object_relation": "sha256", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508174, "uuid": "0a48595e-9657-4cfe-a180-74dcee87d542", "comment": "Malware payload", "value": "3035683d2e0449cb9a14bb992ccec48bf6adb4ef", "object_relation": "sha1", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508174, "uuid": "28503d2a-9726-4f99-ae07-44e512b79de6", "comment": "Malware payload", "value": "bbfe4f8ccfdf6246d80b18a83840be2d291e91bb57d5062b988cedd9d7318325a5c54e492171bd6c941b4541c93b8ce0", "object_relation": "sha3-384", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508174, "uuid": "6d4a9b8e-8b33-4252-9fe4-d5b8d554e98a", "value": "T179435CD68BA80441FAA9293052EECA477C7877830B6497E707A1E14D2C673C0E734B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508174, "uuid": "3b920a32-2b44-486a-975c-c48cb70759f3", "value": "384:nl5YAdkZ7OfsOMFwUxWITWXDBRJlJFR9z48in:SxFw8+1PlJX9z8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768508174, "uuid": "82646fa4-18d8-42b9-8bfd-f40e08b0ac7f", "value": 58776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768508174, "uuid": "070c9b89-96b9-4f36-9fc3-050b20e02a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508174, "uuid": "e6a8edaa-fa7d-4e2a-b50f-02feab4be89f", "value": "kdnet_uart16550.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a33232-f255-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1768510984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510984, "uuid": "7944cdf7-d68e-4e5b-aa23-9014c00d87d9", "comment": "Malware payload (CoinMiner)", "value": "46cd051ed06eff05f8a6cc18b5edd7b8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510984, "uuid": "7a94d06e-5103-41cf-aa63-9defc2ddbe10", "comment": "Malware payload (CoinMiner)", "value": "4f3cc3cf6db0d27aa7f0dbf80603b8f7723d49b00a646db90a27894db41a9324", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510984, "uuid": "a26ad97c-8d8b-400b-8ba2-5ccde156046b", "comment": "Malware payload (CoinMiner)", "value": "6df5929f6148b253c1e9bf3da85d232125584eca", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510984, "uuid": "6f243513-2584-4b73-88fc-61e509b5db1e", "comment": "Malware payload (CoinMiner)", "value": "7134843b03ce0a78efde5b2c820231d74ec68068036466da31269c02e3e7d5949b1e4d83de052335a2f61946819a1d55", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510984, "uuid": "35790ee0-8746-4a36-a80b-495092f714ef", "value": "T1E12633292FCA89B4DBA11B349DD18E169CE4F5B42F30D4CB5B986D5FB5AC0860B3D1C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510984, "uuid": "6cc4475f-4e01-437c-8673-03f0f5ac5840", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510984, "uuid": "6a2b5436-e247-461a-9cfd-58308e30da52", "value": "98304:jb5CElKOg2giNjwv6R6kemo6XPbQ8Yx2YkjV0qbjITif252y1c7u:jb8ElKOg2IS8gdhrQFVSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768510984, "uuid": "0ea03ecf-fa0c-4c11-b3a0-88132ba5771b", "value": 4831096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768510984, "uuid": "37c51aee-2adf-48df-b376-ed9f62f10730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510984, "uuid": "1bf21da5-3add-40fd-bc0c-6f94c53a310c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c223d9-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768466130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466130, "uuid": "58429f9f-51b7-4042-93b8-cd06cd39e61e", "comment": "Malware payload (Formbook)", "value": "01b290009be560f4e0b0e9bdfae20fcb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466130, "uuid": "819a27d9-9b23-4750-9fad-04c47167bbfa", "comment": "Malware payload (Formbook)", "value": "4f6f49d76b427ecd1df55d94a028a143e1f3795c938c0612ec546775395fb130", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466130, "uuid": "4f435d67-ac4e-42f9-9eae-8b45a344267e", "comment": "Malware payload (Formbook)", "value": "f17782e2e94795b082a0147197cbc0b0f6db2665", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466130, "uuid": "77eb0114-7e10-4a48-b5d5-d4c86fafc594", "comment": "Malware payload (Formbook)", "value": "26ac231b4a8d32b6ac3b3b21e51be3fed1e4962dfc145b1426a2f1e99e7dac66abf8ddbd3a1f7474a1cfcec769762459", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466130, "uuid": "05a9415f-69b1-475b-8e4a-7e5b74353a18", "value": "T1F7152348DCB4EE2D0D7C571460EF5E77EE224F59C4CCA2BA32D1BEA28B1DC5A0541D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466130, "uuid": "322c7ef1-6bc0-4c5f-960d-8e0bb3e3e7ad", "value": "24576:7YUavdDHHKf4x+nyiFOHb4g4pEmvrZPo5prLwX/bh4z:7Sl7wvO5YPGBLwXiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466130, "uuid": "4b374f9d-74c4-487d-9149-7bef7cc326f9", "value": 934681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466130, "uuid": "b11483c8-5de4-4bfe-a362-56c5fe257134", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466130, "uuid": "cfea4f44-96de-498b-ae98-e7ac2f6433d4", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c814cfd4-f255-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768511069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511069, "uuid": "6769d196-2da1-44fb-b96f-d27182f58c19", "comment": "Malware payload (Mirai)", "value": "3a8a3c3a493e65e4015115f92fd6b4aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511069, "uuid": "1ee488c6-61ed-407e-a45f-756e5c6564ac", "comment": "Malware payload (Mirai)", "value": "4f73d87531b5a14cb5791dc8b9c32a4b87e47c3f5bdf221c80844d4b8c749103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511069, "uuid": "b04292f8-2594-4efc-a127-33541903b299", "comment": "Malware payload (Mirai)", "value": "834549d0b47fdd7b702072038cfa4c694c96c744", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511069, "uuid": "c7a6c083-7e52-44f1-b545-6395210e3f2b", "comment": "Malware payload (Mirai)", "value": "20e9e9cd2398c529aa8d833b6c1e1b014ad89e62def3d17b3c06647eb35ac393b4671c4196b3bc1d5078d987ddfd5acd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511069, "uuid": "99105ceb-58b9-4a90-9302-0bbee4316822", "value": "T1CA431891BC819A23C5D4137AF56E56CD372033E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511069, "uuid": "993cf166-fbee-4e5a-bcf3-a41f08de9e28", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768511069, "uuid": "35d01f43-215f-4022-b5b9-116f5cb4d763", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768511069, "uuid": "2330280a-e63e-4e03-94a4-b49338830733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511069, "uuid": "9b68b90d-90dc-43aa-8680-a264d09aaa92", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13673f3-f255-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768511030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511030, "uuid": "92e11f41-1781-4849-a1c0-e8d4a1fa90d6", "comment": "Malware payload (Mirai)", "value": "9daa75d9e795a5175ad189eb2dc067c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511030, "uuid": "a4186e26-e494-4cb3-9ae0-14b08d656963", "comment": "Malware payload (Mirai)", "value": "520b3cc4cdacaf0eef7a847ca355dcd40c3c2271b72d39129143c6cd1a44c21c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511030, "uuid": "753c1303-e91f-4178-b102-7822aa2969c5", "comment": "Malware payload (Mirai)", "value": "b9d76609bb88446c5322b3395812030aa74d5257", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511030, "uuid": "5b203540-5545-45ab-b08a-93475d483e7d", "comment": "Malware payload (Mirai)", "value": "d12de3f0105ea47052f5a93ddd7c122bc233cf8c99b67682b460f7b6aa269d9ce25663e12b8aacb3acd1af00515c944c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511030, "uuid": "ee8d6799-7b74-4e24-a818-8f3f9bf5f259", "value": "T18AA2D025E3456EF4DFEF9C9452C2D2C276E547C72786C8E240FEAF012906442F789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511030, "uuid": "24ea2c89-77a8-4f8b-a6dc-767e90fe80bd", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5V7qM4uVcqgw05VxJq:9RxsSVsMD6xiJJE5zRWNrt4uVcqgw09g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768511030, "uuid": "fe97a059-5122-4fef-98d1-593dd966c575", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768511030, "uuid": "bd443ecf-8134-4332-b51d-0744af69c4e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511030, "uuid": "c2d5acfa-bffe-4e39-af9e-7ed1ae461669", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcd5a1c-f253-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768510085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510085, "uuid": "805636b0-15fc-491c-ba20-4552a2e3cf79", "comment": "Malware payload", "value": "88a7916db7d9b8fa202a03b1352a4959", "object_relation": "md5", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510085, "uuid": "8209fa7f-38a3-4a2c-869d-87ca71f90652", "comment": "Malware payload", "value": "537c7bf0dcc56757ddb97d709fa65c1b3cbf9619563df9a13fa8287b71d9e8b5", "object_relation": "sha256", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510085, "uuid": "39227459-d3c8-4e95-8861-507c9ee34401", "comment": "Malware payload", "value": "633631c232753493319141af21d104816d7f5de4", "object_relation": "sha1", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510085, "uuid": "63303435-5129-4e52-9a57-27bda3fee5a6", "comment": "Malware payload", "value": "b0f60d0c4e0d80bb4e95527e2d6b24fd3cf69a4b14f52c494a160b543e890845f43b2728e2372c61ccb856a9ce91894f", "object_relation": "sha3-384", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "UEFI", "colour": "#1B1CD6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510085, "uuid": "4ccc430c-e4c7-4502-b1be-cfdc026508da", "value": "T10CB37C9626A940EDDCAB9074C616550BFBB1F04E17204BEB1BA5C91A1F23FE0DD383D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510085, "uuid": "7313b12f-a129-4fcf-a499-4995aa4933ab", "value": "023641132c550e433ff30f58a8df5553", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510085, "uuid": "cc481b2d-5874-4af0-8876-fa608f79a688", "value": "1536:GDng6wpNRk09+d/i36GpK/EryGAO/+JN+AXFAC4J3gqLPTkv2Ep4zZ7k:GDUpH9G/i6qLryn0+3+AVACY3g67LX9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768510085, "uuid": "a7a1b282-e43a-443d-b4d2-3588f51c6e7e", "value": 108464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768510085, "uuid": "1427fbf0-2147-4fe5-bcdd-1a6604cb0de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510085, "uuid": "235930d8-65db-490f-ae02-4a2bf79b7d52", "value": "3ware.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18a35da-f231-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768495569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495569, "uuid": "ca3ed2c0-a868-4669-829d-30ce4099bfcb", "comment": "Malware payload", "value": "90ad6e43891a736f29a1c322acccc100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495569, "uuid": "f737a7e5-db7d-4b1a-a529-8058ef30d78e", "comment": "Malware payload", "value": "53b2f9da9e8ebc8eb6aacc169ad6441d4a3b1d9c74f219c20938f527a11c16ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495569, "uuid": "9a173e8c-9c1b-4c8e-b5e8-48e9471a8c8c", "comment": "Malware payload", "value": "1bca20921e9a8aca2a1a03292959edc5a50e3b1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495569, "uuid": "d85370b9-a1fe-458e-8a20-0917ce3128c6", "comment": "Malware payload", "value": "3f303e817e8f2e1b17c67092d64c41d21c2fe454272f411e32180a64b1114c6917c4e88f297afb2b5b6db777c5a72727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "raton", "colour": "#68B54F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495569, "uuid": "e20a0151-b201-47c9-b20a-a2012203d9d1", "value": "T13B434A0573BC3635F6BF4B7DE8B4A1114A79BA236D21DA4C4C8520CC197AB81AB11F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495569, "uuid": "e75fa6aa-4f92-42e7-bca9-3c96517fb55e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495569, "uuid": "84463d92-a20e-45fa-83f1-461adc783500", "value": "768:A7B4LRET/ihfJa/1FcJfYVTOeT/rdDKqfIbfshYw53Ac2gwbtGd0Hv8MU5lq:A7BkWT/ihf9yT8qAbfzkwbsCHv8HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495569, "uuid": "8c9ce8dd-5997-4b70-af47-a299e35342bd", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495569, "uuid": "b9731e5b-72df-4474-9000-d82fa72d0f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495569, "uuid": "db9f9aa5-dfd0-4044-88ef-27bd8a42d25d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c21b09b-f250-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768508660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508660, "uuid": "1e0577e1-f88d-4cd8-855e-35b3873a65c4", "comment": "Malware payload", "value": "6b4acb3bebfd2223e3146131cf479a7e", "object_relation": "md5", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508660, "uuid": "02f060a1-0ea1-4dad-a23a-70cc0ad862f8", "comment": "Malware payload", "value": "5420a20005e04b9f47ca93f90ff347dab98ba153dfd4e3490d17de906dadf879", "object_relation": "sha256", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508660, "uuid": "e3c30c87-c59c-44df-90b2-9c594d6c4848", "comment": "Malware payload", "value": "fcb5a69192bcf56017100a541a8e24f90136feb2", "object_relation": "sha1", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508660, "uuid": "8a88e2b3-52db-4cfd-9701-4995490e0240", "comment": "Malware payload", "value": "788e3e2d9cd9c1b5c44ec796877ee3b8dd39e86aa6d70cd9e890d08d13a73693d35bf8bdda4d285d48cc99a0b6a6d185", "object_relation": "sha3-384", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508660, "uuid": "3776bb7f-8fa6-40e7-84ef-9ed31a99439e", "value": "T1F184236B0A04D66FDBBAC1FDF453512363B10B0E9876EAE9768A02033C57394C79479E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508660, "uuid": "1716fec0-c602-4898-b19f-0519177d5de5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508660, "uuid": "da6bebc3-2bcf-4a38-baef-6bd8fee8598b", "value": "6144:EhkH9yoNqYAW2C0W/coRO8oDh7EjOIUT+GIgf3+LtggXSvcbWq0Ef7:4kANYaU/VTj4yGH3+hjivgWkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768508660, "uuid": "92c794a1-b011-43f8-863c-ce1b4280f72b", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768508660, "uuid": "7efb5b00-a271-44f3-b5ab-150eecf0fa1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508660, "uuid": "2687c9d2-aa69-4282-81d9-6effecb5f29e", "value": "file2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34926fe-f1f9-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1768471520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768471520, "uuid": "8e5c20f1-5656-4110-af84-051845a4346f", "comment": "Malware payload (PureLogsStealer)", "value": "60637fc5c912dfd517b8cf0ffc76e720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768471520, "uuid": "3ab8402a-2bd0-40c4-abb8-85bcf487d2b1", "comment": "Malware payload (PureLogsStealer)", "value": "55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768471520, "uuid": "161819d0-eed4-49f1-af87-be8cc96e5b6f", "comment": "Malware payload (PureLogsStealer)", "value": "3d0b11817ab58f6f85f4183b789bf76b9e751fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768471520, "uuid": "9f514cc7-4460-4c0c-a91e-0aef8a01823a", "comment": "Malware payload (PureLogsStealer)", "value": "2637e259471cd55d35f5cdeab3478713c8d0158a9970cb0942df3182a571ee92ed735dc7aad0827bd6b23206e452fcb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768471520, "uuid": "1667f464-f649-4c54-8071-11f0d465064e", "value": "T11A35126EB6A1AA66D7CC1FBBC4032200C2F38462E631FA2B4DD56DD55F26385C10ED67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768471520, "uuid": "07267497-9d60-4829-850a-f576449b8ba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768471520, "uuid": "eef271f2-0447-4541-a555-b401faaebd04", "value": "24576:8AIGK2or+6CJAOCCZNwrPNBEkoxi0sMLrWZzHf5cosGsF:8AtporbCJ/ZNGBETiULrW9Hfe9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768471520, "uuid": "c4720ecc-f86e-447c-875b-2b442a32c58f", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768471520, "uuid": "9592670f-65d0-404a-9a55-b72269ae4f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768471520, "uuid": "236d8442-d23e-40ef-b1f5-5ec967c573ee", "value": "USD 671,210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4168c1e1-f1f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768467893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467893, "uuid": "9afceca1-7ab9-47fd-85fd-b295ea866a57", "comment": "Malware payload (Formbook)", "value": "a6e14cc39fb340448201aa581bb18318", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467893, "uuid": "d00f2a23-921c-4c0c-b336-27aea5f9f44a", "comment": "Malware payload (Formbook)", "value": "571728e210ae139dc4fa0f18c737d161db62b197e8c5e28e28543b2bc074a549", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467893, "uuid": "a086c1a1-51d1-412b-bd8b-f5751a6fe5e6", "comment": "Malware payload (Formbook)", "value": "7b70cb4295efad09200dfc0ad0c9ed68e03f6837", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467893, "uuid": "805cc9ed-e20c-4b59-8a30-67f310fde535", "comment": "Malware payload (Formbook)", "value": "cdfbc90163f1a3c30ce60630a9a2caa6d1131ab1291bb7bd034aa30ecbb7980e46f0e57a570aa1031061375cdc1c42f2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467893, "uuid": "2d5db4a8-caa1-4dbe-8647-7bc2b2a85116", "value": "T18D6523C62C597B6B8F348B3D219B1F8BB9D24991544020DA33AED8E31F3B641893FD65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467893, "uuid": "01415300-3201-49ff-9168-0242d2a604bf", "value": "24576:XuDCnXxhtfujnyZBjOHOB14PCnFxzObvR27aQ6TGNHeWYPg6MOT4:1wuxkP2k0uBTGcvPT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768467893, "uuid": "d8889004-cae8-4cca-9fc4-5df0ee99c596", "value": 1418867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768467893, "uuid": "fb35aceb-0c41-48b1-8830-e93980361b5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467893, "uuid": "8bf1cbcc-c026-4df7-8299-ff83d6b6b1c3", "value": "ENCRYPTED.ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96d397d-f216-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768484013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768484013, "uuid": "96a4dc4b-ce36-4314-a762-a46f3115dfc5", "comment": "Malware payload (AsyncRAT)", "value": "f1735fd22d83c95efa7e24f007e8ab7f", "object_relation": "md5", "Tag": [ { "name": "anti-debug", "colour": "#334878", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "long-sleep", "colour": "#2D3CA7", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768484013, "uuid": "d9c69e4e-efcd-407b-a57a-55cf6c3f4519", "comment": "Malware payload (AsyncRAT)", "value": "574482778792874721df6f4461490efbc7bbc6dfb833184f20e77ecd61e68270", "object_relation": "sha256", "Tag": [ { "name": "anti-debug", "colour": "#334878", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "long-sleep", "colour": "#2D3CA7", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768484013, "uuid": "55ed7f79-cc45-44a1-bffa-e8c8d71f2ce5", "comment": "Malware payload (AsyncRAT)", "value": "28b1cbf7672670edadd78ee8ac856c92d2d39aab", "object_relation": "sha1", "Tag": [ { "name": "anti-debug", "colour": "#334878", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "long-sleep", "colour": "#2D3CA7", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768484013, "uuid": "4c747a97-2852-4984-9827-9e6e03e21b5d", "comment": "Malware payload (AsyncRAT)", "value": "8df45d39765e201af7a6e9ce5dab1881f7a42d73d4d3b98a9a6bd703ebf5947886176a5468f6d2acb76de1c20697e78e", "object_relation": "sha3-384", "Tag": [ { "name": "anti-debug", "colour": "#334878", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "long-sleep", "colour": "#2D3CA7", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "net-malware", "colour": "#DC3F29", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768484013, "uuid": "9e5160bf-5d44-4501-b995-0c4cca8bab80", "value": "T1B4535B012798C926E2AD4AB4BDF2550106B5E9772102DB5FBCC400DF6B9EFC64A123FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768484013, "uuid": "9026c6d8-8ebd-411c-b716-7720826c3bc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768484013, "uuid": "633ce1b9-b642-47e1-8703-8d1603f9b71b", "value": "768:10R08mQ6oiPCHXi59JYmRSI9xOymXnQrpR1+dSCv7mqb2nTpeH1o4H6v0d7cT/HE:1Ex6XXD98QrTDGbbueuc7cAGYWVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768484013, "uuid": "fefa0ce4-0287-4d10-a320-13c61ba67228", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768484013, "uuid": "3c7b6e76-ed07-476c-af25-f8ecbca3fcb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768484013, "uuid": "49a44bfb-c535-4e7d-8ca3-72e8a2da1906", "value": "QAGAStrategicImperium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e932161-f1f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768469553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469553, "uuid": "32080a41-2fa6-4fa5-b383-b92dcbe86290", "comment": "Malware payload (Gafgyt)", "value": "b3de83e332d181151359a9eb52de217b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469553, "uuid": "ee6d95ca-8be7-405a-a7d5-83d137d426f2", "comment": "Malware payload (Gafgyt)", "value": "57dc35c08c2222919b90f00d4114b204139ea2a43f20fd0e19e2296b11be52ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469553, "uuid": "46209b5b-9384-46f2-b0a7-c21e2ad1b081", "comment": "Malware payload (Gafgyt)", "value": "e274f52583d490487354dc75c318e18fab94a2c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469553, "uuid": "056d9ddf-76cf-49d3-87c3-be8ddedf94f6", "comment": "Malware payload (Gafgyt)", "value": "49bd46cb1f196c79dd1d8625223711b1bca72a66ae533cae57362eb8544747d997348336efed319b0acb5d3152b9a542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469553, "uuid": "aaee1206-e14c-4f8e-a2f3-2a403b5eda13", "value": "T19BC30240FDE284F4E04781B7209BEB8BDB31DF490129C9C3EB497A55ACE9797514E638", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469553, "uuid": "21aefa89-a264-4f02-9726-9b59c094521f", "value": "3072:qa3z5a9yc6DOAD17NhIgz4j3qazSA1jdmpH:qqm10OADXabrzF1jUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469553, "uuid": "325a897e-0393-4904-9b28-d4eff57d4c21", "value": 126678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469553, "uuid": "72686aa8-687f-49c5-8650-4eab288b32ae", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469553, "uuid": "78060425-90f9-48f9-8d5b-051a6ba10577", "value": "7vjkteq40g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b6fc4f-f21c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768486317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486317, "uuid": "184d3527-e71d-4924-a1e3-3f43fd415a27", "comment": "Malware payload (Mirai)", "value": "a8e7c829f0ddfcc3c3f46dab825cf6fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486317, "uuid": "44e75fd1-6fe1-4b79-9462-48e22a924faf", "comment": "Malware payload (Mirai)", "value": "58109094959493854d66f291360bad89c0a1e404e0f73f6aa4bc588815e1117a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486317, "uuid": "ea9c36a4-8852-4cb6-a909-f8e56f06c5ae", "comment": "Malware payload (Mirai)", "value": "900242d904708ba6cb3b4f8dfdd584d00605572a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486317, "uuid": "95850b04-4eed-4d5b-affd-aaaf8c6c339a", "comment": "Malware payload (Mirai)", "value": "e6ea48647baedf6910ae9954bce836a697042260844d8ab2c2225b47dda049bf23e9394e6d8579e628ce77102a83fa8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486317, "uuid": "494d7fee-64a5-48e1-be09-25bf641a4e55", "value": "T13E147C16F64080FFE89AC37852EEB632D9B1782D1235768D67C4EF263C59E21363D681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486317, "uuid": "7777e17d-8023-4d5a-bb3d-5e410e6520f0", "value": "3072:5P+5h1SGETDOvRyerUUJp1U/WdKo1sZAud3a0zG0eRV:5P2DE+s+UUJp1U+LH05Yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768486317, "uuid": "96f436a7-e234-407a-a902-bd794fc84bc9", "value": 194352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768486317, "uuid": "4df647ac-6a8c-4f04-8202-33cd37300ab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486317, "uuid": "30a9d3a8-e011-4b34-a273-e204f2dfec4f", "value": "nigga", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4713de7-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768500728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500728, "uuid": "cc99f2bf-c5eb-4b8a-b3ab-0f736ec4a902", "comment": "Malware payload", "value": "0077b5336a4c6fafc2e2f8a47848217b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500728, "uuid": "5381970a-1806-4e38-986d-2cc26e20a9f9", "comment": "Malware payload", "value": "5a4be7cb16147df1b37015d912183431e3fc98c0d7b52d736849d1fea93f5ac5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500728, "uuid": "7340968b-16e3-4a95-a2b8-4f6784a04ccd", "comment": "Malware payload", "value": "39120f124b74d8b654d88aba088b95d197667d63", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500728, "uuid": "c0ccc11c-ca98-47aa-a4b0-a3afa906a4c2", "comment": "Malware payload", "value": "9db72fe312f215988b81e39aaa92d417d5011424b1940d864c8ae9727966a0252e2815f797181fadbcddcc6716f2b5f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500728, "uuid": "491b050b-50e9-4175-ab48-700e32bdecde", "value": "T1D9B523D1BBD99CB9F2A62871061927576E7EF9F167D48BCFB68C081205302D0A2F4B4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500728, "uuid": "4708c191-6480-4e53-84b4-dacc48e06943", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500728, "uuid": "0e1754c4-ae02-4ad1-9165-5efbb111ff84", "value": "49152:9gwRO3x6tuHsBCcXU1+LC7Do+Js1ridF8V7YayYRk44PN:9gwRO4ycHYppiBidWV7YabYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500728, "uuid": "31e0118e-2f51-43c7-9638-18ffeb4ac311", "value": 2342190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500728, "uuid": "5108da7e-69c4-4ca0-b844-f2f5a1cae123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500728, "uuid": "fd7b3025-0196-4512-8602-cd19ee74ca13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b2bb4b-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1768463422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463422, "uuid": "4ae5cd86-5106-4e2e-bbbf-10143a3ed0dc", "comment": "Malware payload (PureLogsStealer)", "value": "296e4c85b1684adbbccd5c7c870d8592", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463422, "uuid": "c2201a71-4702-4f17-8461-85087a22e6d7", "comment": "Malware payload (PureLogsStealer)", "value": "5b41b9ffcf68f066f1fccd088bdcc30753984cface4f3a1fb09ce3e3d68838aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463422, "uuid": "8bc68256-33ad-48e1-b23c-9097a50000cb", "comment": "Malware payload (PureLogsStealer)", "value": "9964798733ff74955bac9b2fbfcc13d2818dae20", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463422, "uuid": "a7bbbbcb-db3d-481f-9d38-3bda7dc8153a", "comment": "Malware payload (PureLogsStealer)", "value": "92548116dce7b64eec789f1fff25a2a9803622de9314dd62df520741bd20d4d2236618b0a04d9a344a210617106adc32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463422, "uuid": "d98b0104-0d97-424b-b760-f2381a0158f6", "value": "T1DA26E8B1B6AD68485F74F7818FE7C4F0A0488E6F9DAB81A9751091DC87563B0CCBEC54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463422, "uuid": "e2c691fa-3b94-4e3f-b06f-3de19d90d22b", "value": "96:Ek57A30DrpT2GVUiB3mw587rew+DMdLeZ8WwZ:fOdLeW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463422, "uuid": "5204b34b-7508-49c2-8cd4-71d1ee5cead0", "value": 4697945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463422, "uuid": "31a1327b-31a8-4f9b-bc6b-803992a21249", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463422, "uuid": "f8096383-33b0-4f74-9222-77dcb38945e8", "value": "Cotizaci\u00f3n QSM9002237EA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a83859-f202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768475440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475440, "uuid": "74f00689-6497-4f39-b0fa-cfcbecfb9e78", "comment": "Malware payload (Mirai)", "value": "3b56184e20ec38d3a52d77738d078e89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475440, "uuid": "dcc80ee4-4ea7-4a89-b5be-a35a23849503", "comment": "Malware payload (Mirai)", "value": "5d25dc191ac20f5b6710d0ce69289f443919a6bf91297f133a412cb238d25f25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475440, "uuid": "e3a28373-41ba-4e24-98f1-1fcb560215eb", "comment": "Malware payload (Mirai)", "value": "e9140ea6b7e921a9758284687b869bb65f63ed6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475440, "uuid": "0cc072be-da76-4b84-b610-74d151c1e20a", "comment": "Malware payload (Mirai)", "value": "09c9c833d4c61350c31e0b57595db26491a455b3ae44173add37ba64424eafae2278c86d730b664e89da0fa74af64afb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475440, "uuid": "e7aff079-a8de-4354-a5a8-19cda0cf918b", "value": "T1513329CABC01AD7DF94BE7BE44170A09B620B34451930B276377BDA76C331A85E16E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475440, "uuid": "62632829-fe8e-4d8c-a5d9-49634bb5c656", "value": "1536:PW56h2ppZ8V2oH+HkWhzxIWIY5hISyyrL8ZD:+UViTyZwyq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768475440, "uuid": "78df1741-fb8d-42ff-abd5-08108205f3d9", "value": 54108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768475440, "uuid": "427f326d-c899-41a7-9620-0519616ad632", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475440, "uuid": "3c660de0-8f1f-40e4-bdd5-1e9c61b999ba", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dd8133-f1d4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768455665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768455665, "uuid": "db5f0ccc-165a-48f4-bcf5-3b5422deafd3", "comment": "Malware payload", "value": "d80a126f41758e1b0a60799eb790c213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "SuspiciousPE", "colour": "#52132D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768455665, "uuid": "10202c3d-7807-4f04-b56e-217b8ee85e28", "comment": "Malware payload", "value": "5d4b9e922576f0203376d98508239b2266b7b43cf591699c181f15797adffad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "SuspiciousPE", "colour": "#52132D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768455665, "uuid": "c9db209b-9735-4979-b8e5-233d45077f82", "comment": "Malware payload", "value": "ea23b2ad7fc58a6c2de3f19f0d12c333525b9a7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "SuspiciousPE", "colour": "#52132D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768455665, "uuid": "8576c417-3b00-4d3b-8abb-4a007618d857", "comment": "Malware payload", "value": "f2695ec31927e545ce7ebe835ce08ed3cee9ec8608f669f32055fb2360501f27f2610fcd9d32e4c8bfb9d5b90cf3a928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false }, { "name": "SuspiciousPE", "colour": "#52132D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768455665, "uuid": "00ec392f-2bab-4c47-8e57-7332330fabba", "value": "T139F42302B7E988B3C2F7DB366C3F1637BB7BE71912B8A90743052E652D1A461C61C752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768455665, "uuid": "8eaba345-1621-4c1b-b2fd-9a119a1338f7", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768455665, "uuid": "db96fbb6-f0a1-454e-826a-7ed6abdbfb55", "value": "12288:BnPdwpjZzmr5q+TZ1VQNhDhGSiYSfr2V0BlZaiTOTHwThj9srcngbIwCisf/eh:9Pdwfz05/11VcASiFaVMlZ9ObwhjarWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768455665, "uuid": "e0b6cf85-f370-44a1-be67-8eb2e6b8c350", "value": 723930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768455665, "uuid": "c0c3e442-cacb-4324-a905-7b8b623c49df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768455665, "uuid": "6c3ccdad-77c1-4fa0-b8e4-5c7e618eabb5", "value": "w.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d35d39e-f26a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768519775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768519775, "uuid": "7b67a558-8e1e-41ea-b02e-ad780a942ed9", "comment": "Malware payload (Mirai)", "value": "7135b6bff69193fb56862a886902a353", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768519775, "uuid": "bb6404c7-11cb-4f6d-b2a4-9d001cb14846", "comment": "Malware payload (Mirai)", "value": "5d660556f6cb085de03199c3958f01692d40205350c1cfb0b12c9a8c3fa07da1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768519775, "uuid": "9bc11ee4-e49b-42d0-9fc0-0363df4bcb5e", "comment": "Malware payload (Mirai)", "value": "f7b1278ce2e5e412654e21e9739789aa2b0d649d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768519775, "uuid": "1b602782-4577-4245-ad8a-76b862ea7509", "comment": "Malware payload (Mirai)", "value": "1eb918a8fad85965c576b1b7f8e520b3e3c0a9b150a4c111af5ade1322c31e200689603e5276373724608c1a51a0b594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768519775, "uuid": "66e268f2-71b9-4bcc-a85b-31944aeb0ce3", "value": "T12F143926EE90C0AAC457D17867EBC1B2F730F8F40321765F33A96A312E79E505B19786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768519775, "uuid": "0f48a0c8-86bb-4062-99ae-f7b8e5411bb0", "value": "3072:xMri3Ub11aMlhuQmyn/HISwzDBgzgSBJW4obquBmD4mi07bJ:2rP1a6bASwRyRW4obXL07bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768519775, "uuid": "4bbff7b2-7fdb-40dd-b0a6-1887e2aa8da4", "value": 196328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768519775, "uuid": "879264c0-4e63-4c87-b9f4-ca0c7f3dd03d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768519775, "uuid": "efe0b0e7-fb9d-46dc-86e8-b7fdba17fba3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d3f540-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768463443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463443, "uuid": "26f56094-b164-4f65-9140-b03de836f38e", "comment": "Malware payload", "value": "e8c5566d143fc4426d6aa9edbc6d4072", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463443, "uuid": "6b43a2c2-312d-409c-9f92-b1d0a73746a7", "comment": "Malware payload", "value": "5dd666d3161f324219aa85bbb9a4e9086a4918a3fcc4492e11354f4011c89340", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463443, "uuid": "d0bc01e5-3bec-402c-a697-4332cd5fbd4e", "comment": "Malware payload", "value": "c13a4894344c36646fdfd16b4ed85b295ff3126b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463443, "uuid": "cc24922f-105e-4336-a430-09477bf7c95d", "comment": "Malware payload", "value": "cf2e743a62ee0a76d0c69a9d3eaa2f5bfca566a7e8a9cb2e07973f43bf8c1061bd171979bec3bcc8e5e36633c716a4cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463443, "uuid": "21a47c42-89d0-4584-98e7-c7b77c3cc419", "value": "T11A26185643482160D9B84D5ACFE120E8D6C0596B6D6B4C0FB2C16BDADF34DF16B32CAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463443, "uuid": "f0153bd1-4ab4-4b8f-931f-c1405a3f1cae", "value": "192:o7z2T8V/KA4ofr9qXZHRJsLVvGZJfjhnIqTUCK:GqFXsLZKJL3UCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463443, "uuid": "2ec092e9-97f4-4360-9f3c-8711ec6b95c3", "value": 4754463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463443, "uuid": "712051af-bdfd-464e-a734-e12dda29e60d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463443, "uuid": "dd724281-1b00-4753-ab02-7c6149420d02", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b935929-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435725, "uuid": "0bce6534-4aaf-4c98-ab8f-d691ed43a8d7", "comment": "Malware payload (Mirai)", "value": "50ece8d237ef080bf3fd1597c8b6d8ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435725, "uuid": "cc067be5-40e4-49f5-8eb0-ee77ced68bf6", "comment": "Malware payload (Mirai)", "value": "5e0d8b0fb08ed7a09db2058f7c1442f54fa7528c8c5339cd2d9a88a96ad8ff36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435725, "uuid": "c2620783-c18f-4b8d-a2a5-cbbc14f291de", "comment": "Malware payload (Mirai)", "value": "56301e81c78ad125b88bc62d3f48c27f40f0a2d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435725, "uuid": "0b53bb0f-c0f7-4729-9605-6ddab5240a96", "comment": "Malware payload (Mirai)", "value": "54dafe28ab16f961f529fe5377f44eb97f8752fed868e2edaf29599934f56e0750f247b3424913928b71f2136c3d688f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435725, "uuid": "77b31766-facc-4cd7-b0f4-f9497217e57a", "value": "T194D33951B9825A27C5D123BBFA6E028D332963E8D2DF71178C215F2177C691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435725, "uuid": "08ad0743-f7c4-4d9d-aa6c-5c540adc2836", "value": "1536:9ZrC6uZMkwCc5xFKqJ2AjHSUIOQYacwV84V77X1LpZVoGQN6ZTrwhiA9yqd9Ck/Y:frCukwCoqUI8677X1toNN6dwhphnbtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435725, "uuid": "b587e30c-f149-4fc2-9e7c-888819a94a3f", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435725, "uuid": "37a768d7-d17a-4efc-bc84-5e4d15f52310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435725, "uuid": "347fb100-214e-4e62-8b49-002abb1feadb", "value": "systemx64.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4fdea5-f1ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768444344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444344, "uuid": "458d1e14-8f38-4488-9983-547e6ac32594", "comment": "Malware payload (Mirai)", "value": "9e2ad991cf6f97622a87f3d85f9c1376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444344, "uuid": "6822f96b-c63a-49b4-a7c9-e57988410da7", "comment": "Malware payload (Mirai)", "value": "5e611c0ad2bb70becdf4a772162a14356ee476e3e0bebabd21cd00860bf4e4cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444344, "uuid": "9fafbfa9-982f-4b49-bd1c-9f99628a22bb", "comment": "Malware payload (Mirai)", "value": "2849be3cc649716b6e49b390c039df41459d68be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444344, "uuid": "c4264554-cb24-4c64-a072-71d6c8d4cf53", "comment": "Malware payload (Mirai)", "value": "7ed3d7e81f145b37387cf920bc1441094021bd0028843f1ba36daa188526c353ed2a608da49706642bd9e4ede07d4dba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444344, "uuid": "3d11c8fe-3cd8-480b-baaf-80ed6ff189ce", "value": "T19DC31955BD819B15D5C626BAFA4E728D331337BCE3EE7212DE145B2423CA91B0F7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444344, "uuid": "c111daec-b140-4528-8bfd-685b8f95b878", "value": "3072:oj73Z/4VJvUtpbJKpqM0x2tx/6SARaJudBuGsSI5ZNDp2vI:ovJ/Q8tVJKpB0x2txC5RaJudBuGvIJD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768444344, "uuid": "9521770c-6631-489e-af5f-f102a0c53b3f", "value": 127652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768444344, "uuid": "d9446486-c782-4956-9a77-79a1c2f0ce08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444344, "uuid": "181db619-0444-4b45-a436-26623e95cfb2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c25e0d-f26b-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1768520561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768520561, "uuid": "9bada221-e86f-4e01-b054-2a32616c0fee", "comment": "Malware payload (RustyStealer)", "value": "e9a621764d5bddaf74f1fcc762c277a0", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768520561, "uuid": "e3020dae-54e6-4719-83dc-e36bd1cafe4c", "comment": "Malware payload (RustyStealer)", "value": "5ec3c7917a2937cf8db46b4546e77db9853bdbc7cdaf805480a54b336faa54ee", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768520561, "uuid": "82cdd6c0-e194-4217-a83f-e9be325de28e", "comment": "Malware payload (RustyStealer)", "value": "f4609d8c9a637a1ff060945145899938aa65704d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768520561, "uuid": "255a7391-a4c9-4eea-84f2-366e0720b9e5", "comment": "Malware payload (RustyStealer)", "value": "ab2d605a8d2e87f2c2f8b4dcd948d3408dc9d42678e81ff2f8cd3fea9944b79325a8fbd02c175648d08ef6567fe74445", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768520561, "uuid": "4c12e912-e983-44b7-939c-aa38e69f32a6", "value": "T1C4F51A53E29581D9C4ADC479C36A9B23BB62BCCD8634B2EB5FE44B212F15F506B0D306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768520561, "uuid": "f4253b18-5bfb-4113-be0d-bda58db7f18b", "value": "f3b3705ca6777531ef6050f7df4fcde8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768520561, "uuid": "093036b5-b713-4a5d-8476-419eb701b2e8", "value": "49152:aVBxioKGzczbYFy5yv8o23xwjH0UN0SVhENM9:3HYFNznd0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768520561, "uuid": "c1822b0b-64a0-4154-8699-c375c6ad8a6d", "value": 3372544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768520561, "uuid": "e53019c8-262a-4685-9da7-a8f8bb54b116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768520561, "uuid": "bef45a07-939b-4b7d-bc7a-65018377eb9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa89499c-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1768463345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463345, "uuid": "029c61d9-c9ab-4ddb-a63e-f64beb063bb3", "comment": "Malware payload (DonutLoader)", "value": "52f176f28a7c748967a9e28f5fc69859", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463345, "uuid": "929c94ab-12d0-4f0b-86c3-84fa213d5b88", "comment": "Malware payload (DonutLoader)", "value": "5fecd66820b4aba8d551ee623d60eef3161c555799af61f9552626246807eaed", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463345, "uuid": "d4061175-5eb8-4170-a93b-e678eeab3606", "comment": "Malware payload (DonutLoader)", "value": "a5eb179bcff9c0e4a905d614c154cc52b7874a71", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463345, "uuid": "e5c88284-4dfc-45b6-9ec6-fe6e34d3b763", "comment": "Malware payload (DonutLoader)", "value": "045db31737cdc0606bc810d8e4560ed371d8af42655579c33479f3a13f3dc1f25946670647c3860c00488c0d4108907b", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463345, "uuid": "2f01914d-754d-42d3-8e9a-d0fe2f5feac6", "value": "T1095619732697B8A23A776D1E12B09A100C6739233D4FCA0CF5D5323A15FAE14D5B6CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463345, "uuid": "a087c53b-954e-4ebf-a6d4-53adfb5f01c5", "value": "24576:dB+azCUGx1KN5JGeI4huVjCiDvpmeRia/gRpj9kEc4H1s2p2zkmWh2zkebUj+gXv:ef9F/oLC2Mi9uqexFVJG82v6vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463345, "uuid": "a8569d79-0fb7-45cf-8d82-5291247a0370", "value": 6391523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463345, "uuid": "7717f7c4-36b2-4511-8c57-c57887d8d885", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463345, "uuid": "790588e9-8ed1-492a-b346-efe755a9050e", "value": "Quote Order - No. RFQ_3866-10528.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a0ca1c-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768463463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463463, "uuid": "2e585b34-2511-4d01-b1fe-9245180fb6e3", "comment": "Malware payload", "value": "3c86a421b6f08ce6fbf5ce86177077e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463463, "uuid": "fcb432e4-2ebd-4c83-a3d1-dbf10090a56b", "comment": "Malware payload", "value": "61eeefdc2978f29228bb31d1f2531593389c7c810abc3d43a380ba523f2d3fb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463463, "uuid": "6e40b141-7005-49cb-a3d5-c90af55fd21d", "comment": "Malware payload", "value": "b99a5bdc3989ccc1e5f81de8c56db70fd6538011", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463463, "uuid": "ae8158e5-c1a1-4017-908b-f77b120d5f15", "comment": "Malware payload", "value": "259387b902a813badd20d13c9ced98bb93e67d3ad78995450faf150e49529d2720023b466e55747a6f875057629ea902", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463463, "uuid": "15fcef29-e6bc-4246-ac25-3346c20e01e3", "value": "T12316E8B24B3D6AB4A7FE821DFC0716B1FA67481F98D1707AF50951E6FB00B1798106B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463463, "uuid": "0daf1364-b541-41ca-a191-f01679a5a555", "value": "3072:ZZPuQfjyLLkS/GLL6LLLwaCdj8um4NhGPmetTK/ihLDI99mpI6uoqCG/VMFCDlhA:0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463463, "uuid": "9ce9f1db-7cc8-43a1-830d-0c9e35642184", "value": 4233153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463463, "uuid": "7fd0dc58-9e56-493c-acf7-5337d355153e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463463, "uuid": "5e30d090-402c-4392-b6ac-f71801d32a71", "value": "First Ord INQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6730ab0-f1e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768461674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461674, "uuid": "9f2109fa-5f84-4bd9-9cef-04fc38b4d150", "comment": "Malware payload", "value": "54106fdfec36a5ec75bef8c676177f81", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461674, "uuid": "7e0fc6f4-3f64-4b39-8b5b-2f8ecc0fc27c", "comment": "Malware payload", "value": "63195392facf0a69644f70464cb3ac26ffab9a8db2102dda33f46cb6abd5ea73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461674, "uuid": "e3e7cee1-5208-43db-a93a-3f24bf1dc253", "comment": "Malware payload", "value": "f0de77e7ef16efca60618da4a22dcb60811976ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461674, "uuid": "227f7160-7f12-4f99-81f4-a74388657d8e", "comment": "Malware payload", "value": "eb66c897452bcb46d544c34c2049d1c16b010a28539548e9dfb2f51a41ca484bb973bdec70b2ffbf9a567a549c5114ec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461674, "uuid": "369c91d8-67e2-4c1e-bd2d-8cac1c2ab459", "value": "T17FB5B664DAD19E5D590C380244D5F4486C0ECFAD6089AEBDAB0AB5DBF6CB40CD9CA3D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461674, "uuid": "4f330227-3c50-4b53-9d16-e448f52614ad", "value": "192:vVQFc+J/3blSfUERpmIOBXUvIJ5C4hGGXfSZgZJG/HRmPvWxzdJdPPYSUMGf:vVsgpkBXW8JYW+ndPPf6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461674, "uuid": "9396fd78-1d75-45d9-aef4-20ec1820649a", "value": 2430393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461674, "uuid": "35b12f2c-12ae-4a11-b9f0-43a6ea97ee0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461674, "uuid": "45948504-4980-4ee7-bfcd-6589a41e44d7", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfb594d-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768463805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463805, "uuid": "b7214290-24dd-4785-9598-70ec7133645f", "comment": "Malware payload (RemcosRAT)", "value": "17f39e5f4098d28df3b4a139ac6bdf82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463805, "uuid": "1e4a267d-de9e-4c84-ba97-214658771998", "comment": "Malware payload (RemcosRAT)", "value": "63d5674ba2e1f3ac11569c1fb85c987348bcb2c7467354bdd8d848707c648115", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463805, "uuid": "05871541-21b8-4d23-a871-38ea1a284ec4", "comment": "Malware payload (RemcosRAT)", "value": "c226f4fb74d1b6b632cbf1ba95151b4e3e0b1c37", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463805, "uuid": "8da13390-5bae-41c1-9a13-a179a4ff021d", "comment": "Malware payload (RemcosRAT)", "value": "a11b19de2f80b8f13f9a41ec8a4219a90737963d07d85864244105dbe80b688d91373065eddd0a338d8fc96458634562", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463805, "uuid": "ff97eb0a-81fb-45bc-b9d7-b88f28a7f252", "value": "T1D546936D64D11043D441FEFD2E2DBB904C0A2D6756C208DA753BBA9BB0BDCD4EA60D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463805, "uuid": "427a25d1-e511-4930-b960-b28ee182b6b6", "value": "49152:QL1OyDP8iSoN7FZICsO8JVMwI7O1g5CetcFF7R2qm2K5BoMHb/OpFP8ba1S1:Qp5DP8iSoNJZ9wB+qCN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463805, "uuid": "95801140-dd71-42db-b8fb-3b7778a63f83", "value": 5828814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463805, "uuid": "feca17bd-6ed1-40c6-9a59-62c04e543d19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463805, "uuid": "585d8136-0a7f-479f-b25f-2c0a9989a217", "value": "Techcombank_B\u1ea3n sao thanh to\u00e1n.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e82300-f23a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768499141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499141, "uuid": "c6760688-8052-4180-a02e-480e22905600", "comment": "Malware payload", "value": "23e2169d751379f69e1e438113d6a9cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499141, "uuid": "708ba6c5-a82a-47a8-8f17-b5e8bb02b3a2", "comment": "Malware payload", "value": "648a2523aa0392033a003d9d9d8e13c67124447b99aedfb319f6644cb59b9d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499141, "uuid": "cd1f4a24-fd81-4d10-9d75-8e7dfce03237", "comment": "Malware payload", "value": "a70791b434c747809c9e2d84da368f8d7486b6ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499141, "uuid": "ab5895d5-dd78-46c4-8d3d-a92fdb20f2a6", "comment": "Malware payload", "value": "7a5780efc5a94708751b284ab49d70b5c2c998e914f33b3eda3065b76f33cb452b5f270bfd94af10c6090a8e6c55e5ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499141, "uuid": "bb8d096e-0a5f-403a-9a97-262939dd4688", "value": "T1181412ADDC915BB6ED425B7F3243E5CC4151BC2796CD89A223487E293F704C8BB01667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499141, "uuid": "fb6c7ed2-fafc-4baf-890d-99640697af4d", "value": "7f25dcbea91ea13add2ab7113a4d6742", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499141, "uuid": "ca416810-cc01-4fa1-a40d-734ccf6a9564", "value": "6144:fiwvkNAjYnkxrtUzDG6uIZUFNm30ynOMt6:ftIArtUzVdUFNmEyOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768499141, "uuid": "d36310d9-ff84-483e-aef6-f60d3964e17c", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768499141, "uuid": "95eea414-39df-476b-93ac-a0d2758de73e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499141, "uuid": "3a6d57e0-254d-4ecc-b838-4de399332285", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1fe69a-f1f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768469661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469661, "uuid": "bf20f76c-46a3-4aef-8937-898c1f8b3faf", "comment": "Malware payload (Gafgyt)", "value": "32abb352ef5428947660fe2ca1094f8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469661, "uuid": "0c0596f6-740b-42f1-b1c6-9fcff9674bbe", "comment": "Malware payload (Gafgyt)", "value": "6504c8fe6ec436b2121db84fe1b18177593319ef39ca30cb0155bfecaed72733", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469661, "uuid": "dd286a18-6f7f-42a2-82a6-00b09358560f", "comment": "Malware payload (Gafgyt)", "value": "6841693658cf133f4af6bd815ba56488f9ef2930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469661, "uuid": "cf9a18a2-7a2e-4950-89a1-9073978d29f4", "comment": "Malware payload (Gafgyt)", "value": "41e275b3bff51f4c9f389f265dcadc3b901d36666b2f4cfd3b18cbf050a7d82770128adb0d14a44265c210a612c64aa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469661, "uuid": "ae55a3e9-628f-43b5-aca5-8d1f4a18bb66", "value": "T1C2C3028BFED195F3F0C39673444797A757708F220910C9A7E348BBB0EE81B61A456AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469661, "uuid": "06660d4f-ca41-4d7d-9d2c-2123878d77d3", "value": "3072:qa3z5a9yc6DjuUHX13YkOCdtcys65NlsQrOvSfAUldDWznyKJ:qqm105X133htcAxsQaafpKzyKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469661, "uuid": "bf6eb1b4-1f74-4d43-b842-658d3d226985", "value": 126678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469661, "uuid": "e146d661-4aa7-4309-a802-c51c157ffdc0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469661, "uuid": "82a12df4-58ee-4d6b-bd08-bc148ee7e064", "value": "h9s78k5pry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b53d37-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768500468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500468, "uuid": "d5c84772-0006-4052-8f90-a8dc81a46ea8", "comment": "Malware payload", "value": "9ed4921c204f0eef0f255778b34f4675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500468, "uuid": "cd07c0f5-521d-46a0-9d4c-8556ce77d171", "comment": "Malware payload", "value": "65146c7cb01492b8c4437711bde00cb9de7229e4e589aecb3c8c36037aff117a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500468, "uuid": "13562ee1-a455-4fb1-b66f-3f6f66d5bee5", "comment": "Malware payload", "value": "6100a792c8a8cf5f07647485e2b94a0bba411c5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500468, "uuid": "b4fba73e-2f27-40d1-aadb-0c315435c79f", "comment": "Malware payload", "value": "90750e6e6a5d9b8db977061814029427aed0104b67a4a74e4e6e3c9b5689c28b6ed3e9abf0803bd8132c7346716e87a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500468, "uuid": "b5c30ec9-3940-4393-b300-b4e6ea97cf38", "value": "T1BFE17217E2E2CD32D8D4177E45930A1A223DC8659E83DF132E0C896D2E537DCBA72B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500468, "uuid": "36ef633a-bd74-4987-abb1-a32d44fd524f", "value": "96:f6u6TiUBOUw3PJheuhiq5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcb/JhAkZz/cl+M2x/fLbpziQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500468, "uuid": "a93b35ce-3fa5-458c-96e9-b7483d740c54", "value": 6968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500468, "uuid": "326b06a0-6a60-4420-af98-6d142942f628", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500468, "uuid": "83438aac-57e5-40d5-ac02-b1df607638f2", "value": "linux_i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13c3ca8-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768463437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463437, "uuid": "b7f30fe6-2612-4bd5-b665-2628eb27ff7b", "comment": "Malware payload", "value": "cfa4327c970fea711137332eb07f61bc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463437, "uuid": "4186481c-2c98-42a3-9c9f-7873843225a3", "comment": "Malware payload", "value": "663a95534c741ca89c5e686902fdede000574ea8f18601d9e290773728bf7f69", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463437, "uuid": "81cdf537-0b67-4fb2-a21a-4a3235271fc8", "comment": "Malware payload", "value": "ab92e17307004c1b7a1c2b840da2f0cc9ab4a17f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463437, "uuid": "68355be9-244d-4d33-b13b-13b458ce91c2", "comment": "Malware payload", "value": "c2c4379f800911d593a5706804ef18a5d40c9fff22b85d7b05e0bb1f47f086b1584b8a11c13f4a359e92263da9102fca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463437, "uuid": "687393be-5c19-400a-bf23-f5a3e8362f8d", "value": "T1F54629E96F8070706B238F9E79729E80E41B251B54E5CB2D780F9864772580FD7B2AF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463437, "uuid": "3cda32af-f35f-466a-82a8-81514875e519", "value": "98304:8+iWzM2rN+HQGWspI1LPUyye3IEzx0RCG6zQ/QJ2ECAFNCb4Wqeh8pkv1GlhGn:8+DrNoQGWspI1zUyyeYoxnQ/QJrFNKmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463437, "uuid": "df71b39e-2d82-4069-95f5-16a150df7615", "value": 5414801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463437, "uuid": "7d905a4f-c8f4-423d-a675-3f9f0c3f6981", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463437, "uuid": "dd944c2a-2daa-4898-b947-190a49175e5e", "value": "PETROSTAX-INQUIRY-RFQ-4305-073-2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cde8c6-f232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495710, "uuid": "4b6c4994-a284-4f53-8348-775d70bbaa47", "comment": "Malware payload (Mirai)", "value": "e2c84a4c4d35cc64df148797442fe20c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495710, "uuid": "84776bd1-aad4-4233-9b53-12636855079d", "comment": "Malware payload (Mirai)", "value": "664cd78d438af62048a0a127f98bfcca55b264df109035fba90f1f325fcb9cd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495710, "uuid": "5570ac3e-13e7-4fef-9d6c-7f3871fb881f", "comment": "Malware payload (Mirai)", "value": "70e03e57288c5ddda2ed176a3c3149203ab82e6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495710, "uuid": "a27218f3-3c3a-4a3c-a707-a2338230bb70", "comment": "Malware payload (Mirai)", "value": "bf8ed5ecad475c3e77768694f905c1b52405084029a041db7fb78cdb3dc0e3e5a5624da76356c90ccfe40027a40cbd5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495710, "uuid": "79a0673e-8f68-4a41-80c7-81758610f6b0", "value": "T15004B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495710, "uuid": "4414f587-2ccd-45c1-99e1-9276dc49eb3b", "value": "3072:nKpzGmeNkSfcQqmav8SqaRVlnYzK5DVt:nKYmeNYQqmeqavlgK5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495710, "uuid": "8d75c9b8-af11-4d95-9e3b-7792a8ca0de9", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495710, "uuid": "d1f95224-e688-4daa-a780-9b57bae89273", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495710, "uuid": "906d86a4-ccbd-4b65-ac51-bff9eff1b049", "value": "djmario.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b711aafe-f1e9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768464654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464654, "uuid": "e46e53a7-94f8-4b89-bf28-1a62b957817b", "comment": "Malware payload", "value": "339e957b4de8f335fd2ba9223af54d82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464654, "uuid": "f82e53bf-9fc9-451c-9e84-c63f236461fd", "comment": "Malware payload", "value": "67219e9776b9a374c618e948f220f1871647189364487254d5cea968023b6fc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464654, "uuid": "78b1aff0-3d30-4293-9cd1-3e63866817a7", "comment": "Malware payload", "value": "e6709a11d9bdb7fbc0dde65d124702ec0b9d1475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464654, "uuid": "14a570b8-aec4-4f20-8dea-ff5e47a3255e", "comment": "Malware payload", "value": "b78e79f1b609a22790a231dd47f0e61d03af2be7492ffed31627ba7ae4188ef629329f3006a2166d2d3be811446f73bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768464654, "uuid": "44eb489a-b9ef-4575-96d7-84995f1c8ea7", "value": "T14194D002F7113A97E10A8136548147042684AEB573E1E302FF97B2B9756F5F9CF287AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768464654, "uuid": "3a231930-6c0f-48e5-a0f2-22382b0d0d42", "value": "12288:NM4i28GxDnkyTXA3L8ntECDuaCjFT1C8sSypybfzCwC:C6DkYX8L8CQyDmwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768464654, "uuid": "fa2b218a-11c5-4c0d-a036-717d17fef5a3", "value": 448784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768464654, "uuid": "4b34214d-20b9-4109-93a8-0ca98b36e5a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768464654, "uuid": "e90a16a6-dea1-4cd1-96e3-977cb9576dd6", "value": "rondo.armeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082e72ac-f232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495714, "uuid": "7f9b2e0b-0ce1-42c1-8df8-fb83660201c6", "comment": "Malware payload (Mirai)", "value": "62bd6ad98057e751ee04638c9b5db005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495714, "uuid": "a2c3a34a-a1f0-46b9-a25a-042cd542eebe", "comment": "Malware payload (Mirai)", "value": "698472487992cb604b774270b9c71b46e59653da63e04d3d97a3d849f63b47d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495714, "uuid": "2174f356-702f-43a8-9d22-9b242fda948c", "comment": "Malware payload (Mirai)", "value": "b513b3a2b3aefa64687d814c00ec5dd4d2546631", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495714, "uuid": "985b7b99-4b10-4935-b0fb-18b1bcdf03d3", "comment": "Malware payload (Mirai)", "value": "cce0a7fa749d1945bdc652c7ef9a24da682cec113186ce70fac0350fc1f90ad60121f54ef754fd0f1b5a6e4466ac1d1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495714, "uuid": "6579fa19-94fb-47b6-ae71-b3f0e768fc7a", "value": "T1FAE30B46F8814B12D5D111BAFE1E128E37131BB8E2DF72029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495714, "uuid": "22daf6fa-4e8d-48c9-abf4-119351e0d9ad", "value": "3072:THea4CbXUDAopAX0zTzzgaj/YKdW1EAo/LL:DePCbXQTAXeTz0acJEAo/LL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495714, "uuid": "d2661d82-3dc6-496d-8bbf-d4ef43e55f9e", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495714, "uuid": "d853e5fa-08b0-480c-ad7c-98333d5b6f44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495714, "uuid": "e855d772-b128-4ed0-ae53-a20bcfd05dbc", "value": "djmario.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa2471a-f200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474646, "uuid": "f9d45b1a-7603-4fde-89f6-c95d290b16ef", "comment": "Malware payload (Mirai)", "value": "d6b83328f12e37f40f6ffc3edb1b6480", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474646, "uuid": "47b3e303-3be6-4a41-a5be-399a19a60e53", "comment": "Malware payload (Mirai)", "value": "69d09e0d092aea2d8eabfca1cfc31cf228142b86dba9ecf3c9c6f91653e1a6f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474646, "uuid": "e32cc4e4-80ce-4440-8a8d-5babf3de42b8", "comment": "Malware payload (Mirai)", "value": "87f173cdb49baa736cefd70fd68d63f6e05f02db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474646, "uuid": "7c4e8915-cc1b-4cb2-9a22-f537f30b2b0b", "comment": "Malware payload (Mirai)", "value": "bbe82d5bb24e31317d9737898f116d4489277512ec6ff36859b7385e4aa89f05c014c6779e6bc9d53c6152f7c609310a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474646, "uuid": "8221acdf-8a54-41ee-b987-1d920050fe6b", "value": "T16B41C5C4177248312B56EF7736A5441074C2E0A1ECE06EA460FDB8BF415FE885B41EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474646, "uuid": "f35c83d3-f637-4f32-a335-79a02b4f94a7", "value": "24:vUQFsX4BWwzuJFKWAssmAYLwEAdksoAkkxuTTFEIhOBPS:viIWRFKVsslYLmdJXkmuTTfw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474646, "uuid": "3b2c31f8-a972-4429-b360-0d0cfdd622aa", "value": 1920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474646, "uuid": "0d545809-3836-4b5a-a7fd-5fa7897875b1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474646, "uuid": "1382dc6e-1c70-4b6c-a685-41ed1e1b41bf", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ac697d-f1ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768466055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466055, "uuid": "ebd8ef7d-3f6d-4136-9b7d-662490cfd8d0", "comment": "Malware payload", "value": "5c2e3df3cc09aeabe4ec480e6acf8f74", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466055, "uuid": "f498d648-2368-4c42-b655-7cee18155e17", "comment": "Malware payload", "value": "69f53644f954eccc8376ba769a59df7c43c5d98a2f1ba85f58a7d62369b5264a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466055, "uuid": "e250b3ef-d0d2-443b-9689-a9dfe67deb91", "comment": "Malware payload", "value": "8ce51688d0c2f2aaaa5e4a7517930a265f552db4", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466055, "uuid": "59fb07ef-3662-4ad6-afe6-990d99154368", "comment": "Malware payload", "value": "f5f3ad3861ad971bd554c596f920ca314b244237530fa9559103dbfef01fa46b373bd531d64a2a7f066ca49f000115f2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466055, "uuid": "0548b7cd-d3b0-4a51-8779-c95dbbcb1a2d", "value": "T1281633141E6CBD780B6C822D317F9F0DABA1ABD0984DD0D2F1EC69D61B67F42895382D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466055, "uuid": "bf591beb-2c47-4fcb-b5eb-cabe9938168e", "value": "49152:a2aUtqMoIwMkVFZCArZguwW+AqBPgM/K74H3JyjEk2a8CBGNtEbj:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466055, "uuid": "3ca2f3ba-1adc-4445-aaa6-42c9144744ea", "value": 4044231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466055, "uuid": "a5b06832-93ac-4066-aad2-f7ef7083853b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466055, "uuid": "7be8608d-d8da-413b-b56e-ae8846b6dbdd", "value": "newww.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a666454e-f207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768477511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477511, "uuid": "a536363b-8377-4a79-9ad9-8baaa06386bc", "comment": "Malware payload", "value": "5e8383721392b37d4c7967eec6ea7aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477511, "uuid": "1572e3b2-fa7d-44d4-81e9-0e68a6bed773", "comment": "Malware payload", "value": "69f720f1caae81d5897244ffbed547e9cb11643a26966c7880973b61df5436a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477511, "uuid": "0e9a518b-99a9-4640-81b3-24cdde4ac87f", "comment": "Malware payload", "value": "aea07f2ae27a06136bf75921bce3736488c60d62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477511, "uuid": "72c61674-b993-4222-b092-06da8b27420f", "comment": "Malware payload", "value": "8738fdf138414af20cb762aeaf1372075374d3408d823217304955756f66882a62e57bf4638387a61b94263be5ccefdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477511, "uuid": "34407c01-819d-477a-a2f5-2ee1bcb2fd17", "value": "T1E2E3FFC6024A537FD7339F70D85420B29A989C42F7973C72C8AAFE3594FEA3518D950A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477511, "uuid": "238da455-cd4e-4fcc-b904-6ed6cfda4fbf", "value": "4cf952d22eebb3be8496a62f36dbc34d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477511, "uuid": "dffb665d-7316-4edc-a1a0-f3db62f074f2", "value": "3072:07G3mXwwwwwwwwrwwwwwwwwwwwwR1wwwwwwwwwwwwwwwwwwwwZwwwwwwwwwwwwwW:0GWwwwwwwwwrwwwwwwwwwwwwXwwwwwwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768477511, "uuid": "0aa0d11e-4087-4f5c-81ae-6aaff3816ead", "value": 150568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768477511, "uuid": "2117ef2a-6316-40ea-bce3-870a6cd94e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477511, "uuid": "f1784aab-9477-4130-84d9-67692661ce7a", "value": "Weixin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff94363-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768466092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466092, "uuid": "26db345a-7471-41e3-b9fd-01fd6c9ed84b", "comment": "Malware payload (Formbook)", "value": "d43df7e839cc4c72dfd887ab416f07a4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466092, "uuid": "2dfbe29b-106d-480b-b9d3-28c09a109b11", "comment": "Malware payload (Formbook)", "value": "6a341d2ac8e12920f79ed4a9b7a509bca52d2eeba0e29d801a37afac4687333e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466092, "uuid": "840fe575-aead-4ad2-8861-532fc93c0525", "comment": "Malware payload (Formbook)", "value": "f47cde02c555b5ef030809a393c12fe40a553fa8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466092, "uuid": "c6420b5d-a113-43d3-9e74-8594f1f31d3e", "comment": "Malware payload (Formbook)", "value": "b58378487abb051bf37cc89467fff5ffd6a571cf7953566c34f4743fb6eb1cdcb7705f2add619ecf56534fcb06a5704c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466092, "uuid": "34666ad1-b879-4070-9a29-f9de828470cd", "value": "T1375523126F13BAFD4A2CC37568EF6F9457511A24C484CBCB7EE890D62B6DB028663C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466092, "uuid": "8574a750-b475-405c-aede-dbd186389ec3", "value": "24576:zB3fcWdZ6q6FHZDPW86bO5bL1x0G+p+UMRy0N7MILzYyQJKcJfQaTsDtj:lPdmHl04R9GKcZwDtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466092, "uuid": "47bfaa1a-369c-4ddf-89b9-2a04850112b5", "value": 1376005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466092, "uuid": "7d4d8273-6b56-48a6-929d-63af601dd7f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466092, "uuid": "1d8908e9-2c00-4f52-8153-76cefa11897a", "value": "CU.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21007631-f20d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768479865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479865, "uuid": "7b86af1e-2490-4e7c-92f9-833c5c8d0f15", "comment": "Malware payload", "value": "99850ac1ebd7e6fdc11c6efb4099339f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479865, "uuid": "75666c0b-217e-4e3a-8637-fae07b317f1d", "comment": "Malware payload", "value": "6c116d55f26c089c191174f90a1024bc785b742487a219ff036e1eca0639ccfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479865, "uuid": "37353efb-1e0f-4527-94e1-89362b28ba66", "comment": "Malware payload", "value": "d932488e29e112316f581daf39c06c12c9d4b5f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479865, "uuid": "cbafbc53-a93b-4508-ab86-568ade61bf4c", "comment": "Malware payload", "value": "52d2b658d4408ed5ee37f806378f8c54ed283f5b0e7a59c8ec3f53819483cb3bd2977466e4cd8b0c88869903799668da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479865, "uuid": "e6e87281-70a9-4a03-bfcd-a733b27537f5", "value": "T13AA5AE29A3E402B8D8BBD770CA525233DBB079D55334A54F0698C6592F73E919B3F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479865, "uuid": "b3ce2bb7-b3a1-43c2-806f-af1cb18e16ff", "value": "091edfe3147290054b3545fa059aa32b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479865, "uuid": "a8445c34-18eb-4f2f-aa2d-d0fa8f972153", "value": "49152:9JBf/Rengeohzqw4htw3lhd7up1i3RLm/Ev1CKdvW:RD44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768479865, "uuid": "8516a502-b012-4a59-8e38-ebfbd630b652", "value": 2077184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768479865, "uuid": "e5fe57ed-e317-4431-a849-38dc53f9cef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479865, "uuid": "cbff2f10-7805-4567-bfab-2d1700b3eba6", "value": "tcl86_core.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03252849-f201-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474661, "uuid": "355d42eb-968c-4dbc-a026-0ee23ccf9c58", "comment": "Malware payload (Mirai)", "value": "c546c51ade6983ee87beb339f147fa37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474661, "uuid": "615ec3a0-1a7e-42cc-8480-7f61cfb02c1d", "comment": "Malware payload (Mirai)", "value": "6d965b9b75e0deaec31c99aea2873eb02e3d3b22ff646b507e9b32863b4ebe9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474661, "uuid": "ad3edc35-c929-41d6-98c9-e1800a812c46", "comment": "Malware payload (Mirai)", "value": "ca17c25931e279dcac6106766e0efbcee919efd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474661, "uuid": "dab0eff4-a0d1-437a-a4ed-94c5c07ff0c3", "comment": "Malware payload (Mirai)", "value": "50130a7e22c77358954998cb5b0bf622e791edbce70ae02301232f994ee0075c5b2082449aff05e748ae4fe4925434e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474661, "uuid": "7ad9b474-aae6-4bad-8070-63d39546ac26", "value": "T173734B4331284A47D5934AB4253F57E083FFE99034E4BA89684FEB5A8639E771086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474661, "uuid": "fe83a90d-3d9a-4767-80d8-0a09aedb94d9", "value": "1536:tvPFs4/Cbhj118cuFf9tMjS9FEmL5jiTpIG1uf5:8xaFfJcSkpIG1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474661, "uuid": "15a8066f-e63e-4058-9ec7-98d7b38b41df", "value": 77048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474661, "uuid": "77f30e71-0b12-415a-b417-b0d1f9922a3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474661, "uuid": "6074c1b5-df51-4bfa-9d46-1311c562a814", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba06b25-f1e3-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768461844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461844, "uuid": "6400541f-4379-40ac-b0ef-837e477ab9f0", "comment": "Malware payload (AgentTesla)", "value": "f79f2c18784a2c504c48c4bdaf61a921", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461844, "uuid": "db8f44f2-6ac1-4ec4-8225-57497d24c16a", "comment": "Malware payload (AgentTesla)", "value": "6f17d8dc0458bbbd4e56a23c639fdc1555670d39a47368bce0f3effbb00f2e8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461844, "uuid": "c3249d03-512c-4535-9c67-a7b629e844f1", "comment": "Malware payload (AgentTesla)", "value": "1c9575d67cdba0465face33974c431ddbc6f36d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461844, "uuid": "977fd157-5656-4cbb-9fdb-3f660239e815", "comment": "Malware payload (AgentTesla)", "value": "4d08b10d4ded6d7c9ab081ffac810c9b10107f90578de5feb5bfb6e07a54fc67a2ec03b67dd8b88c7483ac15cbdeca3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461844, "uuid": "ee5a0db2-794a-4930-a71d-acd67bd556d7", "value": "T12A35BE0273D1C062FFAB92334B56F6115BBC7A260123A62F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461844, "uuid": "25425f35-ef5a-499b-8e1b-f3e0abe95bd2", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461844, "uuid": "c043678f-af37-486a-9b16-d85eabd6ae3c", "value": "24576:A5EmXFtKaL4/oFe5T9yyXYfP1ijXdao6i7ep5pi1/:APVt/LZeJbInQRao2pLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461844, "uuid": "69321b95-ca7c-4e63-b10a-d9415f58c741", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461844, "uuid": "b19068c4-e7cd-4ee9-a4b9-9ea3f6f418c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461844, "uuid": "311b4b72-ea13-4924-a9ed-8dd5a6eb5a62", "value": "Notificaci\u00f3n de transacci\u00f3n BBVA n.\u00ba 700339 Pedido del cliente n..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bfd6df-f20b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768479368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479368, "uuid": "11a7e20d-e844-4776-87da-a53c014cf7ef", "comment": "Malware payload (Mirai)", "value": "b2813f453349253af9449adb54820784", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479368, "uuid": "cddb61fd-6a41-432f-8862-523d4ceb4889", "comment": "Malware payload (Mirai)", "value": "6fa41de70eaaa3eff965b89fdefaf547a224103ee6102455b9f9770c03f7fd9c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479368, "uuid": "07ca2c47-1264-4561-bc8c-b5e90252db23", "comment": "Malware payload (Mirai)", "value": "b40ebe4704de6c132e0d2a45ccd4fa4289a7d2b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479368, "uuid": "5a151393-b2f0-4d11-b610-48effff08d02", "comment": "Malware payload (Mirai)", "value": "2f29e9be9f27dac6542f235b9143833ae802a27de8a4f38cc639819fb55bc7e88b9f40c7a51c30849493eb2242372a2d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479368, "uuid": "6edc6dde-ab9b-4717-bdb3-a428909bf2a8", "value": "T11951B4C583A82C706C636B13E7F6C16830C596D318EAAF95DAD8BAF8825ED343D41753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479368, "uuid": "ae0bafd2-2521-40f8-9abb-ac2e1107c999", "value": "48:iQ7f7N7hQ66GQgCzPQqKWQcoUQ7c7o7UQf93bQv9RQ4cgQjpVQCSOQG+CQNfTQ1Y:iQ7f7N7hQ66GQgCzPQqKWQcoUQ7c7o7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768479368, "uuid": "715116fc-c910-479e-9ffa-919dc703b777", "value": 3007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768479368, "uuid": "87325726-aac2-4561-b56d-0d3cba3f209b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479368, "uuid": "c19228d3-c455-484b-b62f-7df943febbca", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074ff06c-f232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495713, "uuid": "6e02f5ac-bbd3-46e4-845a-1de52bc6edcd", "comment": "Malware payload (Mirai)", "value": "c9e75bb39ce3212272f02cdbdbd211cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495713, "uuid": "b3b7d4ab-f452-4e89-a786-1525210696db", "comment": "Malware payload (Mirai)", "value": "702dc79f56fcf920a798195707d7750726241fe54e10188de6dfb20202941568", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495713, "uuid": "1443e9b6-031d-49cc-a066-23c97d2a289f", "comment": "Malware payload (Mirai)", "value": "3b8db539b0cba5ac2b6b940e44d8213d45ffaaa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495713, "uuid": "db0c08bd-c268-45d4-8132-bec94f96e1db", "comment": "Malware payload (Mirai)", "value": "e451436ca6cfae75722ba2e1583462fbb5cdf9334d3989dc6b7608af0491b97812db1b625e809e4e2fe29859450faa3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495713, "uuid": "2297a258-7574-4b94-86b4-7580a965e9ae", "value": "T11DD30845F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495713, "uuid": "6cf1282a-a119-4f2b-8a7f-e936b60442b2", "value": "1536:YKdzElm18uZJNb4AlFa8eAZHk4VB7fzTTDj97g4ivbGeqZvF20lqiwyw6RNPATqe:YKp506U8e947Lzj97ziytxF5KdKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495713, "uuid": "88af13fa-176d-447b-b5a9-2c3589044184", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495713, "uuid": "84488091-d4bc-4615-80d7-1d71c6f3b5c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495713, "uuid": "c0d60b47-88d1-44d7-8c88-e9b530607ece", "value": "djmario.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4776a4-f1cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768451621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451621, "uuid": "42e5e3e6-79f1-4872-8ddc-8f40dbbcc727", "comment": "Malware payload (Mirai)", "value": "3b4835ba687cbddaf54c98cf741d36e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451621, "uuid": "7e92a040-1b3b-428d-bf1c-2ea86aaf2394", "comment": "Malware payload (Mirai)", "value": "7178c414b8909ab7903880a02b34fd604928ddeb95a69869aafa1e8f828088f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451621, "uuid": "82bbefef-6245-422e-98c4-958cc9016a25", "comment": "Malware payload (Mirai)", "value": "eaed12ebcdb42ef910f22fd2acddc1d96f7d8a11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451621, "uuid": "7c3c24b0-ea7a-45a3-8205-6b9c0dc64d3d", "comment": "Malware payload (Mirai)", "value": "9b15a4a7411bb164041e5cb2fc56f406a1973b7902c4757e42357876874cea2170f82a314376cf995a4673eb415a9869", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451621, "uuid": "71112f8a-c662-428e-ad56-61d0fe6d85c2", "value": "T10831F000F31D4813E5D23DF433772B505B66DE131A2849049B9EFACDD9B8C60595C49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451621, "uuid": "45c41e03-f8b5-44dd-87e9-644f22e57836", "value": "24:3CzaAxpWS9nSWZ6S4/KSwISBd6oTKP5tAFlhICqzktqKcvy5EaaTo0YOmCsgFmFy:l/gZVbXGAlIXz2qKcvy5Eld/UUUia+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768451621, "uuid": "39888c9f-e3ca-4a42-aca2-b4dd73c06521", "value": 1524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768451621, "uuid": "bf878227-b3a8-4aea-9ace-3f33237bb0c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451621, "uuid": "b62fc240-c4de-4654-915d-1adcefbac053", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebba97c-f1e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768461473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461473, "uuid": "bbae0237-60c4-42d4-842c-5a9173b563f6", "comment": "Malware payload", "value": "f8fa3075cbab2c6b8f4b07d6e2a1800c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Purchase Order 4500036946", "colour": "#562A04", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461473, "uuid": "6ebde53f-6651-48fd-be56-33a1fde10aac", "comment": "Malware payload", "value": "71ab434b6a238f283cfaafaca25f5a91184cec44c0cbc8cde7ed17ec05d47a71", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Purchase Order 4500036946", "colour": "#562A04", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461473, "uuid": "4d697157-4ef2-4c10-896b-9cba493af780", "comment": "Malware payload", "value": "415619a48ca127b7da9700786808567495b0fe5f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Purchase Order 4500036946", "colour": "#562A04", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461473, "uuid": "fa7bbca7-8816-495b-b5da-e786ec841114", "comment": "Malware payload", "value": "824f823342f7d782ec2c0bd06d3073cfc5c7a99e2f2b4977d1b203341675817b0457738412acdbee519a75d89a91bb22", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Purchase Order 4500036946", "colour": "#562A04", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461473, "uuid": "c6f87b33-dc57-48c8-aecd-a9049a2bb516", "value": "T1D5F502C0D8532870AB3C5811CB5FE62D201F74B316266E29AE5972E8BA5C4F7CD652FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461473, "uuid": "1012ee10-2af6-432e-b7ff-1689517187de", "value": "49152:dkxHsxPSS2GPZEQEopK+hgUx0BAnyw7rmemiIEigtj01gWEeQf9MMF9fhxW+JRb2:dkZuCAigB8FQVMAfhxW+JRzNq/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461473, "uuid": "f9f1b4a3-2642-4cc7-8ee0-60532f2ab134", "value": 3366669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461473, "uuid": "9e5516ed-320c-4d5a-9eb6-553754b42f5f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461473, "uuid": "3ac036b4-7e45-4f19-940c-e5b443e8991f", "value": "Purchase Order 4500036946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b00544c-f1cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768451535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451535, "uuid": "5926a43a-ea24-481c-a912-953ca6929178", "comment": "Malware payload (Mirai)", "value": "42547fa39173b1305baed727998f8ca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451535, "uuid": "51e517a6-4d1a-42a9-8e84-5257a1a58128", "comment": "Malware payload (Mirai)", "value": "724d3bc953ebe1ccf8ee7f880eb52491db3dd37c471da1435c99108b1f36448c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451535, "uuid": "8fd90023-7c43-4aa8-9b12-4cfd752d5584", "comment": "Malware payload (Mirai)", "value": "d1990d63b1ef7c4403e219201140254f47a9cbb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451535, "uuid": "ede47354-68d1-4b96-a2a6-8e031d6fad38", "comment": "Malware payload (Mirai)", "value": "53dde4efda76ff3635edf6b72647d6bd93a01c920a2ff3104050a7f75581b12479990a89a9d17dbcdc792e0472fa1b39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451535, "uuid": "a23cd7b9-6bdf-40e9-ae9e-a79447f44c11", "value": "T1A021EE3BFBBB8F07C492A0B90FA353543620EC6804259269BB61BE4DCC116917E952F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451535, "uuid": "ebbb7218-c23a-4da9-8faa-afc65d89bc92", "value": "24:3eGvDq3N0yTK+59k7z8MAQOlhCrjSkvFSJ9lpCuFmFmFmF8NoXawqvV:JWVT3Wz8M5Dv+9KuUUUiNzNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768451535, "uuid": "b28dd705-a46f-4a0d-bb41-4cd13bf82b91", "value": 1392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768451535, "uuid": "4b35ba40-3004-4011-8635-fbea901a5183", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451535, "uuid": "4c7d2b3c-f82d-428c-a468-205166445ee6", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5e6201-f1f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768469660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469660, "uuid": "f8b16c2e-790f-4e4f-aae1-0b2fd06c0876", "comment": "Malware payload (Mirai)", "value": "4b20a8a7bee9e098b9781968728d337b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469660, "uuid": "efbce7fa-e252-49a0-ae7d-c839bb131799", "comment": "Malware payload (Mirai)", "value": "72b8d8ea223326fe2b5f9fc9ef4f4bf692e8c9183f4fbaf683f9dbc9c4be2739", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469660, "uuid": "4ef76cda-b565-40a8-8bd7-6ac5ed16f2dc", "comment": "Malware payload (Mirai)", "value": "20baa171dd6cd5e657efc167b9e3102630f19b15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469660, "uuid": "485939c0-2c44-461d-8e3f-33e75711ef11", "comment": "Malware payload (Mirai)", "value": "09020b20c872fc4fef79980a7c3dc0ed0234df813516117208d6f52568f5a53d3d646bc3dfbb10cb23411da63c7205b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469660, "uuid": "8f984f72-5535-4458-80c6-fa96e512655e", "value": "T169D3E1A8F940DE33C9D11ABEEA8D12487357576CD2EA3302DE144F2177A796A4E36842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469660, "uuid": "6c1d7460-8ab9-46b0-bfdf-56133db788ed", "value": "3072:foTTImvmBwUd5SCxH6OcqrUKVzjV+gnp2bA373Vloa130fu/:fgIwWwswCxHzcYUKVHlnp2UTVlxEfu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469660, "uuid": "5580b0a8-4248-44b0-836e-bac40a61100c", "value": 141878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469660, "uuid": "c815521c-a872-4fc9-a28f-d82f80ddd55a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469660, "uuid": "510f90c5-47cc-4b63-ba66-79cfaed0e4d6", "value": "vw2g22to0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0686890c-f20a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478532, "uuid": "6ed05012-cecf-4f45-aada-13795cc7e651", "comment": "Malware payload (Mirai)", "value": "deda02003df76faf2409ac8952ec9359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478532, "uuid": "2d2fc510-2fab-4ceb-8e6e-021bb298f74f", "comment": "Malware payload (Mirai)", "value": "73197226668bca8a923206f93e5799189fe6207ed6951dba41bd12a744597300", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478532, "uuid": "cf82e872-29c5-4a19-a072-dba17abbb78f", "comment": "Malware payload (Mirai)", "value": "9417393bbb83e6d89a99626c5871753bbc017e7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478532, "uuid": "8e4ebe15-bfb8-4e4b-a1f8-754ec1ae4820", "comment": "Malware payload (Mirai)", "value": "c042d94f52cd4df050c1e62e4532a2c1ff0342e46184ffce487102112d7d6bbfd5b560dd401b6a651cdce266cbdfe011", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478532, "uuid": "e31d28de-1d65-47c0-b722-896322af653b", "value": "T14504B9592E228F7EF67CC73447B79A21976923D623F1D684D2ACC1105F2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478532, "uuid": "62f233e0-db6b-40dc-96e2-779bf645eeda", "value": "3072:8T59WLWkKItI9GIyCtahJwBKxsm3a5/0Ub3uF:07WvKIt5YoMKxVa5/BLuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478532, "uuid": "54eee8b8-7e3d-4d2b-9dff-3bbe11e074cc", "value": 184164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478532, "uuid": "5914fd2c-5050-40ea-8bbb-ed67b2c58fcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478532, "uuid": "49560470-3570-409c-9ad7-c340f68dc379", "value": "sumrak.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea8c3a8-f1e3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768461902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461902, "uuid": "ff4860bb-f85b-4b2a-82a9-bbe2f4c7a922", "comment": "Malware payload", "value": "1b5890895d28f0cc5e60f7cb24fe549a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461902, "uuid": "20a2bd96-8031-458d-9dc3-1f3ba79b61c2", "comment": "Malware payload", "value": "742cfc0d9f4dfd16f49135f690c96884b8937bdbd02100ab99513508f5fecdd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461902, "uuid": "9b100a22-9ddc-4c0c-b27f-17e1f9eac3d1", "comment": "Malware payload", "value": "b9e86654192ca0b3f847d551c836d7a2186a57fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461902, "uuid": "547f0dbf-05bc-4600-b635-def938f27923", "comment": "Malware payload", "value": "62c7ce2e78532877bb466402fee7dbad7fe8ead0a5463028b58b77ec6fdb82087bfd35c697360d2b6439649c11bfd524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461902, "uuid": "a2fea209-a038-4c27-9044-e99cd6d9248c", "value": "T11CB5220C1299CA02C5A24BF466B2E7B06B746ECEE861D397CFD9BDDF3464B408D15386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461902, "uuid": "85f6c65d-83be-46b9-9b6e-1cc6d95ed5ae", "value": "49152:s6OTicDkiJYXhc7HnkeqxhTcVs/m/kHhNT2qUoMLEvAAnFHzjC:spTRJj7Hn/ATVO8HhNT2q7MLjAnFTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461902, "uuid": "79d74c69-32d5-4f0e-aae4-f11968d78749", "value": 2278400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461902, "uuid": "87af1774-27ce-4e1f-b9d7-202c0d6b73a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461902, "uuid": "fa21e7db-b05f-43a4-aabc-fb25468ef2b1", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44168.5557.12392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ff984e-f212-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768482316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482316, "uuid": "6e1bdb29-1c13-45fa-b318-d48cf6956a31", "comment": "Malware payload (ValleyRAT)", "value": "b8a12e3be2d111be1a6441cf3d943d37", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482316, "uuid": "5be1b6ac-356c-4f72-9db2-0587a3f3680e", "comment": "Malware payload (ValleyRAT)", "value": "75c5d8814ce92188ac9304cd9a624e48b781415be01a41438f517b75da6c6ffd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482316, "uuid": "957f48f8-f60e-4d8d-b953-fd5617a6f807", "comment": "Malware payload (ValleyRAT)", "value": "e89a747b2e33abb11eb49118c378b011f6e1855c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482316, "uuid": "d4833a28-d384-474e-a7f5-88ad3f3aabee", "comment": "Malware payload (ValleyRAT)", "value": "ac48bc0c88fdfde493c5dcfec334adcb9ebc5c07aeb0c75f25eb97d3fe4391ec3a691daf5ed8c1d1230eb67f011c6422", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482316, "uuid": "12ccc622-7776-4d50-8259-37ab2810c2ec", "value": "T1EDB38C227660C832D0DB253D54AAC7725A7FB83187B854CBB7A407BD5FB02D06E7934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482316, "uuid": "f6388b5e-e350-4440-b76f-c5a265c7aba5", "value": "9a3792aff0565a5387303270c11c4e6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482316, "uuid": "b35b4469-f47b-4aae-a935-fd4dfcd82f0b", "value": "1536:PoygeWdYImrAfYxMffVjzLO/iFq3BZvU5oNp8fGsEt6XBtkU3nPTShFXYX5zL:QCWKIm8zLO/iFgBZWedtwCoX5zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768482316, "uuid": "d556dae8-e0a7-4d53-92fa-850a857658f2", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768482316, "uuid": "1c8c37a3-3a5d-40b5-abe4-a31ace87aa71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482316, "uuid": "68bf2dd1-4306-4c64-9b0c-0453f05764dd", "value": "B8A12E3BE2D111BE1A6441CF3D943D37.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e406881b-f1d5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768456140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768456140, "uuid": "2bfe5995-0e51-4aad-bc11-9a95cb49cf37", "comment": "Malware payload", "value": "2a1a7ed74ddba4f45db588c4572e9006", "object_relation": "md5", "Tag": [ { "name": "AddAdmin", "colour": "#E39336", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768456140, "uuid": "61c4b45f-f9a2-41fa-8f9a-bcab7f1fac6a", "comment": "Malware payload", "value": "75fd7ffc31e907846aee69f32d16b04e2eb658a04c4c3963bc31ec148a107764", "object_relation": "sha256", "Tag": [ { "name": "AddAdmin", "colour": "#E39336", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768456140, "uuid": "36177788-f4b3-4903-a560-3cc1b79849a5", "comment": "Malware payload", "value": "320911cc09f1ff8112029c50f2495cfbd4e06523", "object_relation": "sha1", "Tag": [ { "name": "AddAdmin", "colour": "#E39336", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768456140, "uuid": "d3c63e6c-d906-4eed-8dff-508c951e5d6b", "comment": "Malware payload", "value": "08c24524b69bbde26316e311b17e42ae674ce872f5e9c17646fbcb7c87b626c08354434b7bd703f049d86092692f60ae", "object_relation": "sha3-384", "Tag": [ { "name": "AddAdmin", "colour": "#E39336", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "StickyWerewolf", "colour": "#C19060", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768456140, "uuid": "dd0a16c6-cb21-4a4c-9d3f-d5205367959b", "value": "T1AD1172465A921925C7521B0084E6272032E2B3CA26081A92FA8ED8C260C10EE3F6E8CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768456140, "uuid": "ddce01c4-1616-4804-9ce2-66887bc48721", "value": "24:w4xFC2X4GRz+DSR6qTcaB/uiFwMS1D3a1qNb:hkbcz+WR6AVFwMS1W1qNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768456140, "uuid": "da6a4fbd-d1fc-4dd6-ab82-e3d17fc46d5f", "value": 1025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768456140, "uuid": "b1dc51b9-ebc9-4be4-80d1-1b0fb8d6759e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768456140, "uuid": "4f1a64a8-ecf8-45c4-88ca-ca79b3d1d66b", "value": "addAdmin.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbd68dc-f229-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1768492016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768492016, "uuid": "ed20c239-e996-4f35-a84d-ba4c79fa74bc", "comment": "Malware payload (DCRat)", "value": "bcc6f02f3bb5d589b02573408de915d6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768492016, "uuid": "58c1aa54-df5c-4650-a5d6-10d3ad6628da", "comment": "Malware payload (DCRat)", "value": "771ffd8cb7ae3f948e51745ba8ba1e4192fab63342bac75c465ac91b146c78c7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768492016, "uuid": "9c100eb7-f8d8-4b22-81a5-2821daca654b", "comment": "Malware payload (DCRat)", "value": "5b37eb51102ae6830e3444d22d3a70332ebb552b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768492016, "uuid": "447dae20-ad2b-4563-92c5-dd2362f1e748", "comment": "Malware payload (DCRat)", "value": "44605ac03edb6053c55910885f7508dfbc7bf0d4035b59a5947258cc63eab3fb8b0cf71f5d9c24dfa8d974ba49965cb8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768492016, "uuid": "2e960354-1736-4f4e-b9b1-df14fe9682a5", "value": "T117234C4037E88136E6BD4BB4ACF2E1418675D6676903CA5D6CC814EA2F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768492016, "uuid": "9a85b1d7-bfc8-4a97-889a-ab4190ed68e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768492016, "uuid": "dd5bb3b8-9299-40b1-8ee8-3822385dc082", "value": "768:dOEuILWCKi+DiBtelDSN+iV08YbygebApM0KVmvEgK/J9lZVc6KN:dOtmBtKDs4zb1kFmnkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768492016, "uuid": "f179daa2-d621-4d3d-9fc7-d7b8c8c6c9e1", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768492016, "uuid": "aafdf3b0-21e3-4988-a096-7e8bb12896b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768492016, "uuid": "63f46222-1d9b-46c6-949e-d3c729c09cd0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bdd337-f1e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768460572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460572, "uuid": "5d6bb854-37ac-4570-aac7-31434332f3cf", "comment": "Malware payload", "value": "4e9a89bf651a8f30d748e4b94645e20e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460572, "uuid": "2fed83f6-3138-43bb-9c94-e95c8a0de8f1", "comment": "Malware payload", "value": "791dee5f6c7693cd99846063f1b8d393da5ae18332de82cb632758e4397d56c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460572, "uuid": "d8f67064-cc43-44c3-88b9-bf32eb8b98de", "comment": "Malware payload", "value": "9a0110155bb2af64472e7303fbc33eff3e4b10f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460572, "uuid": "1bba7c2d-416c-46e1-a68a-47a0976d8f25", "comment": "Malware payload", "value": "bfe88f3b3ae9dd06dc391ac5edce633cccfe9083cebf63b383a96053eb0c358c5405ae50386948875c5787cd1f017a4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460572, "uuid": "adcc043c-9931-4b6c-afa7-705e7a89d2ed", "value": "T1CC9439029F840FEFC86FCD30492E878714ED89EB5AD4923491BC8889BFDD65A5AD345C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460572, "uuid": "7d1273f9-8c09-4703-8719-371017c2dea8", "value": "12288:n3AHhWX8DCyI272NYxwssdThEzxzXzQzJhzrlIPiaubjXg4i9LvZvUZUW4+St8lO:v9i+9XDDnuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768460572, "uuid": "b14e8978-233f-4666-bd77-d8e367b78cbe", "value": 410877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768460572, "uuid": "d5f69af2-4aa1-48bf-a79b-031e1d427b4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460572, "uuid": "01615a8a-1d22-4e08-a99d-5bef8ce2cde4", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9203554-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463343, "uuid": "2e329e77-5134-41f4-bf80-a793b73bbce8", "comment": "Malware payload (Formbook)", "value": "7bb7a1cb06bad96da8415f91586c5954", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463343, "uuid": "ca36c0c5-7275-4cc4-ad94-4529f440d281", "comment": "Malware payload (Formbook)", "value": "79669b6f6da1e2f28db930340e3b1343c1963efb7c24a7249bd9f007a105eedb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463343, "uuid": "3ff85b6b-b955-4deb-90fa-5152d6d40db6", "comment": "Malware payload (Formbook)", "value": "d51a844842e800eca2ad55a3e7040fa4367bed53", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463343, "uuid": "c9871a7d-38c8-49b3-914f-9bb4e10c5e0a", "comment": "Malware payload (Formbook)", "value": "cd9819ca88dfd61cae59ad6f3991bf3938589b9005cd0573151c2e29e070e822161d8aa9e2437655913240844c02dd04", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463343, "uuid": "c80cf658-8cc6-43b9-898f-14df77157fa2", "value": "T1CE7374DD7BE7F475139168337A2BB05AF22E4C80754C4191D29A6585FA38B08EF3BA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463343, "uuid": "2f1fd35a-8862-4529-8193-c4da5601b829", "value": "1536:e72aviADD8KXPZvFb2Fzf66NvgqgHaRmgsXnHjBvy5gTnHYcbxrh:e724iAfhFbYcoR1sXDBvyUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463343, "uuid": "3eb225fc-081e-4593-80d4-87ae5702a218", "value": 79934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463343, "uuid": "c6471f59-f354-4cec-8a50-ee0a8d352df4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463343, "uuid": "ede4c513-e876-4fa8-8b8a-8ae3c85c4bb2", "value": "JustificantePagofactura1-000968 CUOTA FLC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0550d7-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463102, "uuid": "4af2fbbc-ddcc-4c07-bc70-2907fcea9076", "comment": "Malware payload (Formbook)", "value": "b2d8d48d28a003dcfc65ac9df818242f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463102, "uuid": "62fdd1d5-732a-40b1-9df5-9311f3026996", "comment": "Malware payload (Formbook)", "value": "7995d7985c7b1475d069071024557fab22717fbef8faeed51607aaf81b4ab760", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463102, "uuid": "dfcc820b-482b-4644-bdd8-a5fa88881db8", "comment": "Malware payload (Formbook)", "value": "f4a5b4a1facefc3ffeeb3f525c2b81eabb20e80d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463102, "uuid": "aaffa059-c659-4a67-b0f1-23caba9b7162", "comment": "Malware payload (Formbook)", "value": "70b3cb924b39f26f35c57f3f6468d2febd0d920d4db4bcdb16f4c69aa3b67e57859a2b430af03c419af524fef85f82c6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463102, "uuid": "de85c5fe-127d-433a-bfa9-4f24826ed832", "value": "T1B073629D3BD6F467535130333B2BA0ABF12F9C42748C8091E39665D8FABD708C975A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463102, "uuid": "58fb3869-1081-46e2-b089-cb0e101de444", "value": "1536:6cGYwoH+Ks82xuRyPHr7GR+ycpy5PtYJrlj6WIHG:gYQPE+yiyVtYJrlj6WIHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463102, "uuid": "147cbddd-ab93-45b0-84d0-7854c1b93def", "value": 77341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463102, "uuid": "59274077-c97f-4138-b24f-c8e9037d6ad7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463102, "uuid": "cca2f78f-24a4-4460-bf5c-d47414fc8d7c", "value": "Technical Specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8a4dff-f200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474651, "uuid": "5127bf95-6ed3-4d2b-91e8-7fe3f56ebf85", "comment": "Malware payload (Mirai)", "value": "7e58d0a7dc7dba699eacec540b0b2726", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474651, "uuid": "3741926d-5622-4995-8589-1d803a265b2f", "comment": "Malware payload (Mirai)", "value": "7a1b362f2f5627dd3974d89ad7a75fcffd4fe9f3ac837a935974e6b3d7db57ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474651, "uuid": "39ae3582-4322-4eff-9be0-4f7ead4639c7", "comment": "Malware payload (Mirai)", "value": "d08f1860477f05105caeb3d519af3abe867598ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474651, "uuid": "5d34b379-8b9c-4c8d-bde6-36ab03c99489", "comment": "Malware payload (Mirai)", "value": "32a4fc2a8a1711816f438c974d52825edd38e54cc7b79de9c2870835f216960f310f3396f09bb80e866905b7ce1785a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474651, "uuid": "6d19efda-8a33-4874-831b-95071f2939e4", "value": "T17753E9627C926A2AC5E063BAF6BE418D332167B8D1DF3217CC212B057BC551F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474651, "uuid": "af2596cc-70bb-4184-94b1-3c2cab18adfd", "value": "1536:wmHfUXVywKHMIeVOeKSs2KlkaLFgiZuiKjoh+tTnm:wmHfUl1IFMiKEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474651, "uuid": "25968aa9-e160-46bd-9764-fa0b67eb34c5", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474651, "uuid": "d6aac4ab-a5fd-4448-82f6-df3dbd22936d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474651, "uuid": "9ad012e2-b3f2-434f-9b61-9e3664f9ce2d", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99335f60-f202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768475342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475342, "uuid": "ba76f2b7-ba68-4b1d-a605-78e5a5548246", "comment": "Malware payload (Mirai)", "value": "1e9c4579b7fb2b5b2ed6cff2e4bb75c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475342, "uuid": "827171b4-0cba-44e1-be84-53e559800c03", "comment": "Malware payload (Mirai)", "value": "7a21c878989a083a2c39dad51219ce926cc986f901896f6e716e9da2316242c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475342, "uuid": "46955b67-7efd-47f3-bf46-fa2f3097199f", "comment": "Malware payload (Mirai)", "value": "0c9aea1b4f31b2d731dc0dfc4f71d6e6d4146dae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475342, "uuid": "848a3421-19d0-4334-9864-b2e428990974", "comment": "Malware payload (Mirai)", "value": "c4c30361c102b89871691383617b4e55a31bb819659a0e6694add97e383c3f1303452cf2f83a2b9ae5da5bfa239e4356", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475342, "uuid": "ae6fae7e-32c9-487e-a5f5-d9bf00b00e2d", "value": "T1B3C33B46EB408F13C4D61776BAEF42493323A754E3DB73064A289FB43F86B9E4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475342, "uuid": "a45bdc4d-ed23-4cce-91ba-ae1f5bcf6b9c", "value": "3072:tbFoIiBmOgkuFXtNlGn89d7KnNOMOudP0M/9vL9V52:xFoIiBJg9VlGn89dWnNoudcM/9vRV52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768475342, "uuid": "446b2c25-1836-4615-92ef-4c7812cd9984", "value": 129567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768475342, "uuid": "fbb7d2ea-83a3-4106-95ad-6d3c79307e2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475342, "uuid": "0413bd1d-97c8-4726-9ede-70d1fc63dae3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78f7531-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478372, "uuid": "0d67d4e3-7e80-47ac-9a0f-c79c7d867843", "comment": "Malware payload (Mirai)", "value": "2a439a6349d0cda98b6065dc5d5b8627", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478372, "uuid": "ec150e04-b2d6-4c0b-b0ff-ddd2ea92fb72", "comment": "Malware payload (Mirai)", "value": "7a9822ad6a8529d4c73544890543f371210c23186d892e07cc662bd92432c61d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478372, "uuid": "bb6403d2-5e07-4267-87ac-cf2fbed7b191", "comment": "Malware payload (Mirai)", "value": "4c04463cd35004e7a5e560f7be6ad470ad043969", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478372, "uuid": "ccb932d0-c4a5-4f2f-9a1c-0eb74567bf6b", "comment": "Malware payload (Mirai)", "value": "7a7fd3ed381e68132ee8e28afced393e8721f84b22844365382d520a200ed8acf75b3383932261ad1e09ad70f781aa3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478372, "uuid": "50a48c29-7966-42bd-9c31-93c572604dd5", "value": "T1BD5302C2742E2471D6F2257613408CDF6E27FEF0A7AD176678295BD63F427023BA0891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478372, "uuid": "1cb669ab-214f-44b8-b410-70f47c1917e9", "value": "1536:GU4i8H3sVC5k2CoKmE39IBS8nVTh9IbUm0KV2LUoC/8esUxMMlF:GPX55MoKm1S8nXixILUoC/mUxMYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478372, "uuid": "86a5db32-3c79-489a-a77f-b4755c0af06d", "value": 61652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478372, "uuid": "4cc63ed3-3505-4f82-8245-2373899f30e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478372, "uuid": "78a83e49-94e6-4574-9f24-a50aec77f968", "value": "sumrak.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0c0430-f1e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768461635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461635, "uuid": "fe373bc6-1a26-4fb7-9474-c5d0b65faa5e", "comment": "Malware payload", "value": "dc1b84bd3563e64c962a280ad243f910", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461635, "uuid": "6323eecd-a1dd-4150-954a-df8d8c7162d0", "comment": "Malware payload", "value": "7ae25aae47e9d3f206f45c0c2355474bca3add0bcc319dcd478b750c16de8144", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461635, "uuid": "8205c6c1-11c2-48ca-a9b6-cf6fa5c480f3", "comment": "Malware payload", "value": "1d59b512d34e20fe16b3c4087c208adcf0a02e85", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461635, "uuid": "86b9223e-f25e-4681-ba2d-bbc8e57001b5", "comment": "Malware payload", "value": "4b09f79e4abec89cc882fd8491e585fb46ac157ec362fa3b6ea7e99315c38677769501bdacda6b6bdbfe4155a43fe043", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461635, "uuid": "1435490a-d31d-4a1d-bef8-79857904d7ca", "value": "T14EE2F822FDA5943602678199F7BBA709F331404BCA04CA10F6FC866A6FD9E42CC579DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461635, "uuid": "6a0697dc-59d5-400c-91f9-85923b49bd80", "value": "768:M5RHm8PaAzHqrqsCNonKOBbK6KftIVUf1x/Y:M5RHm8PRH1NoPbjctIkx/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461635, "uuid": "79d4ccaf-419d-499b-af57-c75f0e1162c2", "value": 33907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461635, "uuid": "4f73d020-9f5b-47d0-8451-f1e970cba0a2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461635, "uuid": "66385037-1bdc-40bc-9bf0-c0c0e0b77345", "value": "PO_N0_JKPO25040107.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a1fe2f-f235-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768497071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768497071, "uuid": "2de2a5a5-f131-4ef3-ab7f-1ed16876d67a", "comment": "Malware payload", "value": "08a5aa5c2a17f499f960436103087c69", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768497071, "uuid": "3de586f8-db7f-46d4-90a1-0fc61d81e22f", "comment": "Malware payload", "value": "7cf7bd7f967c9b5f5724d62718035787b19db4201d2b6995277db6dcf8c2ec6d", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768497071, "uuid": "4e57a2ff-abfa-4018-bfb9-3ed9f4a3c485", "comment": "Malware payload", "value": "db61548163391058b2c731e2c8b3c3594c113f92", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768497071, "uuid": "1518d85e-61d4-421d-a0bd-bcfa863a0ff3", "comment": "Malware payload", "value": "b00d3f90051df5e5a3f7d44c3e130ce3f5cba70da58a46068bf35f560578b5fd008ffc1054cf09b8e02421831b2dbfdf", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768497071, "uuid": "f98df1cb-73c5-43da-b902-db01075ef6ff", "value": "T180973381ED7547CCE4B3A532DBB879084BD010954552C87EF864ABEB98D77AE22F600F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768497071, "uuid": "1a45812a-95ff-4e93-a770-bbf724b3cec2", "value": "786432:vE+Y4JWh8ruhmjmp+DM3gdovyEEV8d4/Jg5btNb3KMxZly/aKSQ:c+Yh7Y6Tioa9eF5bXeMxZA/NSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768497071, "uuid": "a16014b1-d7ca-4106-9411-ef2e108ba659", "value": 39608335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768497071, "uuid": "164446bb-1635-4ebc-a7b4-e28657381ca7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768497071, "uuid": "706a4be0-bc83-44bf-b315-1bd77d0144f1", "value": "class", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18788750-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768466106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466106, "uuid": "1282c798-2088-4d42-ac94-13d3b2b87efc", "comment": "Malware payload", "value": "84e504fd5aeaf313dbd2f2807647638b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466106, "uuid": "aacd5afd-304f-4354-a79f-7705e67a3e08", "comment": "Malware payload", "value": "7e1fb181d81621d1d4721fc574ad5e08b552aa9afe1ddbc20495054ede44ca7d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466106, "uuid": "409b0532-71c1-4f10-913e-ddf94a2b6dd8", "comment": "Malware payload", "value": "cac05da0830488e883fa148910798cf6cf422375", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466106, "uuid": "43153e72-cf19-4298-b677-9976150bb4e8", "comment": "Malware payload", "value": "936e10b5594f0acdd855ee764ef861c7c90c20c35d3fe3cbd972700514523ec14d980ae821ff7dfbb9ba0a4b0bd4017f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466106, "uuid": "48a62da7-6721-45da-ba06-f83592eb4e78", "value": "T11C164062C071FA605DA1CE21C79518C79F2D5E3A4B380AB65F5B83FB4BB22615FC710A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466106, "uuid": "21ef059c-47e6-4c4c-88bc-4f7f8df7bb54", "value": "6144:da1/5y+tKtBqwhRPVB+8ulW9KI45/kpvFRBkH/UoUnvDsubk+4nqftxCBE6kZGf:o71KtBqUHa/kP/oUoh1xE6Jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466106, "uuid": "f8156d79-893c-4d39-964c-0a73758f2dd9", "value": 4102896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466106, "uuid": "d532bdc3-8eee-4dd2-8b70-93acf05845d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466106, "uuid": "8460d952-37d3-42fb-8f5d-cb5b76ead030", "value": "sweet.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f1a316-f1ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768444231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444231, "uuid": "1c245130-2ad6-466b-aa04-bf7998e4eb83", "comment": "Malware payload (Mirai)", "value": "2499c6ef57df2bfaeec3371205a16b37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444231, "uuid": "2bbbab36-5c37-41b2-a750-4d5ad97a8d18", "comment": "Malware payload (Mirai)", "value": "7f811a1cdf3914ea41daa77485f3b4db99551015182b5c31594b35e521fabc11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444231, "uuid": "a605237a-6a5c-490d-9b40-4e5ac7756d11", "comment": "Malware payload (Mirai)", "value": "3a9cec1adce1781db4ca1870e568d14706243d8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444231, "uuid": "5ce23931-f9f0-4a3d-bed5-42f934fc04f7", "comment": "Malware payload (Mirai)", "value": "8fb3296ff1d4d63f42724adc6e9973e74d003699bd845edc6d6d5d5ab31410ea271ae752c1a09f6d1303d4096c56212c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444231, "uuid": "f91ca653-2017-4407-a1f3-36f50d54c034", "value": "T1B6D3C54E6E218F7DF6A8C73487B77E71A35933D622E1C684D2ACD1011E6034E652FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444231, "uuid": "8eb2c35e-5c62-4e82-baf3-a3b41f0c084e", "value": "3072:IvSH4Q7gXeGNCaFFdmkck3CFxkrdBzSD7P9HZnw/:IvSH4Q7gXREkdqxkrdgP5Znw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768444231, "uuid": "d0a79e8b-73a3-4465-a51f-c2e6fbba2b87", "value": 138912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768444231, "uuid": "b5bf61d1-3a15-4213-a4af-c9331a8e0b99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444231, "uuid": "974bd92b-3de9-430d-8929-7b9cc0738300", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9f7178-f253-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768510214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510214, "uuid": "30af2c92-802d-409d-948e-140e8ef0e2ff", "comment": "Malware payload", "value": "0f1ced9316fafa4c05a90ee730ca70b6", "object_relation": "md5", "Tag": [ { "name": "Apple", "colour": "#17EF9D", "exportable": true, "hide_tag": false }, { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ssd", "colour": "#689D83", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510214, "uuid": "210cf251-8c2a-484a-a9cd-62c02bd5486a", "comment": "Malware payload", "value": "8097bba0ab20b5eccbd02def237a0b36e845ee8f50c684d72148a89bdba34a7a", "object_relation": "sha256", "Tag": [ { "name": "Apple", "colour": "#17EF9D", "exportable": true, "hide_tag": false }, { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ssd", "colour": "#689D83", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510214, "uuid": "9d16ae31-f3b2-4c47-ab95-91befed77240", "comment": "Malware payload", "value": "08bbc3cd496b4597c6ba7d9ddcd551defc1a4557", "object_relation": "sha1", "Tag": [ { "name": "Apple", "colour": "#17EF9D", "exportable": true, "hide_tag": false }, { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ssd", "colour": "#689D83", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768510214, "uuid": "fde314ec-709f-49ae-a692-1074c1234d1e", "comment": "Malware payload", "value": "5a8a118fa21e8a0ad16621a9c50722f61efc816dc6af1c9d0c513f2e43ac359adce254e0448c736a1b5192b64afdf97e", "object_relation": "sha3-384", "Tag": [ { "name": "Apple", "colour": "#17EF9D", "exportable": true, "hide_tag": false }, { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ssd", "colour": "#689D83", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510214, "uuid": "73a17a5e-7cba-41c9-ae86-05023c4878dd", "value": "T1A3B34981A73533ABC9C56A34F30A804FEAF8B885175253CF1B6099952713BE1AF37B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510214, "uuid": "ab7f9102-5c99-444d-8d04-5e96d49cc1e9", "value": "92828dd58ef3048c2b8db6e86f943505", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510214, "uuid": "8a559c64-d18a-4913-b8e9-bdf49e82cb62", "value": "3072:22TNpsdvMrDYhPU2IjEL7T5nTAYYADp7GZybaOfkcSMARiCQmRpzo6d+2XC2zpRR:BmODYhUl4L7T5nTAYYADp7GZybaOfkcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768510214, "uuid": "a8772111-4296-42e7-b4c2-c7c0c044eaa5", "value": 113456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768510214, "uuid": "532bb5bf-2057-4039-80f8-7a37b6ca95ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768510214, "uuid": "1e796858-769e-4c68-af67-e135e0bd8208", "value": "AppleSSD.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0feeee3f-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463515, "uuid": "e14633c7-2e22-464c-8952-76268a060945", "comment": "Malware payload (AgentTesla)", "value": "6d5bda2b9959030654c996a5b33f0459", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463515, "uuid": "68a6a2a0-0771-45b3-ab4d-7d5630f6ee54", "comment": "Malware payload (AgentTesla)", "value": "81e01310414899d3f1244223df326779642aa8f1ee2fcebf3fcb800da79b7300", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463515, "uuid": "f61665af-2834-4aa6-b50a-bbc938ca80e8", "comment": "Malware payload (AgentTesla)", "value": "8b90b356a76a4c841244d87c3bde47bc861fcb32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463515, "uuid": "dea1beb6-2e8f-4448-8ca4-6ffde8f12f6c", "comment": "Malware payload (AgentTesla)", "value": "442f081f7d9eb588df89e872eacafe25d2d1965b08249af179cc59c4a7d99c63c36881a85dc6fc7d7c2d1e5f9aa56190", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463515, "uuid": "92dd9dd3-41b8-4d0b-98d8-061b3a27e2b5", "value": "T11E535188BFC2B46453513833392BA0AEF22E4C44764C845AD3A758D4FA7C758F776A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463515, "uuid": "25faddb2-62d6-474f-96d3-9781fd07c792", "value": "768:PoFJJ+PlMj6G2GOmXyvFFCxmDNO5fDy/jLcAzw85DgaOl:ef+K2GRyHCxmhO5Ly/HRzw8hgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463515, "uuid": "8e5346f5-bacd-460a-b402-e36b84507472", "value": 61421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463515, "uuid": "cbc3d444-7296-4c9d-b1c0-9a717d4a505a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463515, "uuid": "75de9dad-df74-4241-9d89-7526930bbc4f", "value": "Payment Advice \u2013 MT103.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588202a5-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463637, "uuid": "1f8ad381-c7dc-4460-8a4f-79ee4c30bdbb", "comment": "Malware payload (Formbook)", "value": "9fdb126fa5bdbd25d7bf6cce54aacc30", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463637, "uuid": "d08dac93-a05e-4653-a380-b35cbd8d3f62", "comment": "Malware payload (Formbook)", "value": "81ec63a1296d7f6a0efc4e7bc01641270f936d20ada45135110d2ee8fb4d6e6e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463637, "uuid": "78ed36a1-3ae6-4c26-a506-7450a0aface2", "comment": "Malware payload (Formbook)", "value": "9b6a143d894a4ac8e14a968d88fef2a282a1cf9c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463637, "uuid": "4b26644e-17f4-4372-b648-a2e9d25a8c9d", "comment": "Malware payload (Formbook)", "value": "5313302d6e8d018c8d7aa873da5b6bcad24bcdc27289a771ea042c67405ff6c78a85b111d3439534d0e2448144a63e1a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463637, "uuid": "526eb2fc-dbe1-4b5d-a95c-68e0f464f8e7", "value": "T12A535188BFC2B46453513833392BA0AEF22E4C44764C845AD3A758D4FA7C758F776A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463637, "uuid": "da3a00ec-6843-4c28-b222-dd1da28d7f4c", "value": "768:PoOJJ+PlMj6G2GOmXyvFFCxmDNO5fDy/jLcAzw85DgaOl:ff+K2GRyHCxmhO5Ly/HRzw8hgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463637, "uuid": "7dad3496-3bf6-4f84-9241-c6056a2a1cdd", "value": 61418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463637, "uuid": "dff766b7-7fed-4d7d-a032-c23b88c5d116", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463637, "uuid": "b1c30b86-29ab-412c-815e-c9c0a5cd76d8", "value": "Revised Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b675e0ab-f1fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768473243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473243, "uuid": "1aaf71d1-291a-4b4e-87a1-b66ff6182042", "comment": "Malware payload", "value": "43567a9b81f3822da10ce2ad0eb08dba", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473243, "uuid": "8608e212-64d1-4225-934c-6a45ab9fccee", "comment": "Malware payload", "value": "82b146839a20e0f8fb1547a6afd3b79b015af784a07873d93dc1c3e16c851a86", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473243, "uuid": "f1c6828e-2767-432e-857f-8e5a2725e7c2", "comment": "Malware payload", "value": "6bd6ab6aee863289b3b1144a69d7ad0079e6e73f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473243, "uuid": "e907cc06-bf19-4dd9-96f7-fcfa93c55b6d", "comment": "Malware payload", "value": "37f4057ddcbd73e7540d19ae10a09dee1c736db2397df8b99d5b36435cd6dc887f826f1bb181f58f1afbf8bc7748579e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473243, "uuid": "6120eb57-adb4-436f-a828-0e02cbf47d63", "value": "T17D71A5FBCEC342908FACBFE0C318BB56CB4B059E98B145DCE580A555525BFB4A12B50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473243, "uuid": "33c0e489-e5dc-40ba-9a8e-fb679e35cf6c", "value": "48:ZSySlCdFKHHHHHHHHHHHHHHHUdqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq0:ZfFKHHHHHHHHHHHHHHHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768473243, "uuid": "c63d4f3c-0ee2-4789-b9ce-7ecc87b3f1cc", "value": 3482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768473243, "uuid": "6b1d7d2f-9e6c-43e4-98f4-f2f60b9c547a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473243, "uuid": "05d2bd53-fc82-4365-8bb3-37c832ccda1d", "value": "skRise.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d469f3b-f218-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768484556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768484556, "uuid": "79bb49bf-f4ea-487e-a260-7017f3412885", "comment": "Malware payload", "value": "7cd4ddc889bcb64e2e19c3072d23d025", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768484556, "uuid": "35387aac-195a-4985-8171-d5cda2485583", "comment": "Malware payload", "value": "8406e6ea2afefa19d9380c5faa3413b4423180f89741a37e6695357a7c8df936", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768484556, "uuid": "cec84b87-1c16-439e-ba4a-11511b447a19", "comment": "Malware payload", "value": "d5f8ee590e2f5033378e9e635c685bdeadae3b8e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768484556, "uuid": "8ed66194-a249-43b7-b1cb-08a10f8797b9", "comment": "Malware payload", "value": "237bac1efc4ecd0d0c0d4d762288a15db04f6a834bd4d0a3016e2fb8873b35950a31fa1162f0f08115da3e1c5ebc6b95", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768484556, "uuid": "21639be8-c96d-432e-8c96-74a1cc58a6ee", "value": "T1E597339DDD85228BE97E8830482E718AE96BFC560C424C3B2AE5F3211177B5531FACD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768484556, "uuid": "b1aac46b-8513-4670-ad76-ed2e0c96354d", "value": "786432:G2+TbcVTjFmL4kyjZRvUqa7zlWPAsPmC+jOklA7CH9dfZm+fdfubCy6NS7CFXcn2:G2+TO40jzvSlcNMemH9dQStuGpo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768484556, "uuid": "7fd126dc-b859-4b9c-ad6e-e62ce5772ef6", "value": 40976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768484556, "uuid": "fd4851c7-321b-4cbb-a7ba-3541c019e6d5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768484556, "uuid": "04797a8d-18c0-4760-8559-947c3cd27276", "value": "Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b423574-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463131, "uuid": "ced0e9e1-4334-4216-9b41-600b2d8603cb", "comment": "Malware payload (AgentTesla)", "value": "4c7d38a75e77fb01c5be9d84523cc6c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463131, "uuid": "2b817021-1978-4d93-b3f0-129b23dc36df", "comment": "Malware payload (AgentTesla)", "value": "8485e45e3007498df45bb8231dc77a4ddee876273f98770bfa44ede3d7568855", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463131, "uuid": "6ffcb7ed-c8cd-4143-b2ca-d714a59a195f", "comment": "Malware payload (AgentTesla)", "value": "fb7ead9edfcefec59a180c719873374f5f5eead5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463131, "uuid": "54a1ba46-b343-4289-86fd-d267a26303a9", "comment": "Malware payload (AgentTesla)", "value": "06100f5e100882c1e53d7c7193b8b30a978a5e3282a3daff2fe082af5e8374e0f28a3eb3fd06d14e4f3542335ca85f96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463131, "uuid": "aa443392-3fed-45b1-9ff9-7071cfb6ff08", "value": "T171935B60D92905B70F83BB98BCA90660C67C8315843758B1F9DE870D920A9FCF77976B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463131, "uuid": "ceae06c3-8a70-463d-835c-617023c12a07", "value": "1536:XvhsbFcsT+ELMgj9ZdKafb8o5QsOEGgkU/E5B4A2oD:/hsRcsTrLh0afQIQhEvn/SB4A2oD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463131, "uuid": "9441ee14-c109-4ee8-bd43-afba94a26662", "value": 94097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463131, "uuid": "ac38dcee-8584-471f-b3d7-bb7290b1e445", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463131, "uuid": "ea9df031-7453-4edb-9343-0abd274a95a6", "value": "IMG2026-01-13-00371.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f950fafe-f234-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768496978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496978, "uuid": "d444798f-b446-4406-a491-730e7db886f6", "comment": "Malware payload (Mirai)", "value": "a2fd89da203852d4ae475aed6cb3d3de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496978, "uuid": "47e59b58-2368-46d2-a4f1-c717fd136edb", "comment": "Malware payload (Mirai)", "value": "85c89e3e84e41da0c333f2e6bae7779445ec812edc3c351b1b9330485f694cae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496978, "uuid": "43e5cda1-11cb-4c92-8ad4-bdf3c913ffef", "comment": "Malware payload (Mirai)", "value": "8127e2a77d7126291838746cecc35b946e1b5aac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496978, "uuid": "4cac6f4f-be32-4212-9a98-86085017a9c7", "comment": "Malware payload (Mirai)", "value": "a5afb7e0c302ae0fe7e3311ce99fcb4085775260f32bfba2f205ae027925d1050f8177a86fb9076feec3874655cf993c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496978, "uuid": "9dbe9db6-a6d2-467d-a5d4-b711b0db803b", "value": "T150515AC483711AB02E62ED7671B88264B0E5A5DFACF6FB0748FD3DE6508CD045F84646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496978, "uuid": "4bbadfc5-4a15-4058-a7b6-5d2ea56d79de", "value": "24:vZonlnKKt4vRtKFT4+CXlFc4lKVblKyySl4PZkTGB8FbmA:vZa/t4vRtKFT4+w9AtekTvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768496978, "uuid": "5ba95931-58e8-49af-bc26-7d9a639856ba", "value": 2639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768496978, "uuid": "150f6930-4b10-4c19-936b-0d11cb87bb41", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496978, "uuid": "8fd90b3e-c74e-4a86-ad90-957a6e88d27e", "value": "23.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b3148d-f24d-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1768507382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507382, "uuid": "d3c49faf-4654-4f65-a6bd-70467992ff79", "comment": "Malware payload (Adware.Neoreklami)", "value": "31d51edbd3a1d33d2cdc3888592cd84a", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507382, "uuid": "529ebad3-dffa-432f-afa7-b657355d70cd", "comment": "Malware payload (Adware.Neoreklami)", "value": "8739f66877d1f311715d21f820fc6e9dbd85ae435ba871c67c327735cae40f1b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507382, "uuid": "6d5c8bac-129c-4046-bb5f-a131319a305f", "comment": "Malware payload (Adware.Neoreklami)", "value": "d3234b6583bae7ba641ce8521f28bb1025627351", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507382, "uuid": "99b5c1dd-d2b3-4e3c-b8db-c6b9df8eaa6a", "comment": "Malware payload (Adware.Neoreklami)", "value": "5108b1004f5c62e9acd01d6ce9f847c7dd20579dedbed1fd9362af77454ce00a1d52aa0fa5b9dd3b4ea25567b9c3b29f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507382, "uuid": "3633751e-34bd-416e-8c53-e55b951679f3", "value": "T12C7633123AE885B1C1532AF3DA365F55529AA3800A21DBB333894E179DFC46DFBB07C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507382, "uuid": "0ee4fd35-add6-4788-8e8a-9799c5deb7ed", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507382, "uuid": "3cd514ac-ac02-4a1a-932f-f91311743c0b", "value": "196608:P1OWpPdPhyqUzhq7ICQbShZo9uB4LdjU/H2QOnA7t9PjuuEU:tOW3A1q0CQbShZoA4dI/W/M9PjuuEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768507382, "uuid": "21268b67-0685-4280-803f-86ccfc069544", "value": 7534681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768507382, "uuid": "fe764cc9-35c0-4f61-b2b2-a24f0594f762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507382, "uuid": "c1f2227e-66f7-4c52-b244-70b98d3d877e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d106fb5-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435727, "uuid": "66457a7a-5dbd-4c2c-9d79-eec00c0f56e2", "comment": "Malware payload (Mirai)", "value": "2a3db797aecfcff2afa3b5f40b87c378", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435727, "uuid": "1cc9cc79-3b39-4318-8c23-1760fd7fd36e", "comment": "Malware payload (Mirai)", "value": "87414ba748a9a31cd3ba69d4dd662c09295906a554373c80a5e540adf938c562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435727, "uuid": "52c35d65-0502-42db-b398-26183ed68193", "comment": "Malware payload (Mirai)", "value": "4d276eebe33137839bdaa463fd5511acfde26509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435727, "uuid": "c1a2a10c-edd7-4370-9a37-c453b57368ed", "comment": "Malware payload (Mirai)", "value": "c5c73a26e49801981a39c456752846293a0b4d0a2c4a11226c048e1ca80fe6368ee9cf9ce13034e5c57d8538c5608775", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435727, "uuid": "ab476f4b-e908-4db4-92d9-0ac364c80d7f", "value": "T180D35C0673180F17D5A35AB0263E1BE083FEE5D021F4BB89691F9B6A4672E371581FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435727, "uuid": "f4354cdf-368a-4ca9-8963-fd4d1ed1f199", "value": "1536:Gom472eUS/FXyFQ+16G3m/2kcVJlVAzWXcs3Z7AUneMG0Dl/wnBy5Z2o1jaq2Vie:ZXUoyzm/5sJwzWXbZ7AUrRZYy5ZfV36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435727, "uuid": "0ea1c21e-0d4f-4c26-b379-6c023026e5d0", "value": 136760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435727, "uuid": "fa6b72d8-5fb1-4166-89ce-784c62302f6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435727, "uuid": "26f82b81-f840-4a8a-8bc6-1efb6f533b1b", "value": "systemx64.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588dced8-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435720, "uuid": "bf1cd9bc-7426-48ba-9441-49b206e9eddb", "comment": "Malware payload (Mirai)", "value": "44d555b5c5566bddf0b9338fb337e6b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435720, "uuid": "cef795a5-0f93-4332-a63d-8100d8368060", "comment": "Malware payload (Mirai)", "value": "87e12a203756cd8102da0a2a44c8508dcee94986377e91eba9494825d73a5901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435720, "uuid": "7692f701-99eb-4d0b-ab2a-92b5ff59b0d3", "comment": "Malware payload (Mirai)", "value": "d188a6b03448978db2d048a08b9f49291d562bd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435720, "uuid": "a53d7db4-db75-43b0-af97-81dd437910d7", "comment": "Malware payload (Mirai)", "value": "3272d9f98115c8b5054492f62f4220c528596d47ed1131fb443f8abfdb42b839d97145df35b2f236e91a4384caa543b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435720, "uuid": "42d634e6-bb91-4469-88e9-2dce6c1bac9e", "value": "T1AD041916BF110EFBD85BCD3B45B92B0124DC585A22E97B3ABA34C418F54B25F2AD3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435720, "uuid": "2cf15e66-62da-4161-9db9-6cfb6fd51c85", "value": "3072:fiN3JMJdXC9yVGNOjyqHtzfTZQc2Slfx2Bnc7pj:fiBJMJdXLxlfTZr2SRx77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435720, "uuid": "83b4f4f2-b22c-4262-8589-135a12f08695", "value": 177004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435720, "uuid": "36b7a385-3a7a-4495-9e1d-bd3059a659d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435720, "uuid": "eb6db6fd-a34b-4b54-aa31-afd2f6b41ca2", "value": "systemx64.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc07ce07-f1ea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768465092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768465092, "uuid": "b173176c-3292-47d8-a922-49d6c36d5b5a", "comment": "Malware payload", "value": "4ae0099757689c271c11e36bc86d1444", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768465092, "uuid": "84ef475a-d06f-4759-9a82-78d039230fe5", "comment": "Malware payload", "value": "8859ab75c8aa2a5da71d71a53ab938a8e4fb3f21fee0fec2e8f48d1c17b81958", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768465092, "uuid": "90f56933-69ec-4f33-8dd0-60e70245cdc2", "comment": "Malware payload", "value": "4f9e512fa951148c4d6879a0799225c952f8d524", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768465092, "uuid": "49942243-82e2-4916-97e8-f2f08a6ec453", "comment": "Malware payload", "value": "1fbca017d66b0de9badd54f3fcf0bd023a1d39c1174bdae9075acb3b61f4b8d462e363aef6f5e81a10d29c75bc85c953", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768465092, "uuid": "ea4161cb-437b-47e3-af4a-592384ffe9f0", "value": "T1F1D3AE97B38B1861C42246F017D7BF8D2A63B212CEC7C8E76D0D663B59B91DB0906782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768465092, "uuid": "7221ce73-83f2-4f28-bff5-f6288cf993b2", "value": "3072:iyMIiyLBWYkVCLKWL9YQVKixtVUfIWovA7Dqgfq:TWYpz9FtZf43bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768465092, "uuid": "f704f6f9-76c3-4ae4-9478-e6e6345df58c", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768465092, "uuid": "66dec0bc-d0aa-458f-abc4-2b17a3b3ba95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768465092, "uuid": "b3efbdeb-e440-4d52-afdf-caff8462803c", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1ceda2-f200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474654, "uuid": "228308f8-e236-432e-97c9-3990ccd6a7d1", "comment": "Malware payload (Mirai)", "value": "66771891d8b0b319d16f533ec3bf75b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474654, "uuid": "43a6d035-98bf-4fa1-886e-3d78da38e734", "comment": "Malware payload (Mirai)", "value": "886b335cee3055840f03fdc58ebbc1333554986d8e9db35f43a67ea697906c98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474654, "uuid": "521921d5-a5d8-4b51-a1e1-5b3704b57f58", "comment": "Malware payload (Mirai)", "value": "3ed41cce2f651a662030ea348fdd1f75b5b27ac2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474654, "uuid": "896c5a24-612b-4b53-bd49-2907600e1e80", "comment": "Malware payload (Mirai)", "value": "10d8faf5b9a8c5d5bb8d005dda455746c93af6b65d747233f6ec6d59e5fddf8078fc05564e887c14d8e7a9227e462107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474654, "uuid": "c15d29be-abb8-4583-9b61-99e062378a98", "value": "T1A1A3C516BF350FF7E8ABCC3719A51705198C650A22F97B35BA34D818F64B25F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474654, "uuid": "6ccbf11b-3c6a-4763-ab6e-7d1ffde63a6a", "value": "1536:RvMKs9oRHbfZT7EQYEWi6lCv+Ge1Cs2ooKfALVZPpzKAJ:RvMKs9oRHbfJ7fWFls+rVILV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474654, "uuid": "ee1286f6-af8c-4a8c-900b-cc26d4186def", "value": 105116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474654, "uuid": "6a4e1e9c-4aef-4993-bf17-386a00045fd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474654, "uuid": "e2c6c4d6-c666-482f-894c-a464b8f8f61b", "value": "UnHAnaAW.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080d9dcb-f266-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768518048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768518048, "uuid": "e87798e9-079c-4fb7-aff5-cef92db717d3", "comment": "Malware payload", "value": "a0888953df0e604b7204c9a51ad573ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768518048, "uuid": "0c144831-b221-4995-8aea-7f5667fce5f3", "comment": "Malware payload", "value": "893da8032ac374fd79c964ea1141202db1903c83e37e9a8b113bad6ad2edcee9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768518048, "uuid": "4fc5e29f-b15c-4ed2-807a-9fe3186a0551", "comment": "Malware payload", "value": "1149f62d477a1586a1e38a43de080a2a5d77f4b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768518048, "uuid": "c82faac0-918c-4a16-8859-a039509ca832", "comment": "Malware payload", "value": "2816f2198857a6062541e64ee77ab0454f9889d3380604d892b0d4b1a69eee8c84381bfa609fc388decc7266e4600559", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768518048, "uuid": "1c565b18-399a-463c-ad3e-06799519c673", "value": "T1A524E7076BA19EF3C89BCD3306FA860110CEE45722A56B6B7378D61CBB4A94F49D3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768518048, "uuid": "bcf51acc-3680-44cf-8b82-2db48a5ffbcf", "value": "3072:t3EcyxRBqO+TFHMU2M6VxPsc3moz9nzBsNcPUTkFizT:REfN+pb2M6Vx/3moz9nzBsNcPUTkFizT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768518048, "uuid": "c6f5eed4-34f3-4824-b019-f2b19246bcba", "value": 227701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768518048, "uuid": "fe89bc74-590b-41f5-8c62-4fa0a545f858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768518048, "uuid": "2caba23a-b884-4064-af0d-14f5690a2b18", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168f1651-f20b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478988, "uuid": "640ee3f4-0094-40f3-ad4d-a9a6e58955c8", "comment": "Malware payload (Mirai)", "value": "59528d196f3abeadb7c4b44574d7bb7d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478988, "uuid": "9fe0f963-057e-43ed-ae56-7cfe29bf47d4", "comment": "Malware payload (Mirai)", "value": "898b365a05e1e49e4d8b49341e567f714b8cb7b45296edc6bf56761802045a29", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478988, "uuid": "1b506680-065a-47c6-a0fa-73104ad6bc6c", "comment": "Malware payload (Mirai)", "value": "b653c42770e2a58011b396d9b39294019b05949f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478988, "uuid": "a5a50984-74bc-4346-8bd8-0a2252903d2a", "comment": "Malware payload (Mirai)", "value": "8e8f6b271cb34165ee1d7520d427aab07a998b330fc67e7760b9fdc8286eacea6d69d9c0aaace7f2f31ad13bb4eb4705", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478988, "uuid": "9e6accce-9258-47c4-8d4e-43349d895106", "value": "T1D941C9C921554B317CED58D7BFFB484A34D0A59B9EC16E1959E834E9448CF083F88A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478988, "uuid": "a9ca1718-c2cd-4b63-a432-40ed6843652c", "value": "24:vd1WNd+jwNdCOCRNdk0NdB0Ndo8NddkNdmwZNdsr7sNdnXKNdNvOTa:vsNIHyvSBDNeuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478988, "uuid": "31a6f4ec-881f-42f9-9594-cf033886d197", "value": 1994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478988, "uuid": "d054ce38-1fc2-4f13-b6d8-545d9203b217", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478988, "uuid": "a38c7667-53a8-4e66-a020-aada71fc8298", "value": "jaws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daef7671-f24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768508523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508523, "uuid": "74bcae05-e54a-459a-9dae-bdc43310db21", "comment": "Malware payload", "value": "5a24c73ce955bd991e721d6e9d0c9a9e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508523, "uuid": "934e691e-251f-42a3-91b3-5b1c9794ef8c", "comment": "Malware payload", "value": "8ae9d4559875fe037d4db59036c3f392ced37b25e6498cfa80b361446d4ce24f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508523, "uuid": "c08f6fb7-4dfe-484e-b2d9-a1fbef0c1fe6", "comment": "Malware payload", "value": "8dc0d3d34c8f3577acfa6bc5e3d54eb97dbf7080", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508523, "uuid": "e29d477f-edbf-4af7-8d79-14b018f98fc6", "comment": "Malware payload", "value": "91fbfa9e1d08da1cf3dc795a06cedec100349bd95bc0ffcf5e8f06e733455aa85e1484baa2a5e648ab2009ceba25bbe6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508523, "uuid": "c82e61f0-932d-45e6-b0d4-bdfdd3354566", "value": "T1BD646A41A3FE9608F6F77F646EF922644E7ABCA6AD38D29C1201505D4972E50CDB0B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508523, "uuid": "600f6985-6696-43d0-9f59-23427fab5520", "value": "3072:snb/muS4ubUHxebtB7ZOhOhyibIn8TNyj4Tc1dMWOOUiibAkz:s/SrUy4nRDX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768508523, "uuid": "70b6d346-b99c-4285-8b0f-4382825a1804", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768508523, "uuid": "485b9772-aae4-44d9-bb3d-2caaedc28ff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508523, "uuid": "c13dcd03-14ee-4f7c-85c5-dd26effa0be3", "value": "AcRes.dll.mui", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98d94dd-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478376, "uuid": "48ae19cf-0c41-4250-89f3-fcc4a02de655", "comment": "Malware payload (Mirai)", "value": "6101fc6a7219b7bf0221c4f7cccab164", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478376, "uuid": "94c54ab3-add0-4ef0-98df-06e71bc7158b", "comment": "Malware payload (Mirai)", "value": "8bd46b39ffe5dfaeac576ec2c235c4c1990d916daf38b134b3af18366c228616", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478376, "uuid": "99457557-7c66-4f94-8bb6-fcbbd3e8f159", "comment": "Malware payload (Mirai)", "value": "a84cd12578182de9785c145754dd5ff2642d362c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478376, "uuid": "83a68952-0701-41e0-89f6-3028c8dd95cc", "comment": "Malware payload (Mirai)", "value": "1c7fa299de759db7ae21445d2f033ea830e7a8592e28c6af9c0a754dbb32f0e708cedf9c7e4d984b3c88681311e02991", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478376, "uuid": "ae193ba8-4ecb-4479-a91e-c2072e6dec2a", "value": "T14D33F175A0DBF771C1D011FED83A19438B1B28FDE78F671CA10985B9784B4807B61ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478376, "uuid": "b7363612-783d-4db0-b29b-2998f60bd677", "value": "768:893y5OU1HsD2WgIB4ozlTJ+DCt/ThHA2GBcN7QQWoiQD+a9Ggtbohs3UozP:J5lsD2WZO8lcy/tAE7QNo4gtbHzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478376, "uuid": "f453548c-1023-4d2f-821a-aae247a020d5", "value": 55016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478376, "uuid": "72577585-6126-4995-8cb1-f646ee6cf69f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478376, "uuid": "0fcd314f-01ae-4ba4-b3eb-a932c2d68634", "value": "sumrak.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e57eb5-f24e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768507891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507891, "uuid": "bd30786e-8976-4adc-b901-a3ef28ebec7a", "comment": "Malware payload (Mirai)", "value": "6bb57a0867fb9d078d64652c814e15f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507891, "uuid": "a8282cee-e918-45f3-9edb-81e5e4b2a739", "comment": "Malware payload (Mirai)", "value": "8c9a145421a24e42f8e493fd3b29d804a50f4e5fcada419dd23bcb4ffa9cf451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507891, "uuid": "999517eb-4bd1-4d21-b839-19b368a5bf60", "comment": "Malware payload (Mirai)", "value": "bf13bbe584561057aff9b805e5e7ba8b25760781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507891, "uuid": "440f76e6-1a49-424c-ad43-9ea878c5bc4e", "comment": "Malware payload (Mirai)", "value": "4cd48309671dd99c71e2833e7838c803392b940992a343ac1d44caa4a0332c24f39988670aab0da02512fec5cac03d60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507891, "uuid": "f05de229-42d0-472b-a313-756eb6c7a724", "value": "T18F5309C0A257E4F4DD1982347273F33BAA71B035522ED9DBE3989B537C81B91CC4A299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507891, "uuid": "3a7d9f80-324c-45a9-8e7f-4d01ad6b04df", "value": "1536:wPXo3TnP1KWYdCLFaGFhu30ARV45ghbq6Nt+V2w2k:tbcWYdCLFaGFhu3/45g1jcV2wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768507891, "uuid": "96e20ce8-0078-43e1-84b7-0c383f744ec3", "value": 65832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768507891, "uuid": "7f211638-c235-4894-854a-b038ba599c57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507891, "uuid": "22787ee6-5a0a-4959-9635-6971dea4b342", "value": "systemx64.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068587f0-f232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495712, "uuid": "631622fc-eb5b-4e59-9023-a8dfc52bfcc6", "comment": "Malware payload (Mirai)", "value": "77443e315fc2362b0ffb8143aba490c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495712, "uuid": "c1650c68-1d7d-4e61-9324-8cfad91622a7", "comment": "Malware payload (Mirai)", "value": "8cfae29ea39fde8dd28f8616cf32eb2a2b6ba0e1ef43ee93b2e2c3bcef5b133e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495712, "uuid": "1ced059c-9b96-44fa-956e-b0c4e3ee716b", "comment": "Malware payload (Mirai)", "value": "92f891bc962b758ad3f878afceacfb2e56b7c179", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495712, "uuid": "5fc63fc0-7fde-40bb-b2d2-7622e7190eff", "comment": "Malware payload (Mirai)", "value": "735d43af7c38a913923b57d7c35c2ff2b0c47cdde6b8d1eddc00f32ed8326a37db5bcff6d1a610dfe142bf75d52f95b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495712, "uuid": "ac989f59-b1f8-4002-9a67-932b6503d609", "value": "T199B35BB3CC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495712, "uuid": "fb633d17-3b71-46de-a593-2a8e993cbc7f", "value": "1536:eTW/VCxsHZusl2Li62C8TOKDRpvfPV2AJo+WMDPW+zJG74:eytCxslx62NlDzV2p+W8PbUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495712, "uuid": "628cb3d8-ec27-49af-9bbb-595983043ebd", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495712, "uuid": "2e12a5f2-4242-458c-a251-274b2a17432b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495712, "uuid": "e8d07099-e3bb-48ca-a3c0-d934ec5877af", "value": "djmario.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a809d3-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1768463843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463843, "uuid": "dba130c3-5bc1-4185-940b-ab83a3c931a4", "comment": "Malware payload (PureLogsStealer)", "value": "0c5099c45e1b18e7ae072b9db5ac302e", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463843, "uuid": "796ee6be-e01e-46a9-bfad-92fe673cfbc0", "comment": "Malware payload (PureLogsStealer)", "value": "8e6c00c7c8e3624067e5a24cadb921e2f46ee7cd21f3521c80702327de7e4583", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463843, "uuid": "0b0c9662-ebfd-490e-ad1e-f5ecf789bd8f", "comment": "Malware payload (PureLogsStealer)", "value": "c2f31c6227bd97c2a33aeda955266e7183d275a7", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463843, "uuid": "23bb52cc-95da-4832-8e37-22ed723775ff", "comment": "Malware payload (PureLogsStealer)", "value": "5b0b80225b5b721e30f3845854ccc307565c7c9b86d91dfd4b1bf34cc5676571100bbf987d701a628d4fd2305c7c6898", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463843, "uuid": "5b2ea621-34a5-445d-b8dc-4924ee49854b", "value": "T146C2F72AC914AFF00B6F619AED072C56844083286B74390D79CE99EC2B75365CFD91EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463843, "uuid": "8122b685-0341-4b5c-b4dd-f40225b7b972", "value": "768:aADUHIZpE7BfFgwZ3lQg3XL6IvxAc4K6ICuG4NzK:a4KfFgwZ3lDnL6wxA57IP7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463843, "uuid": "c33e51c7-9e70-4e6e-a67f-8191be8fddd9", "value": 26876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463843, "uuid": "393cba2d-5b6d-4cfd-be18-8392f2b79c48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463843, "uuid": "f797e88b-a6fe-45ca-aca3-f60131debaf5", "value": "\u6574\u7bb1\u8d27 (FCL) \u62a5\u4ef7=Jin Shanghai Trading-1402026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc262f43-f250-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768508955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508955, "uuid": "7e24ce40-323b-43d0-92ff-2ef1274128a3", "comment": "Malware payload", "value": "35db43557a7bbd7538597ffb41d01f10", "object_relation": "md5", "Tag": [ { "name": "166-0-187-127", "colour": "#26F89A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508955, "uuid": "996a85a4-8226-49e2-b89b-76ae5df7615b", "comment": "Malware payload", "value": "8e95828610c4cdaa5a6bd9fdff475a5e6bef2c97c5c8ab86f56115e8f2c56035", "object_relation": "sha256", "Tag": [ { "name": "166-0-187-127", "colour": "#26F89A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508955, "uuid": "93d3c372-ddfd-4c20-9ff0-52d37bd56e6d", "comment": "Malware payload", "value": "615c7c46bd58b56e0d08939006b9ec597eca16de", "object_relation": "sha1", "Tag": [ { "name": "166-0-187-127", "colour": "#26F89A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508955, "uuid": "9702aa9b-929d-4874-935f-12811f9f4d43", "comment": "Malware payload", "value": "fc1d140aab0aa47bbd510d76563853ff46f1e25ef5d87082a5981ec3d5e5f6264fb3f5acc264ddc7e131d1fa6ed17f9b", "object_relation": "sha3-384", "Tag": [ { "name": "166-0-187-127", "colour": "#26F89A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508955, "uuid": "8d626ec5-74be-4bb4-830d-89fc8da45c26", "value": "T17245194B73468B61C3694732C5D7120C87F1A296B663EF0F7B4D13692AE23BA8D07257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508955, "uuid": "bb96a279-b3db-4c50-bb61-0e4988b40a74", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508955, "uuid": "29a1edfb-5da0-4eb2-8453-f559af22ab63", "value": "12288:hLlfV56qIheQPgsGpOESf9zvF+kjNmr1fUXOBKBXC6+3uBLiQbPrgRYfQk:hLhi9sQFGFM9zvyMXB1+34iergRYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768508955, "uuid": "7030dac1-3e1a-4a5c-9b2a-b98f670f341f", "value": 1273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768508955, "uuid": "58e1019f-9bc4-41ac-a4cd-e7ca2b47558b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508955, "uuid": "78a341fd-5648-475a-9e5d-cba4935e4ce4", "value": "payload_from_array1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a724555a-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1768463339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463339, "uuid": "e9d28619-4fbd-4c58-82fb-60f52006807b", "comment": "Malware payload (PureLogsStealer)", "value": "50067e6466e56404beb30cf6e6d6e67c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463339, "uuid": "31a62258-5087-4c9e-b315-e55850191588", "comment": "Malware payload (PureLogsStealer)", "value": "908dce36ede484572b3785fe39cb929ff72e913785bc4f1c89bf6f2a395d6ecc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463339, "uuid": "0c4041cc-601f-4597-b237-0b92828c76a9", "comment": "Malware payload (PureLogsStealer)", "value": "b83e08dd19ead05ccad63cd4dcb7cfd9608c92e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463339, "uuid": "2c2c1179-5026-4249-a034-705478f733af", "comment": "Malware payload (PureLogsStealer)", "value": "64049c92c728967c55ad0d7ed36b5160b6b75834cdb49a8cc7df2182c9fc88f1d410941812a79f56617672fae365cc70", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463339, "uuid": "3e7e26aa-ef95-436f-a557-b6d193d95ea5", "value": "T1427374DD7BE7F475139168337A2BB05AF22E4C80754C4191D29A6584FA38B08EF3BA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463339, "uuid": "226c57de-8519-4f2d-be4c-65effa2a7767", "value": "1536:e72aviADD8KXPZvFb2Fzf66NvgqgHaRmgsXnHjBvy5gTnHYbxrh:e724iAfhFbYcoR1sXDBvyUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463339, "uuid": "d2116dd9-1871-4016-995c-3875fca8e068", "value": 79936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463339, "uuid": "56b71651-9978-40b3-bcda-6754dc518e25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463339, "uuid": "3df3e0ef-0fae-4041-9d26-5aa0d09c8426", "value": "\u6c5f\u9634\u91d1\u901a--\u534e\u8fdbC2\u70bc\u6cb9\u91c7\u8d2d\u8ba2\u5355--2026-01-13-.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a04423-f1e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768461619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461619, "uuid": "bca9078b-bacd-47fb-9292-e4b0478e213b", "comment": "Malware payload", "value": "a7c2ba81781d8e1828ba2370cb7affcd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461619, "uuid": "586343d7-c60f-4eb3-95c4-0dd9bb853f34", "comment": "Malware payload", "value": "935c5c6a6be166c9173a5b3bbb6bf257d86bfa832ccd9bf36bcf2404e26855bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461619, "uuid": "9542990d-1b3b-4c01-a41c-f4b0bd53fd83", "comment": "Malware payload", "value": "c3b4b285b992362f6e6776c27cf803a4489ee994", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461619, "uuid": "f5e3fa77-c412-4078-8cff-1901d536ecde", "comment": "Malware payload", "value": "d6efe28504a4680108e9d4276f818c53ac14d88e2292f716a2cb3750d71392af0d416e10e824720a1456e3284ad71902", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461619, "uuid": "60c5e1e2-10c3-4301-9b8a-5e6220f22d94", "value": "T171149ECDB43C4547B5BD1D292FC3691C18DD049EC6BBBE12020A8B95899692CF4FFE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461619, "uuid": "bca14c9c-839e-40f5-b2a9-c39829b7c0cc", "value": "96:qGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGy:NhISVICM3Tegw8gO6iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461619, "uuid": "4518313c-7c93-41ce-b9e2-b247616d8b25", "value": 201976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461619, "uuid": "5af635c2-4e78-43e4-b5be-d8ac77c745c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461619, "uuid": "9b8e34db-63d6-46ae-99bb-04ce5b5f6b55", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ff44cc-f1d0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768453858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768453858, "uuid": "3308e4af-ae0d-4aab-8629-cdc6cf915af2", "comment": "Malware payload", "value": "79ddb58bd757774607b007a09ba1b664", "object_relation": "md5", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768453858, "uuid": "baa66009-3c2e-41ad-ba50-b46ec64bd7d2", "comment": "Malware payload", "value": "944be60b0fbcbf625b47a4ea8064100124d3c0430855da6ec051cd3d494d964b", "object_relation": "sha256", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768453858, "uuid": "ce7f54c3-5645-48f7-834a-4993f9491326", "comment": "Malware payload", "value": "3970148591dc727828eb1c459496a6e0f68dd5fd", "object_relation": "sha1", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768453858, "uuid": "011dea70-7b2d-4355-81ff-17fb4063a18a", "comment": "Malware payload", "value": "491bf42e6f934d327b166e995ef5e4d461c3273bf6d7b754da81f6fc4f1e642dd9a026363161082ebeb41aaf5679a5ab", "object_relation": "sha3-384", "Tag": [ { "name": "cobalt", "colour": "#7A82D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768453858, "uuid": "6bf998a9-9944-4f92-8e64-862d08ed7bc1", "value": "T1091523415EA48927CE1A8D721CBC54B0AEF645BE43502F5D07189ABCFC24B7BFC6A613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768453858, "uuid": "e5f2fad5-ceab-4627-bd3c-9b88ecd8f182", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768453858, "uuid": "9090442e-6dcd-451f-a0c5-c1c930c07404", "value": "24576:cPdu/mvtlSrSC31UPo0Fi0XjFlP+C7/nykVQ:EuMU/TFWjn2I+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768453858, "uuid": "1bc90a34-806b-4759-a2d6-4afdcc724cc5", "value": 885872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768453858, "uuid": "5e5a4e33-401a-448a-a000-b17c344057c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768453858, "uuid": "67e2ab46-7e83-4c65-b46a-3efa4f25d1b6", "value": "\u0418\u0437\u0434\u0435\u043b\u0438\u0435 170 \u0433\u0430\u0431\u0430\u0440\u0438\u0442\u043d\u044b\u0439 \u0447\u0435\u0440\u0442\u0435\u0436.PDF.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eced971-f213-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768482465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482465, "uuid": "3e5fccc4-0706-4c6d-b8ef-b6854e56a1c3", "comment": "Malware payload (Vidar)", "value": "2bd9fc7091daa5ed881f02009f8ddd7d", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482465, "uuid": "d528c5c8-b5ce-4530-ab3c-7e7cae559116", "comment": "Malware payload (Vidar)", "value": "945668be79484bd52964fb16f3e7d5aa0ed33694349ea1e3704fde35f3111a8b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482465, "uuid": "ef75a001-7940-4124-9434-7d5c4b45dd31", "comment": "Malware payload (Vidar)", "value": "f67efe9d055cfbbe147e3efa5112571a2037ac2d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482465, "uuid": "54ecc4cc-a4dc-491c-9c99-9cb18200e869", "comment": "Malware payload (Vidar)", "value": "eec909bbdf97350c7b41dbab7de3e58a012d05e311feeb82f2b4d029cf36d257d5df9ca49f10d2027eb5b27885f76f2a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482465, "uuid": "fc61cc60-012c-4658-907e-eab5deea50e0", "value": "T178A55B56ADE019EAF19A533288B66196B730FC060F312BD76B51B7792FB63C48C36704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482465, "uuid": "e4962eba-73df-4b22-a19a-7fda4f1c15e1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482465, "uuid": "877a83ce-c50f-4d84-9b0a-97eb7064d21e", "value": "24576:9vl6oP3xtlTcEjJkY8TAE54PvW5j/AHRAvdWGcGMUjeleN4j42CRDu:9tbPhtlAENkVBx5j/AmcBUvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768482465, "uuid": "331846e5-e8c9-46d0-99c7-e37ff32e15e0", "value": 2146816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768482465, "uuid": "75350dad-3082-42ec-8b7b-7d3fbb2d8597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482465, "uuid": "f948e8fa-42f3-4f6f-a53f-b56e1a71c770", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4c5aca-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435726, "uuid": "3cdc72fd-88f7-48b6-a78a-454ab93dccb0", "comment": "Malware payload (Mirai)", "value": "2e63f4bf922d3c880bd8fe964dddc66e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435726, "uuid": "2ac4570a-7b7c-48b3-af99-fa2ffc425c5e", "comment": "Malware payload (Mirai)", "value": "9551d007f16feaa1415db8c9d985c4cd5d2a541eaf6d6c28bac9ef61f2cc961a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435726, "uuid": "cd71fb1c-3a37-4b3d-b956-122989a134aa", "comment": "Malware payload (Mirai)", "value": "071dcb8b230a3417d22d5b90d46473525afab191", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435726, "uuid": "902c548b-f310-428b-9181-8027dccd3a3b", "comment": "Malware payload (Mirai)", "value": "28b670eac0dbb490fb60d7a3e8c86eecb4aab15df40199cb0626818174bd41fcf647f0c206ca27ff71230600f4ca93ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435726, "uuid": "ebd723d1-066b-4022-a1b7-6cfeb2d3de34", "value": "T1EFE33A55B8828A22C9D413BEF92D018E331367A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435726, "uuid": "5e226104-7cde-47c6-b777-20471929f577", "value": "3072:ShQVnQ899wekEChf1DAtKVklaHz97VVsdAsMwk9:lVn9wekjhfCKSlaNAdAUk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435726, "uuid": "52c5a208-8310-44c8-88da-7159016021f7", "value": 145552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435726, "uuid": "98171e28-adbd-4cc6-8373-dccd7d48733f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435726, "uuid": "745db1e2-dd21-4e0e-8436-a3691e7cf25a", "value": "systemx64.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b3f6ac-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768466134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466134, "uuid": "dfd11a10-448e-457a-8721-197396b46daf", "comment": "Malware payload (Formbook)", "value": "511fd5715c40af0ff904edb6a1d9c8cf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466134, "uuid": "b7b4e29e-acd7-4999-a195-704a18a226aa", "comment": "Malware payload (Formbook)", "value": "95d02b5db5c6ada40a762a79710a042e3fdcef9d8ea2c47e5e81e575a55d57a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466134, "uuid": "fcb422b6-5374-47e2-b98a-d991fc63f592", "comment": "Malware payload (Formbook)", "value": "8b223dd38c3a18fd85d90f437ebeb2850de3a09f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466134, "uuid": "3f693070-a719-4790-8334-2a855f66ae5d", "comment": "Malware payload (Formbook)", "value": "e85d287af920a52fa8d17d8bdb448bb56d36bc633cba2d7111ffcf9d2bc6c0267fda121fe9693764aaef58c70650f3f8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466134, "uuid": "d0c57828-a593-44a4-9203-f6c1b395e703", "value": "T1471523145EF75DED5938823AB5BF281E6BC186D1C0E9806AFBF874C3172EB5B4324990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466134, "uuid": "3a247681-b1d3-4456-a80a-01e2263c3382", "value": "24576:yxuY0MJZj+ejYzRMWihh1vqQQrygSZiLJ7ty:yxrz4mWiB8bxty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466134, "uuid": "2f3bd44c-9319-4c1b-bd17-97387e4290ed", "value": 935085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466134, "uuid": "21355997-6386-4231-b0fc-45d99afafcb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466134, "uuid": "5baf5c4f-4242-4821-9541-d94c2bee3719", "value": "KEN.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60145f25-f1e3-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1768461932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461932, "uuid": "fdb0bb8c-59c6-4e56-8587-80cd525d1e3d", "comment": "Malware payload (GuLoader)", "value": "4c38c00bac9748573318b1eadff47512", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461932, "uuid": "4948ac8c-f1d0-4c03-a019-cb80bf9f76df", "comment": "Malware payload (GuLoader)", "value": "9680c1423008df81ce373ddef9b2d3949d57a5f205543905812041ceca14d55b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461932, "uuid": "49d87044-00ab-4dec-a8fe-e4ead62cf0f1", "comment": "Malware payload (GuLoader)", "value": "d140879111cb817607b2b4c3d0991c7a41af16f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461932, "uuid": "5a1ad55c-0fe3-4c03-92ab-ed80067f623c", "comment": "Malware payload (GuLoader)", "value": "d774023b164246ed3ed2a7cbb41691965f5acbf176348482fc0bf721436125d82cdc429b73bcace28bc2aaaa1ebc6470", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461932, "uuid": "67da5b43-bed3-4d12-8b8f-e2afa3eec979", "value": "T160840236F626584FDA38EC705E532A7E67B42D60303392473B53F72BA8712A1470F25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461932, "uuid": "98e65e9a-cbbb-4128-9980-ea7c391093bd", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461932, "uuid": "07c6a851-1a79-455d-9615-ec4af544ad6b", "value": "6144:EDf4hQtprFevGVstgwTnvNxWIXSOqDC1zXEN5aOX4C/YKV:U4y7rUCzqFx1SxGIh4oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461932, "uuid": "d9374723-797f-467c-9944-8b2eef2cabe0", "value": 396808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461932, "uuid": "4a52e5a3-fa66-4dd6-8883-1898fe8d753c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461932, "uuid": "8e974f38-0737-4b56-90ed-7aac25220edb", "value": "DHL TELEX GUIA 1Z4815906897663406 Confirmaci\u00f3n de env\u00edo 1Z4815906897663406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b7ece1-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463476, "uuid": "21113464-29ef-4faf-8885-d76a396aaeaf", "comment": "Malware payload (Formbook)", "value": "10c9bb65ba5f0280538e243c01fc5c3d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463476, "uuid": "fb04015a-68b9-4c88-be9d-e286b124d69b", "comment": "Malware payload (Formbook)", "value": "97649f2de6703d6b849d42745d6ced47386dbea15ba89668c1aa376888629350", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463476, "uuid": "e35f217d-3fea-447f-a650-3052f45a9da0", "comment": "Malware payload (Formbook)", "value": "2dbd224076cde867595828e0ed5b6d54ed6f2159", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463476, "uuid": "85440f4c-5400-4121-b95e-5b9e4214e585", "comment": "Malware payload (Formbook)", "value": "f72b2fc3d1154d69e9fd3402329814076cec0e9263324530613b8af09350d4cb008c299a50fc889c379d669f5e46c150", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463476, "uuid": "95ea0a78-9d78-4157-959a-8f158d9eb29f", "value": "T14BA376883FC6F07193657433692FA0EEF27E0C91760C8196DAA760D4BE5CB18E2B595C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463476, "uuid": "e73f5c0c-7d27-483c-b33d-c2b2db368b98", "value": "3072:Ol6fPJptwTmqAz7vcHk2CzlZR4GRricgg54oRuyrrP9pn19e6msCLP/:o6fPJptwqqAzsk2CzlZR4GRricgg54o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463476, "uuid": "12fe3f9c-fc02-4a6a-8bf0-938138637118", "value": 101442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463476, "uuid": "76194572-22e7-42f0-860c-2f77dc3202f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463476, "uuid": "8b79116c-a44b-40dc-b34f-fb7a173046bd", "value": "MVCorewiseVesselSpecification.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440598d6-f1f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768467897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467897, "uuid": "ffae2948-6bc5-404a-b319-f2616480b245", "comment": "Malware payload (Formbook)", "value": "1e370ec4a8e47f075d7cce83cfe24449", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467897, "uuid": "ceb02060-3898-499a-834e-d4ae0244c5b8", "comment": "Malware payload (Formbook)", "value": "990f4fd84ce32890f866a99e5bea2a2d7f0aa64c40aacc28a4c359bff3dff636", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467897, "uuid": "3c31ec6a-8e73-41b9-a56b-91f700e2b454", "comment": "Malware payload (Formbook)", "value": "8a9d4a708845e4ae79fe1656b848ea784ddc38ee", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467897, "uuid": "841aaa4a-a55a-4649-8fea-4b26d29fd61c", "comment": "Malware payload (Formbook)", "value": "a0321a2bf3a82bb11628731cf7975150d30f9addeffde8c39d6c9e0596b50e5d26b7268904764a8c03a55999fb637f20", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467897, "uuid": "585a0fa1-0e57-4431-8ba0-7cf90d0e61c3", "value": "T10F653320BF6F38B805641374702BEAA99DC65EA3D88CAD5B7BEC01D13B1ABD54807D5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467897, "uuid": "42ac20a9-386f-40f1-89fe-130c81240eff", "value": "24576:H5G6rTJxSSLDFAOMZcX6/MOiEPlf34KVIJ/gLIJdSMszSpgTijGGZe3Pq:HjJwSLW/DezIgfuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768467897, "uuid": "8644926a-b4af-486c-b71f-9a029d6f4921", "value": 1418867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768467897, "uuid": "0c92655c-7787-4e43-b502-a94bc738ca63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467897, "uuid": "9345dcfd-6d1a-46e3-9289-d5f665bda455", "value": "357u7r.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe95fe7-f200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474655, "uuid": "84a1ad10-2454-4201-a477-2c8682616046", "comment": "Malware payload (Mirai)", "value": "a9e5418c3c1f9855a109121caa221c67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474655, "uuid": "2b0b2833-16d7-4ea1-a114-5f6c4d949897", "comment": "Malware payload (Mirai)", "value": "99e33c5f3bcc871734d738567c607b66dec14bf482805ceb10921a531da881e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474655, "uuid": "e60c7bcb-3187-4813-83fc-e515e4fdae0c", "comment": "Malware payload (Mirai)", "value": "8c430b27e9207a7de64b936d297e5fe25f7d76c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474655, "uuid": "43f08ea4-c2ed-400f-9327-a296706587eb", "comment": "Malware payload (Mirai)", "value": "9e10e924a08b1c98384fc4a159b956555d94eee40234028951df5be13af2ed609a15933672343adcd7f85a42c45a5294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474655, "uuid": "33f72d1f-dc55-45ff-9f7c-08eab420ea49", "value": "T1B4E34D56EA818E13C4D527BAB9AF01893332A75493DB730689185FB43FC6B6F0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474655, "uuid": "c9eb424b-cc05-429f-8d3c-acada665315e", "value": "3072:cgxYi2gojQeTWKrsRdx4KDuw/2yCmkdG7u+bn52xK1tXnu/IM/9dhqh:XxYi2gojvTWK4R4K50G7u+bn0xUXnIIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474655, "uuid": "5ad0b388-4379-40d0-b8de-d550457a2f1c", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474655, "uuid": "c7ca05d1-9a55-4b50-9262-7b87e7524ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474655, "uuid": "8f2dc1b8-28b2-4772-acd0-ec3f64fd9648", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be12120d-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768463807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463807, "uuid": "4b2407e6-0b4a-45e1-8dd5-ff4b8a47d047", "comment": "Malware payload (RemcosRAT)", "value": "f63b39486caad90dee959ae625b47414", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463807, "uuid": "b68ef002-2188-4dfe-b6a9-63b2dd0e8735", "comment": "Malware payload (RemcosRAT)", "value": "9a0b0c82b59b94ed13551ddc8c79fa368db4db052c90cdfbc9aa38bf8df3bff4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463807, "uuid": "acca7ac4-71e8-454a-b3d4-a94c05c83a4c", "comment": "Malware payload (RemcosRAT)", "value": "560c02335c824c6dbd2f9e88f8de8c2474317d58", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463807, "uuid": "61788aae-9f88-4a88-bc2d-3e403d8cabd6", "comment": "Malware payload (RemcosRAT)", "value": "31a373b9904b3c64f8e091d127d6a615d2eea01891e1414d77532a10d8c59fe86e469c68eb1e7a03c46b140da00d52b3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463807, "uuid": "6c0e6396-c7a5-4cbc-93e0-2522527c738e", "value": "T19945A8A6ADB02941BB58B5F0043FDEF4ED2729BF328E575987E10CF0875A824CA53476", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463807, "uuid": "73971090-3807-49e7-b3ee-c08ae8a28477", "value": "3072:u4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4g4gu:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463807, "uuid": "9673393a-7723-4384-b378-4967b4525164", "value": 1266026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463807, "uuid": "2a68bef7-0224-473e-a946-ec993fc83297", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463807, "uuid": "4279d51f-721e-48e6-bca0-0eda35784aac", "value": "Purchase Order-PO917723.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca7eafb-f206-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1768477092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477092, "uuid": "e2d4dc99-7046-43b2-8a34-885f90c0cb82", "comment": "Malware payload (ACRStealer)", "value": "f65f2a1df9bcf4847418b3533a0b653c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477092, "uuid": "c321f368-4cd0-4f20-9f6a-68d537ebaecf", "comment": "Malware payload (ACRStealer)", "value": "9a5d26e1b3a7ecfbf3e7b75a1c237188d6b052087ae6f0e96b804efe2e370561", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477092, "uuid": "fa189c7a-1a4d-4ac7-9013-ddb86143ae82", "comment": "Malware payload (ACRStealer)", "value": "a5afe7db19c7161013dcd85f4f14fdf8f60c2077", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768477092, "uuid": "0dd7018f-5767-4a4e-9cb0-a9f29361273c", "comment": "Malware payload (ACRStealer)", "value": "2bae6335bc3e8d736055b85353e811a9b530beea6f7452b2649ce88b0c6d551aee6ed9bea0ce0df92d2e83d90a3e0606", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477092, "uuid": "7e2c9ae4-f349-4abf-abc1-9f9dd037c1b8", "value": "T144B68C03E7CA8675E0AE26B09CBB6369A736BC505BF483C757903E1AAC713C16C71356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477092, "uuid": "4f670200-e0f7-4628-91f7-e453657dd7aa", "value": "01efa7c152d1df494eec507ea9d80f33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477092, "uuid": "dbe5ce15-fc0e-41cb-b9bb-29dcb3973970", "value": "98304:mK5Hm4IcJgE7gIqEFwqP3L1HEGVv67mjzlmR0FiEvEfKlNr6Vuld1:t5HmegEbFwI3hHEGVIczkSBEfEN6qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768477092, "uuid": "f8096db4-e891-4c36-8e35-9ea1821830c6", "value": 11186704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768477092, "uuid": "b3da0096-34fc-4e93-ac59-50ce80f03232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768477092, "uuid": "2e0af5f0-4c00-4a6b-be24-b83b29a33281", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c45f94-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463228, "uuid": "efdc4771-243c-4779-889e-e758be72bac2", "comment": "Malware payload (AgentTesla)", "value": "dab6cd6043cc3c976c8b20ece11b0e72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463228, "uuid": "bdaa6473-7224-469e-a050-786bf7b22636", "comment": "Malware payload (AgentTesla)", "value": "9b2246cc7f229e226b711043e9b86382e6924f2a9671ad7a8ade969ce49646e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463228, "uuid": "1a78abc9-6ed4-4d04-a6b6-bac2f4e6e098", "comment": "Malware payload (AgentTesla)", "value": "74d9d094707afc17be3381dcf8bfe7e2ad0eaf3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463228, "uuid": "87596082-6fb2-4316-86b1-709b2136ff08", "comment": "Malware payload (AgentTesla)", "value": "4ba0c4a230bc264ea06f467b98b4f0d2a95e7da926e8a083dcf402f7055d3f0d47132e408bbdcd0639d2fb9e20e62a2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463228, "uuid": "e623ad05-a93a-4701-8314-509a28ffad80", "value": "T1C97374DD7BE7F475139168337A2BB05AF22E4C80754C4191D29A6585FA38B08EF3BA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463228, "uuid": "e183ad14-c8d6-42c3-afa7-e1da9a914f6d", "value": "1536:e72aviADD8KXPZvFb2Fzf66NvgqgHaRmgsXnHjBvy5gTnHvbxrh:e724iAfhFbYcoR1sXDBvyUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463228, "uuid": "20a6f5e9-a3fb-4310-b682-a7c8a9799c93", "value": 79938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463228, "uuid": "7d6995fc-7439-4ca5-a2fc-04358b636991", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463228, "uuid": "d004977d-c37f-48e1-8d22-af9060f747c3", "value": "Purchase Order PO-#20250949.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79818cd2-f22e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768494186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768494186, "uuid": "9ed8dfb2-cca1-4b9d-b3eb-127c89a0943c", "comment": "Malware payload", "value": "7fbca6b3634d3cf57195606526e27b46", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768494186, "uuid": "5fa2484a-9f9e-4e2d-b688-53f70d7b1661", "comment": "Malware payload", "value": "9b2a630e6d367fb9d1fe122c6dbc3859c65bde3e2a2a6be653a23d364911f1fa", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768494186, "uuid": "da4b6e0a-963d-41f0-b343-e7078e51cea0", "comment": "Malware payload", "value": "da5bb7118fad2cb3cd67510acb5ea9b71ae473c3", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768494186, "uuid": "9cea706a-9517-4065-b68d-b635fd4631bb", "comment": "Malware payload", "value": "64966e105a221d4f04c8b014fcc6460804bdadea0ef47a19fa9b623c59959c7bcbf88b3df91fd3ecc3e32b2f8087b552", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768494186, "uuid": "7bb94c8c-9e3a-4c13-a481-9a26b7aec0c0", "value": "T1E4B53382BBE1CDB8F6C211361545B5A12ADDF2B01FC049CF6B5C06055BB1AE4CAFA39D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768494186, "uuid": "3cfe032e-c497-4212-b0a1-4d7a673692f8", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768494186, "uuid": "566747c2-839f-49f8-a592-a31f200a81d7", "value": "49152:IgwR4njORGEqBKfI18DXc5WDAky+AKkw0QOfat9OojItG:IgwR4nB/HCDIWDRYKkdQOu9QtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768494186, "uuid": "31fabd6b-026f-4915-9af2-abf59ba3bdc2", "value": 2342266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768494186, "uuid": "89f3d425-8eb6-48d1-9143-1b8976af43b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768494186, "uuid": "68040f20-04f7-4ad0-aac9-a17d6f592a7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e902673e-f1b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768443263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768443263, "uuid": "f91a9c21-e7c8-420b-9a41-407f17eab035", "comment": "Malware payload (Mirai)", "value": "c826a8799a259944ece9cfca40db71a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768443263, "uuid": "76e9061e-aca6-43fe-bc6a-25f73915fdd9", "comment": "Malware payload (Mirai)", "value": "9be519da66cb95b5d74388860437a98240957d347b6da9c1ce01c37209d64f26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768443263, "uuid": "2c20a804-b438-4562-b89e-0cbf2a1e978f", "comment": "Malware payload (Mirai)", "value": "b8d3cad98429dc196bea808fe9a16764c7e35a8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768443263, "uuid": "22ff1f76-a00b-4fe3-9992-e0ef364f228f", "comment": "Malware payload (Mirai)", "value": "ecbf1603c7f7d62885a04854d31fda0addfff2a8602837f5d636d9f66e5dd9f6c06a317578ec4c0af3b58fd86505d37c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768443263, "uuid": "997ab5c9-5b57-45b5-b7fd-74e51bb0992f", "value": "T145248585BFA03FFFD81ECD370295AA05169C6A0A52D8BF762B34D504B68B14A5DC3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768443263, "uuid": "27f7c7d3-a2e0-4523-b0fa-34a6601f5f6b", "value": "1536:NtzBnYPEKvBUwjVE3HdaqKGr9FCEY9dr+hKmkB1deXGI9bDrM5j40DA3VpqBzG9B:5npKvTQ9aqSEu0hK5cmjJUpqBzGyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768443263, "uuid": "391870da-068c-4300-8c25-0992e6ad3300", "value": 227944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768443263, "uuid": "929b7eee-2bc2-48c6-b1f2-1df19e6ce054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768443263, "uuid": "c0455341-3e7c-40d4-9117-e3d3438506bb", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90b1024-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463799, "uuid": "2dbe96a5-989a-44f1-87cc-a7de3b3822c5", "comment": "Malware payload (Formbook)", "value": "58e2d0128ec97219b12ab5dd18d68977", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463799, "uuid": "cf667a29-ff9e-4885-9d6b-72fdd9ed07bf", "comment": "Malware payload (Formbook)", "value": "9bf9bbcff46c3dfbce9183885fc6040251d1433a83d0a902e3026c6610a17edc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463799, "uuid": "bacfea96-207d-46e5-9f17-c2d30c7de9b5", "comment": "Malware payload (Formbook)", "value": "886c6e249849feaef05f8d76fe566fdd1433f60a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463799, "uuid": "2cc5b9f9-7062-4e19-b2c3-9c1aa93024c3", "comment": "Malware payload (Formbook)", "value": "f1881900145d3ce97b5a0b4163359cdf92c34971b1ec2859ca85e4edc62361d2a1aee54540dac3db6ec1755075aa3cda", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463799, "uuid": "7bef6672-6a81-49c2-9013-4282464f0365", "value": "T1A3A376883FC6F07193657433692FA0EEF27E0C91760C8196DAA760D4BE5CB18E2B595C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463799, "uuid": "999fdced-e739-44d6-b02b-485797cc8cd3", "value": "3072:OW6fPJptwTmqAz7vcHk2CzlZR4GRricgg54oRuyrrP9pn19e6msCLP/:h6fPJptwqqAzsk2CzlZR4GRricgg54o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463799, "uuid": "10ddbec0-8a68-4d6e-8e61-086a8ba85dc4", "value": 101453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463799, "uuid": "2c3f96d0-202c-4e4e-9d44-7e5c877ec98e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463799, "uuid": "c0d68b2b-b05d-4ce1-80dc-bf2f94168120", "value": "VESSEL INFORMATION SPEC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d79ddd0-f1ae-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1768439110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768439110, "uuid": "959ec2a0-26af-44cf-ad04-d2da2a94c063", "comment": "Malware payload (RedLineStealer)", "value": "4af5a50bf18ca67d6ddfa8d8b670292b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768439110, "uuid": "6e30c14c-4893-43b2-90d5-de69515156a1", "comment": "Malware payload (RedLineStealer)", "value": "9d8ea383d735302930a2ba10ca17dd9ffe87f1b1ae0968777900ebe4a9ec6e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768439110, "uuid": "ea0e8b1e-f158-41b6-b9e2-9948454a2a20", "comment": "Malware payload (RedLineStealer)", "value": "4ae62923ebe646be41cddfafa4b1b9f42f9ae393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768439110, "uuid": "a1823ad9-a1a5-470a-a8a7-2c0726185cfb", "comment": "Malware payload (RedLineStealer)", "value": "62e339bf155fb7673f31ef90fbc5c8f782f8e85714cdc3504b03dd8bec5af8eaa909e7eb8bfaa2d770e69ba3943c264d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768439110, "uuid": "0cfe869a-d9fc-41da-85a4-a4ea0cc7a9ce", "value": "T1BDB4F158135AC902C8921FF50972E3F80F784FD9E962D313DFEA7DEBB93A9541880259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768439110, "uuid": "7e6ae3d6-5e77-41cf-a953-97b9beff693f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768439110, "uuid": "692a1bd0-97c9-4895-9493-73e0d65996d2", "value": "12288:dVITn6LpSDPBNa7eXayTzP3NbMOXbEOx:y6LpSBFTnXbEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768439110, "uuid": "59b65cac-2f9d-44f5-a9a6-4dd9f2ad0e40", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768439110, "uuid": "7f75473d-3e3c-47a5-9954-2892cd1a5963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768439110, "uuid": "caf4300b-bcd8-4d81-9a3d-40fe073e5fc5", "value": "4AF5A50BF18CA67D6DDFA8D8B670292B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7afe76-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463830, "uuid": "c67af5e6-c673-4fab-9e46-1e36d88b7e87", "comment": "Malware payload (AgentTesla)", "value": "36fd814949f8d282d29c156b6c178515", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463830, "uuid": "4dca921e-981c-4dca-a5a1-2eb70f5cbc61", "comment": "Malware payload (AgentTesla)", "value": "9e54fdaa81f24b388c0b4e7defc9fb0f2d1bcaf2bab5b806e879e1ac9d19deaf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463830, "uuid": "d95197dc-1e0c-40bd-bc20-21b5132d4eed", "comment": "Malware payload (AgentTesla)", "value": "463939bdec1e3cae9b169c4596a73d362ff36bff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463830, "uuid": "920d8946-8575-4583-a2c1-8e0e00b924a0", "comment": "Malware payload (AgentTesla)", "value": "cee6ad67448158a8d0fe2d6036e1dc8bbf192136b35657f4c2292f1d53a07ab88b0c4e91a5fd4c8ab32e764e8657e4cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463830, "uuid": "25439533-8a99-4d6c-9e7a-8990a1f4941c", "value": "T12AD410770C75B9E443BA643B76D41E15A2B264E2AC03056DDF6C34E3B64FE2D2AC8D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463830, "uuid": "44679af9-5f03-4e54-9c58-62a224454d09", "value": "384:1VT5VxSi2kRdSNLDq09P6Rc6160hsUsUm7r:n5LfzdSxR9P6Rc616SnsB7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463830, "uuid": "4f6f97e3-0053-4ab8-bce5-c780a64ccbf4", "value": 641578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463830, "uuid": "762fb43c-616b-4b5c-a4b3-464497516248", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463830, "uuid": "90c5e288-5e01-4f5e-9648-74c7bcd5ca2f", "value": "Purchase Order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa27154-f1d2-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768454675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768454675, "uuid": "4b128978-02aa-48c8-875c-066b33061ea4", "comment": "Malware payload (RemcosRAT)", "value": "fb61770fd19d3b1b919dfa88be6032f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768454675, "uuid": "c8d52481-4282-4ecc-bf13-c96bcdbe24bd", "comment": "Malware payload (RemcosRAT)", "value": "9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768454675, "uuid": "61c2eb69-c95c-4aef-85c8-ae260e00c517", "comment": "Malware payload (RemcosRAT)", "value": "a3617d7706d07c7c80e90d4bea5b314aa803ff99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768454675, "uuid": "c2ace150-0199-4a75-8942-65a48d3016a1", "comment": "Malware payload (RemcosRAT)", "value": "c885443c828a1f57040b95e19d2382fec58b9069aedd0cd2ae0a93424b5ca85fbd0bfaa47a3a5b26c50d7845c189d7f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768454675, "uuid": "7cb5a2a6-5f25-4690-b40b-b8561811c8f7", "value": "T1D8A4BF02BAC1C072D57161344D3AE725DEB8BD20283595BB73E62D5AEE701D0A73E7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768454675, "uuid": "04d9868d-9d61-44e0-97c7-bb99849a690f", "value": "69f1ad4b864e2aa9e4d714b7029c7229", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768454675, "uuid": "a103bf59-2776-4cf4-9f1c-9c2aefeb32c3", "value": "12288:Rmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQAt5E:viLJbpI7I2WhQqZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768454675, "uuid": "16581ea9-40e0-423c-b0c0-27579ec9a70d", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768454675, "uuid": "e5833295-01fa-4ce6-b039-c5399f79635c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768454675, "uuid": "b47efcaa-8ee2-4250-833f-f1446bbdf46d", "value": "w.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118a1383-f1b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768442902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768442902, "uuid": "6cf4d230-582c-4928-b0af-670ef84cc65f", "comment": "Malware payload (Mirai)", "value": "8c480143fe4423dfbb8f1a05728e63d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768442902, "uuid": "ed37051c-6383-4fc5-bc9a-d5786a593477", "comment": "Malware payload (Mirai)", "value": "a237dd386bf93f8cc5e262fd169c5a7a6d29268c80a9ed820d44bfdc496ba155", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768442902, "uuid": "8dac7a8d-377b-4786-9068-d4affdc45a38", "comment": "Malware payload (Mirai)", "value": "2dc5963d573bdf2546ffefd5cf1d59db9f337546", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768442902, "uuid": "08da4c95-f35b-4d01-bbbb-012b6437f185", "comment": "Malware payload (Mirai)", "value": "5efccebeb6419fa17b98af3e4b6f7c3c80af41d6a530a92528b8c8cd628a8e94628d291e916f3a301405a4d79507dd27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768442902, "uuid": "a09f1581-23bb-478e-9a1c-ef63a6de277a", "value": "T189C38DE0768E3D91E3CBD37DCE447AA2712B74F0C2E592F0BD12122DC5DADAA89E0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768442902, "uuid": "94cd7bb9-3243-42ff-b680-d77d09e613de", "value": "3072:3Yi5FRXSuqLm7SD8SEbvxr19KzpQlWeHFG:3rFRXD5lbx19s+4eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768442902, "uuid": "e515dc2c-f294-4a07-a055-5b0ed17cdd34", "value": 124792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768442902, "uuid": "c902bd86-1b6e-4f8c-a6f7-1dab5b6cb545", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768442902, "uuid": "f743d389-14ff-49d4-9fb6-bced6a7560c8", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612ba870-f1f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768469664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469664, "uuid": "8ef73bdd-ec73-4879-877b-329f2be91d5f", "comment": "Malware payload", "value": "476cfc9c44392c8b64e08631fd4ca5a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469664, "uuid": "d192e31c-c237-49ca-9fcb-a1d719973f6b", "comment": "Malware payload", "value": "a3435ea464c62ffcd1463fd4ebbe18449d5cd20edbe81243812d48a0498a5345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469664, "uuid": "9cd05beb-d210-4c56-93a3-eebc8b01c395", "comment": "Malware payload", "value": "4357aec4d803919fcd403cba14221992c4f9bad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469664, "uuid": "d8392e1d-53d1-49c6-9427-3b9bbc7172c5", "comment": "Malware payload", "value": "fd24b4930d8823c969044a6d3330ef9639e06b6975e559ac2418125b65f030483b3ed8bb1219ba43702927e92edc0610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469664, "uuid": "6df48951-1d3c-4deb-8322-3e20c95acf16", "value": "T15504F146FDA10FDBC85FCE70525F021729EC49DD82A2A32F227CC888B5996199AD7D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469664, "uuid": "fe61fb70-5069-40bb-8899-e4377fbd85ca", "value": "3072:oDTIzc663gm8r+GAQQ9QqTt4P5Oa8/Ji5Kgqvrx+m5yLfTdv6nCAkwJs:rzR63rw+GFQx4BOa8/w5/08DT4Vxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469664, "uuid": "e0194a1f-d1f5-44a0-a798-9f007a213f81", "value": 179711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469664, "uuid": "f267fac5-ec91-4d11-a9cb-54e5917398d4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469664, "uuid": "0a2632ec-04f4-4f8d-be15-282f924ee318", "value": "kl2w669hoa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca1d3f0-f1ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768444343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444343, "uuid": "ec7b2d47-3c42-4e12-9d3e-2f1c771ae8a2", "comment": "Malware payload (Mirai)", "value": "87b700ca138d39ce95abc6a5053cd039", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444343, "uuid": "95f37124-131f-4946-9d26-9dbc6f441078", "comment": "Malware payload (Mirai)", "value": "a3c6896c569118bc40fd12db9516c8a2dd60690a4e5d1eddce11b792b254e6bc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444343, "uuid": "1a8bc29a-bf32-419f-9a2f-3562352be46d", "comment": "Malware payload (Mirai)", "value": "e33c1a89a3575eee082440d1a866002d51475cac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768444343, "uuid": "5a8191d1-3ae4-4940-973a-43e042f0fbd3", "comment": "Malware payload (Mirai)", "value": "1d0f690e6be06ba6244c76e116786da5c1f5dc4acd7cc484857e5ac50053f254377d273e4acaa594469bd32e70ace0a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444343, "uuid": "0e58d623-a792-4e35-8ffd-3fc8e185381e", "value": "T17511AF8277356CB12DCD812D72AB989D6042023F561B7F98749B98B71F1C580F094FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444343, "uuid": "aaf0271b-6bdc-40ca-a147-0d7c263d83ab", "value": "24:VUeYj+H1wDMK9CFdYhEnHQBYw9I5xqARWy3AnQZaZl1cSRs/:VUeYj+H1wDMK9CnYhEYwquWywOjSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768444343, "uuid": "1ed91122-b6d6-47d5-81a4-1fb3524ef8a2", "value": 993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768444343, "uuid": "b8958c5c-5fb2-49fd-ae49-8956de3606a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768444343, "uuid": "6d4f27ec-e138-405b-8948-a7f960794776", "value": "check1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e266fe-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463126, "uuid": "041de065-2821-4e27-95d3-4f59791765b9", "comment": "Malware payload (AgentTesla)", "value": "253be1e44bdf088cd70b8907a67658f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463126, "uuid": "eb3539bd-ea8d-4420-b6d1-f93739632d62", "comment": "Malware payload (AgentTesla)", "value": "a45e46e0ecddccbd1ca3bfa4b9b993a0030f576a62cc4061e3a65371e302cf63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463126, "uuid": "219fe8f2-c2fe-4206-b078-7f06eeb0ef2d", "comment": "Malware payload (AgentTesla)", "value": "2b8d04e71e8cb509211d17a7087edfa8fc397993", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463126, "uuid": "237e0093-85c9-44ea-abd5-c7a4bef334ec", "comment": "Malware payload (AgentTesla)", "value": "2be439328c2b77ca30729e5a66a3fdf36f14252b3179a5ea56b030e615330e271fc6bf1cd198448428f1eb36f7d1fb5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463126, "uuid": "4f4f09e0-08f6-474f-8965-320d066bdac9", "value": "T172934A60DD1D01B70FC36B98BCA90660C66C8315853354A1F9EE870DA60A9FCF7797AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463126, "uuid": "12cc3cae-1932-42d8-b804-0dad25e8a47b", "value": "1536:XvhskF8sT+LLMyNqlaWfYcXafbionRrYZXkkZ265gaROep:/hsW8sTwL/AaWZafGOR0Z0I20gaRNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463126, "uuid": "b4b78008-738b-4872-8f64-383dc5b40b19", "value": 94210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463126, "uuid": "9c2c925a-7411-4f50-b9d9-05ec2296ff41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463126, "uuid": "d58a4166-4886-442a-9e16-9355c50f45a5", "value": "2026-01-13-0171.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68c457a-f239-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768499094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499094, "uuid": "e59c7d7c-9848-4459-b3d2-9d32a3c67bf0", "comment": "Malware payload", "value": "3cecb6a445ac740bd464cb3ee319e7e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499094, "uuid": "df1d7a0f-b38c-4a05-b333-37652b40e906", "comment": "Malware payload", "value": "a53ef8240fc2260ea62ef6a426c04e6333d96517d4d2f91492ab6de81a9eeee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499094, "uuid": "44b81fcb-f1ee-42a4-8d34-b5535ea9b198", "comment": "Malware payload", "value": "688a2ff8ba294074f49e23f63aac32bc4e901f8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499094, "uuid": "f4db6eaa-3349-483c-b6f0-c4054aa7e015", "comment": "Malware payload", "value": "338ff3a699160cd81309c358bc3127bf63217d6b0db0db6aebf2ba04ada8d0b020bc40d2b949eff6c006ec4c35bb1636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499094, "uuid": "79a723c1-2802-4db7-ad53-3c9ec623e521", "value": "T1FCB4492E71F48B6FD07AC17689924B639532787C073681FF1380C2A5DF95AD0AB3AB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499094, "uuid": "46c5e9cc-1157-4338-aabe-4275d92f6927", "value": "1cbae310ee78602a6e6491b2e8f2ebc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499094, "uuid": "65e31997-fc07-4c70-9528-b12f317fa65c", "value": "6144:zkj2XIRmj13uBUwU48quXeRlnMWejKKp0JQIyn4dugWZf6qqDLu4blXA41RD+x2:zaRmgay9sKKkQl4uXqnuiS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768499094, "uuid": "6fe567e7-82f8-4cb3-86c3-2b1ae787df1a", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768499094, "uuid": "cf9060f1-cf69-4135-94c3-52e816eb5d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499094, "uuid": "1da61a6b-5a83-4ed2-b99a-d334bc3f78ca", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9b543d-f261-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1768516015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516015, "uuid": "e3205ed3-18fa-4dea-b249-b5b8c08e9cbb", "comment": "Malware payload (Socks5Systemz)", "value": "0561103faba43b7810b70135ea19b28a", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516015, "uuid": "c7115c90-5ccd-4ac0-8735-6f1aeeb2a6ac", "comment": "Malware payload (Socks5Systemz)", "value": "a60f9adec4ee904b9a1fac5a9dee0eb0c2a9af4db3e6471c7599cedf29590aee", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516015, "uuid": "222c9332-c674-4667-ad1e-2fc0ef88d3e7", "comment": "Malware payload (Socks5Systemz)", "value": "41bcbe3bf3fed780bf5ab23600d81768c968ff08", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516015, "uuid": "c97be5ea-900d-4b63-afc0-f82366f9de85", "comment": "Malware payload (Socks5Systemz)", "value": "dafc90b7b189a4d6cc3f35d278f2bb106ccb188445ac631298a40ccf5fbd54bcb2523b4837c303cc0f6a2b898544d4fc", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516015, "uuid": "506a239f-0895-41b3-a7c4-2d9633a11527", "value": "T1FEF53383E0EE85F9E8B7DA7014C548E0F17FBF6BBA21D568E0C90B8B314669561053B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516015, "uuid": "aa06ebd5-640d-4dc1-86e3-ea5781d64995", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516015, "uuid": "b2446011-c172-447a-891b-351d8906cb79", "value": "98304:Mcxz+HBgX80rxcVqgVLGaGj6lYVf44splubUO7fazBElA:dxKmX8Cx4qAL3Gj6SV/2EpCNGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768516015, "uuid": "1a1d33ce-eef4-4027-a773-f6579fed002b", "value": 3551287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768516015, "uuid": "7e6f0ed0-ae9d-4111-a695-89be77c3612a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516015, "uuid": "4f7e3c5d-0374-486e-bdfc-79d81affa207", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7d5ee3-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1768463835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463835, "uuid": "c3ef60e9-fae2-439e-92a5-98a1b812ff75", "comment": "Malware payload (XWorm)", "value": "a8bfc39c97a943dff1773fa16c8c7829", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463835, "uuid": "ee378754-792a-4d53-96d3-dd0ebb5f51a5", "comment": "Malware payload (XWorm)", "value": "a65762b80a0786fc118a3ac10cc3d3cad0b3772694e85945ef03d8adf8fefc8b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463835, "uuid": "f401b455-bd19-4156-94ca-33e7405df7d3", "comment": "Malware payload (XWorm)", "value": "7e78ca38c75a2767afc11475eedc887835e76da7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463835, "uuid": "9f08a7c1-61ed-4f8b-8708-29488116974a", "comment": "Malware payload (XWorm)", "value": "9a0f8510f9b8d78248e709b2307728396b77dc770b54ba18a6ffb2d0585d719206867c76287b0fc46e80f7255553eb67", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463835, "uuid": "b037adab-3c0c-4df3-8871-38b6bbffb4cf", "value": "T1DC65746163B0B4456B820BDD9177E26A7F29777F68C63E50B78E346B4A87C867331830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463835, "uuid": "c19a5df7-6fa3-449c-ad6f-266fdc653860", "value": "768:BuxoTNIDAIsLZBRR7TygKWl1uDBwQDuxoT76H2uKvHSgK7iTSYeMmaHjU0nKSMuA:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463835, "uuid": "2429642d-14e3-482a-8e9c-86511a6e41f8", "value": 1469821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463835, "uuid": "c04a8611-8126-45da-adf3-ad7c05939312", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463835, "uuid": "2fb23b58-31e8-4de0-a85b-49914dfc13d3", "value": "Samples and order list_986757x.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba6d75f-f1cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768451536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451536, "uuid": "fa8aa2b9-6970-4125-919b-378eff229b35", "comment": "Malware payload (Mirai)", "value": "8b10864bc98cf58eb2e640753acfd4ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451536, "uuid": "8a20e783-603b-46f7-9d2e-4ace4c5c1652", "comment": "Malware payload (Mirai)", "value": "a7cafa72a972325d0c6322d2b143e89f2afd612436667001c45a41efd62c58e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451536, "uuid": "519cb3ac-38a5-4445-b319-0782a36cb967", "comment": "Malware payload (Mirai)", "value": "5d9eb7f8089c9c0c6935c9d44edff686c58b380c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451536, "uuid": "e04a5f91-8a33-4a73-b836-254acafff053", "comment": "Malware payload (Mirai)", "value": "b84bd4f1c82d2bf5f5a348128eed7730711691913828b5b83eb5c04937d732665ce40d415f76f5ccb0d53be2841bc25f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451536, "uuid": "5c8c0122-6dcc-4511-b29c-fd982e1b7d24", "value": "T15741271A1F901F23DDA7CC35469B1B513ACC942F616A23916234ECA0BD2E645E7D38BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451536, "uuid": "aebdd505-366d-4547-8d1b-7f7a0ab8aa4d", "value": "48:NBPQ2UInuDW3B6df9ce+SMTLWPkeTDjLUUUi9XT:NBPQYnuqYf9cjSoLW7TDDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768451536, "uuid": "2ec402e2-6b0b-4f27-81e7-d7658714937b", "value": 2152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768451536, "uuid": "9039d92e-b63f-47c4-92a8-cf6cac79c2c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451536, "uuid": "9dae2e30-42a4-4872-98b7-9928c3db5681", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e2690a-f255-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768511031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511031, "uuid": "e22d8833-7b08-4e88-a30f-fb334e4089b0", "comment": "Malware payload (Mirai)", "value": "670a47281bc026f7a7705b31a79b3575", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511031, "uuid": "6b622c1b-ccd3-49d3-976f-db68d38ca1b3", "comment": "Malware payload (Mirai)", "value": "a7fcd4f5b1ac4bb19f454d172cb2b6b5c631d77a665c88b2dbd3272eaf8d84e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511031, "uuid": "de8705e8-4a28-40c1-a70c-cebd1b227654", "comment": "Malware payload (Mirai)", "value": "de81d6bbe9feea7266c5e8a950183b632f013c11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511031, "uuid": "33622bc1-aeaa-4dc7-bd8f-1c1b71c6a602", "comment": "Malware payload (Mirai)", "value": "a9f7b4ce88b98d75f421f9c1a02f4f316a2c96ef82b61e2ad52b05f31eca776fed17167b85624f36f60b3a3eaab910ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511031, "uuid": "2b99f7b9-7fca-460e-aae6-0b50e2d672d5", "value": "T18B230271890A9EF124303C76EA99939375E12AB1C6673013D62D0B3C6FA57131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511031, "uuid": "8a448717-3160-495c-9674-456949cfc767", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3V8yGB9q3UELbUXfi6nVMQHI4vcGpvD:DECFd+A6YHAxVE0LRQZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768511031, "uuid": "052380ed-a118-4f28-b739-508330873d42", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768511031, "uuid": "ef813269-f15f-498d-900c-f88e86d1dbeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511031, "uuid": "7c7d7f41-a1da-4c09-adc3-4e4771e1fbff", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fbd083-f1e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768462819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768462819, "uuid": "ebff3704-0cd5-46fc-851e-d00312b926f7", "comment": "Malware payload", "value": "60e403ba99427ca5362a2ce347989bf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768462819, "uuid": "8a9f1562-fc38-41fa-b0ae-9c0691f66b5c", "comment": "Malware payload", "value": "a86c47ab685cc3a96d4579348ebacaa259b50ee8c890dbc56829fadbd20fb2ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768462819, "uuid": "bfed05da-dead-48d0-a4cd-b570657da8f6", "comment": "Malware payload", "value": "654b4e934412e5bc977b87b14bd7d33b74876276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768462819, "uuid": "076eccf2-e638-45fd-9aed-c1f1f73af812", "comment": "Malware payload", "value": "099aa9fa1019bdc77a52710210019cfbd56359402ce7eb18d47141608cd2051400960b80d4e0dc060ab6564324407a06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768462819, "uuid": "9b79340f-df8f-4702-b3fb-f6ffedebced8", "value": "T13FA3825E7A218F7DF6B8C73497FB1B34A77922CA2A91C580D1ACD5012E2434D981FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768462819, "uuid": "f69d7686-d1ee-4946-ac1e-dfc13bc2efef", "value": "1536:fmdurU07J8MtqHxqGPkncW/RVi/wJz8H6xVRFOr4kp6Ch1d:fma7JLqHxcncWZViTH6xVRFOR6ChT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768462819, "uuid": "aa86e497-fd40-4abd-95c9-a9f790ea1423", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768462819, "uuid": "6b734930-9a57-46cf-95c2-be1ee30448c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768462819, "uuid": "f05e2b7d-6a46-4bab-8ac9-c5d536893ec0", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064ea0b1-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1768463499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463499, "uuid": "f3a32407-c59b-4aea-b42f-f79ec790e3b4", "comment": "Malware payload (DonutLoader)", "value": "fa7d0bd1afcba790d3d895c0db411d51", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463499, "uuid": "39f550af-0ec8-4a64-b49f-d3744453e317", "comment": "Malware payload (DonutLoader)", "value": "a8d505de9be99d74819a19c7349bd053628e5c0897c51eb8c37064ed8aa401b6", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463499, "uuid": "a74d0f46-2c0d-42cd-9bb6-0ddcd4987a42", "comment": "Malware payload (DonutLoader)", "value": "dfeeacd485933d9d783a49437b9c6388d6402da0", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463499, "uuid": "c50ccada-9abd-4d58-90d8-43a19cb48aab", "comment": "Malware payload (DonutLoader)", "value": "120ded2e4ddbc066b65e9a7125e3c210eef6374801774f0093fc2c391f6924db336786b57e1c395389b01491fc1f174c", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463499, "uuid": "71f35df0-d5d4-4038-a4eb-aec3b6057bfc", "value": "T17646C6403F8085B6B3216B6E91369E71984690877BCADBC5319DDA2A311DD4BA31CFF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463499, "uuid": "0eca485d-c054-47b1-8e72-aa1da19db6c4", "value": "98304:BaJzIYJw+IPsSWFIJQ77Bq/RKQTeOPNTmV1G8Rp0P2t3mQct/qCq0aUe6CDjIY1Z:BU7QZolhq/3eOPNg15tt3m3t/qD0heTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463499, "uuid": "737177ba-3b66-435b-97c6-629d33041897", "value": 5757812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463499, "uuid": "24a5e0ad-1df5-46b3-9954-8eb2ddf88c32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463499, "uuid": "87bc014b-4f8a-4d06-836b-79c85772f107", "value": "RFQ-3168952 PRHO64-PO-2551876-SSQ2026-661.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ad81dc-f210-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768481399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481399, "uuid": "2a6a1baf-7f1d-488f-b986-38ca99372f0e", "comment": "Malware payload (SalatStealer)", "value": "f125310f6c00f04b8df798948f8a6fdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481399, "uuid": "0fcdce7d-3ccb-43aa-b8b7-c3a0239d9c4c", "comment": "Malware payload (SalatStealer)", "value": "aac9460c5b1ff611736674bf5c053f2b666f00acad03a78814bf0e7af249fcdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481399, "uuid": "61e69deb-393e-4417-a8e8-75b8d9d4504d", "comment": "Malware payload (SalatStealer)", "value": "cd6a4ef1d87971a1830d13f0e7d00ebd4ea0e3a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481399, "uuid": "4900fb91-18c7-4383-8107-9aecf04128f4", "comment": "Malware payload (SalatStealer)", "value": "d4aa1c109f65cf67be2b652372a7f4e92b265dc7bff77de3165fbb67739a578f0ef0c5ca6d63da8b5dfe005723b88278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481399, "uuid": "2d86c21c-a1ba-44e6-95a4-b2d8b6130281", "value": "T147E533337C1BC68ED80FD1FDCC3C4A5A2E5C98492BB4C48B86D7ED44A1D9AE1976209D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481399, "uuid": "b9ab0c14-19e0-4218-a727-38585d12fbae", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481399, "uuid": "4f2f2910-5854-444e-b409-a1bb09611413", "value": "98304:IwZ+pr1PbyIv5hUPXjN70OCfocwklxbLNx:74yIAzNvcHDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768481399, "uuid": "41522da2-e2fa-4bfa-8942-7fc592b96251", "value": 3291648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768481399, "uuid": "73928e07-f6ce-4e52-9fbd-9aaa95a46ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481399, "uuid": "06f7fdf6-1546-456b-9aeb-1d2b8e957c17", "value": "EACobxod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c5a1b4-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload (Kaiji)", "timestamp": 1768500455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500455, "uuid": "b89a18b4-7e10-482e-8d39-f4f52107ee1a", "comment": "Malware payload (Kaiji)", "value": "516c9e53430eded0975095eac83546ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500455, "uuid": "dedc7d01-7107-48c3-9e24-8b4ac04ec33c", "comment": "Malware payload (Kaiji)", "value": "ab4525f80ffbdc65f127760d94ce05b9296a6c62f63f62ff6fac1a922a0a1a21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500455, "uuid": "cc3121ba-c8e8-4876-9aaf-6406d8c77f63", "comment": "Malware payload (Kaiji)", "value": "2da328fe1075c3af685523d833e543950fd3db30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500455, "uuid": "9628d500-0f0b-41ad-9d4e-a0751acd0423", "comment": "Malware payload (Kaiji)", "value": "c19e4fa620277e674ffd76ba06ca38891204ffc9b1d4b19c4fc8167892a9b666e3e4119548bff039f603d149043f8439", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500455, "uuid": "a1d934d1-54fa-4ff5-b8f5-5fa86bbd075f", "value": "T130B53A137F28D70EC71521344DB2CB94676A6C8A07D6A517BB81F319B8B20AC4E6EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500455, "uuid": "0c3d4c1f-1312-4d4d-ab68-2e357d55c2c0", "value": "24576:cdz8hxtvZ8T0p+gpvRYvyVW1Z0tWJ/RVXbwqel9OFI+TcR:TFpWxgqelga+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500455, "uuid": "e39a551c-5c32-4718-a920-e52152ad7409", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500455, "uuid": "a3332a51-d0c2-41ba-a31c-8345e2056096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500455, "uuid": "d54d4509-7ccc-4729-a92c-ca746e766d97", "value": "linux_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4189ca7d-f1f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768470041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768470041, "uuid": "b8230f4e-f9c3-4944-a1f7-03d560bb5841", "comment": "Malware payload", "value": "2619c10e7d4154b9976861843142fc5e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768470041, "uuid": "709bf472-9acd-4376-b93f-173a687e6fdb", "comment": "Malware payload", "value": "ab960e62b411ac05fc55137a7fc0d653347c4c38ad212939c3e6a719372a7b2e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768470041, "uuid": "3ba5c037-469f-40ce-ba98-d332c0ea0fda", "comment": "Malware payload", "value": "168aa45e4b2c51d25a956f55a03c1cbf48cc9570", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768470041, "uuid": "cd4ac81e-d974-4955-a82d-901aa4d4f2c3", "comment": "Malware payload", "value": "de9301cbede44fe34a154e6c41e7a57887ff53893231996571d48ea46982f2474751776fd63b928b8f31486adaffdbef", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768470041, "uuid": "05544938-97f3-43f0-a8db-548cdcfbb5a6", "value": "T1B4B53322B3C2C5B1E1C8127049D7A7AB85FCE7515B1801D39B9E4E063EBE5C2E67D386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768470041, "uuid": "99f6c552-e0e7-4f44-9d10-068c5cf29421", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768470041, "uuid": "67d43827-7c9b-4df2-86c4-c4629d6bd91d", "value": "49152:DgwR70pmXor4QlvGN4RwAqul5DQVGGiqabZnP8QQCxGuh:DgwRILrNFGyxfQ23bZncCx/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768470041, "uuid": "30468a6a-176a-499c-a298-382f8dce7392", "value": 2336241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768470041, "uuid": "173a4c85-fe0a-4635-af63-bc79ae4c3013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768470041, "uuid": "e7de9743-b9c8-4235-acfe-487fb11e627b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83c0de0-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478373, "uuid": "07e48cef-a0b5-4f63-a5f8-6d9a748e1bbb", "comment": "Malware payload (Mirai)", "value": "c3577f819b903962ac8875a6f7968e9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478373, "uuid": "ab743a9b-cc1b-439a-aceb-2526be5516fe", "comment": "Malware payload (Mirai)", "value": "ad35f3eb799996067bdb0c3c62fcd8046434b5a83585cae43e1c119550a2b331", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478373, "uuid": "cec60308-0423-4932-8d61-e126f40786e6", "comment": "Malware payload (Mirai)", "value": "9a355afca70d5de3e2bbf76c816d4d0510ca5a4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478373, "uuid": "1b9e09ad-7677-43e0-8ace-3a71c9746064", "comment": "Malware payload (Mirai)", "value": "adfe33ec1f130fe93d9b56f615e9ba745eeb306f72d52345ba8b6be2c3ae44faac316299649bcaa138ba7cf3606bf286", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478373, "uuid": "7dd6e696-9d77-4a2f-972a-a5de4b2e756b", "value": "T1E743013619178F92CDC148B96C9F47C66A728FF1C4BCA06E29354745918328B4FACDCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478373, "uuid": "920ffbb0-beca-4517-bf44-1f1e7c926db3", "value": "1536:eULZtp0B6niDoY3jK978+hXhAGP7JS35yLn:eyZtps6nY+Gi+5yLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478373, "uuid": "4e021f99-a088-4667-bba6-4334a887b60d", "value": 60192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478373, "uuid": "e3f3d168-7a2f-4c56-a2e2-e050e47ac087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478373, "uuid": "c106fabb-cf7b-4e45-a453-e665a7226918", "value": "sumrak.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bca8b8-f201-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474656, "uuid": "11dd404d-1ace-41a5-9091-2c41115f1a1e", "comment": "Malware payload (Mirai)", "value": "b0885dd684cb74dcb394e12a158dac72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474656, "uuid": "ea96d505-e254-4a6e-ac93-e613568e7a4a", "comment": "Malware payload (Mirai)", "value": "adbb7e9a2f98c73c5ec4d8584c6924a9f90acdb325f756785069ad447fe0e70b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474656, "uuid": "6a5a6219-9b15-4253-b332-198d42c2f2d0", "comment": "Malware payload (Mirai)", "value": "6fb28be88160d565c7dfa983efe850f905d6f2fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474656, "uuid": "df806c7a-2572-4530-938a-168a689337e8", "comment": "Malware payload (Mirai)", "value": "d240ef2140683f5de2749f4d8ba6210e359841cd70dcf7c1900c4544d56b4879c1ae481962a5c977211398d2a8bb1372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474656, "uuid": "418383af-99b4-463c-8a6a-7d24894aaac2", "value": "T1A393E896B8C28E15C5D423BBF92E008D331667A8E2DF72129D106F2477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474656, "uuid": "f960e867-f0ae-4423-89dc-e6495e6acbb5", "value": "1536:lwNn21vn1P0YAvT7C+P7V2o6Ahb0rkHP8UWj6X7w6M12xlwU85W//5jFYcpITigC:lFP1sYu7JPZ2oP0r+0UWj6LXMYEHC4CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474656, "uuid": "7620dcb6-9f05-48a5-8a57-3154ce1d8d0a", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474656, "uuid": "0bfcb53a-da90-4cef-ab78-17588ea9af52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474656, "uuid": "a0d2a163-88cf-43b3-a1a8-e45afecee1c4", "value": "UnHAnaAW.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b8e600-f232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495705, "uuid": "a0f7e56a-f422-4ba0-add2-d5d177f8c36e", "comment": "Malware payload (Mirai)", "value": "9a3a4d74bdbe5116caa175e6a2925b98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495705, "uuid": "7890c562-d3a5-485b-973a-cce6ce3669cf", "comment": "Malware payload (Mirai)", "value": "ae88cc6dc61a559d7fa1d7271cc91572fbba361affaa0d93fe6a4c606c097860", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495705, "uuid": "95e4dcd3-2716-42f5-9d9b-cff666c334b0", "comment": "Malware payload (Mirai)", "value": "a989ae475ad91405acf291d849148e7fe4b91f80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495705, "uuid": "b64c4ee0-b426-420d-ae5e-0da0c14ed448", "comment": "Malware payload (Mirai)", "value": "f27ad99408e96e5b5e72b2497d0cc30c739ff82271429a46e9b32d87572c046c7d33f969722a58646212294f5a110cbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495705, "uuid": "2e31b031-1a98-47bb-81b9-7e7bcf126fd2", "value": "T12D937CC0F683C4F2E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495705, "uuid": "4f705baf-9a18-4501-98fa-4bc849108fda", "value": "1536:W/QCZaxGdvts3i5JPhoCUxPu++ov5EUIKqI4FrS4LS8:WYCZa8dvm3oJPhfUxP595GKfUmD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495705, "uuid": "81f7887b-8886-481f-bd95-225ef848fa13", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495705, "uuid": "9cc00b75-d10c-41d8-a04b-8bda97497016", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495705, "uuid": "94f71b04-6a20-4194-8c6e-97c1562b6e00", "value": "djmario.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55fd241-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463793, "uuid": "0049c66c-2895-4cd3-b1a9-95089bbb2628", "comment": "Malware payload (AgentTesla)", "value": "246b1165a6fde89bca939a93eb7753a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463793, "uuid": "247f7d75-9028-46bd-a206-de5a49fadc86", "comment": "Malware payload (AgentTesla)", "value": "aee14995a692ef57a670870fe7d7769954c512f13867a5d6dce18fb94812702a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463793, "uuid": "80fe9a02-b4e4-4362-a7ff-e5ba963e8ff4", "comment": "Malware payload (AgentTesla)", "value": "0e68d755d0452540a5f1b9b27f74845c1be18eda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463793, "uuid": "eddaf276-a096-4eed-bc41-46b08fd77fa0", "comment": "Malware payload (AgentTesla)", "value": "38ccfdf70ff36104e60ff07f358347a31951ba0d72a00147dbd5e20e4ae3f83af0668d7a7c5feff21cb1218411eeecd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463793, "uuid": "b03f0f38-3ed7-4530-b9c2-7469819c59a9", "value": "T1319396883FC7F465834625336D2BA06AF13E0C58B50C8496E2A76ED5BB6C714E27F91C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463793, "uuid": "5ae91eaf-7720-4528-9d3d-70a6e0aec263", "value": "1536:n/qm6fPM+CXpNVmNfXV66Z3zQIKpmOeERDdKqgUvrfZ:f6MJXHVm5XV3VL1ERDdXgUv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463793, "uuid": "9be45fa5-97dc-41c0-9ff7-966d89c9cb1d", "value": 94713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463793, "uuid": "93c0fad2-6eb3-4af0-b008-75fe6a03c714", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463793, "uuid": "58907275-f0a7-4ade-8d68-b2dc5d58876e", "value": "BANK SLIP.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0385eec7-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768466071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466071, "uuid": "2ca505ba-4475-4aaa-9030-9c23ffee0fb5", "comment": "Malware payload (AsyncRAT)", "value": "64fdbb65095866449dba3beae53f0065", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466071, "uuid": "0ab48913-d25a-45c0-88e4-565ad21c1abb", "comment": "Malware payload (AsyncRAT)", "value": "aef327fcbd792f763f374dea26310f6349b71d772907f4166325682266d07127", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466071, "uuid": "f403692f-4736-4e7e-a3f6-ec49b930eeea", "comment": "Malware payload (AsyncRAT)", "value": "dc481bbc675b42be170acec4d2b61a75417dc7e7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466071, "uuid": "e9b88638-594e-4230-9383-f94620d4f0cc", "comment": "Malware payload (AsyncRAT)", "value": "ce406194bc46c68d50dd326a19af8b85f6adcf245abbd6cde9aa5f70e288194b5dd5ac977dbf880e7ac1392f9442d930", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466071, "uuid": "af367d9d-fb76-486e-9f1e-63817d30ac51", "value": "T1D83412742E21E9AE9BF1E37731A2E448F32747136175D09ABA4CE4502B3A15CC1BEF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466071, "uuid": "fc745b23-513e-41b3-8650-5384a2369243", "value": "3072:GrNlrIl2+KLM5Qh6VLxe7vn+9YxBHLZOB3qSa0E6yBOF/pPHUf7bRZ12jDqBo+CD:GxlrIBKLse7kKSjrvUjt+j2x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466071, "uuid": "3f54efc3-4f31-4c2e-a25e-4b69f6b8fd72", "value": 231199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466071, "uuid": "1e185aed-c09a-4e77-8b3a-927f4716096b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466071, "uuid": "c504881f-ea99-44a1-82cb-bbe929526b03", "value": "eazyyyyyyy.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b654bf-f20a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478524, "uuid": "58092f3c-2f1b-43f0-8f3c-c55211327e1b", "comment": "Malware payload (Mirai)", "value": "9d0cf9784b2d442ac35c8faac39b12bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478524, "uuid": "32891fab-3453-4470-8c3a-e37b51e7f167", "comment": "Malware payload (Mirai)", "value": "b0032d23d7f265c990ef4268a6d2c505050becb337e6fb543b6a7ac1381924f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478524, "uuid": "77680a12-ae34-4510-a369-373a957beb6d", "comment": "Malware payload (Mirai)", "value": "80a4739f3b368defdf8dd586ed9e3c9982cc53a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478524, "uuid": "618d3665-4c90-4fd6-94fe-b7a6a58a20f0", "comment": "Malware payload (Mirai)", "value": "73680a4f92aaed34513768abddb1ac301c1fc6d08e4673400a23703a3db9fdb6ea6cebdc842a210cb5e2f8eadd4d0054", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478524, "uuid": "48f24cdb-557b-42c5-8d52-14abe88b5209", "value": "T126936CC5B6C3F0F6E84210B9203E5772CF73E53AA436DE8AD3A89832DC62501D61A75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478524, "uuid": "8d0fabad-4d45-4905-8a97-17d7335b9431", "value": "1536:JxXSN3hv5P7D4Bu90Q33l+TvmHdjfHw3aCStHBNNJ:u3J5jkE0Q31wvI5XLDNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478524, "uuid": "f826e450-a395-4488-9563-2cb99d22bfa9", "value": 94892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478524, "uuid": "752d6ec7-428e-4804-8d7f-9960eb2a21ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478524, "uuid": "15966bfa-903c-4c14-a047-6620d6590414", "value": "sumrak.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d01201-f201-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768474962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474962, "uuid": "f0cdfc51-1ef1-4547-b9fe-fad60a6db2a6", "comment": "Malware payload (AsyncRAT)", "value": "00f52b70117864a29a18d1132bd844b2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474962, "uuid": "8480d0d4-84bd-467a-a9cf-2a9741018161", "comment": "Malware payload (AsyncRAT)", "value": "b044d4ffacaccc955e031ac03b859febb4cc27a6a5dab4ee5a0495b343124e14", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474962, "uuid": "8e7d41dc-dd5b-4302-a706-ef7df502aa06", "comment": "Malware payload (AsyncRAT)", "value": "7fb9c8ec5971ced511312e9dbdc5ec6b58ba16f5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474962, "uuid": "1e8a38d9-e4a4-47dc-be81-288fdb4e95a9", "comment": "Malware payload (AsyncRAT)", "value": "f7474f19586d1fccb4246fcc5ae1167a01c8b3de4bff074703d9bad27b585c1c56318e6bdd20c1a688e684b3135fd1d6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474962, "uuid": "a36693dd-9450-4b74-9f72-9ebfb9b3136a", "value": "T158C21A0473F48261D1ED4BBE48339200D375E68B5D13DB9F5EC495AD2A33BC98A25BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474962, "uuid": "871af25e-5242-4a01-b52e-af009a6dbf0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474962, "uuid": "c2646e1f-e908-4b21-b8d7-b3b1de6ff982", "value": "384:tu048twEHJ5zgeHQQkFMMymrJhxpHqqbuUsJQxnCJf+BWfXWa/pu+:tF4ZqJ5EJQkiMyCJhxJFbHBFB8u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474962, "uuid": "b0ff4e89-2113-4bc1-84e6-a753ddf2da51", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474962, "uuid": "5f51460c-a247-4593-9597-d2cecef7b77a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474962, "uuid": "a27435bf-381d-4c58-9982-c981b5381058", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e78f96-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478371, "uuid": "a4fd0ba6-d79a-4acd-a9d5-dc86b96f73f1", "comment": "Malware payload (Mirai)", "value": "0d497b86aeae366c0934e962efe0b431", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478371, "uuid": "95a24a4e-1fd0-49fe-a134-6fbf22c17a84", "comment": "Malware payload (Mirai)", "value": "b076e910ce1c6e6e5f8ec29a8012fe3ee9aaee13e45693b11de7495bf6fe9153", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478371, "uuid": "23ef5709-995a-49df-92e2-eb7381f3f8b6", "comment": "Malware payload (Mirai)", "value": "fabe5c4765a3391016ebaf245c5e093f436e5c66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478371, "uuid": "48533258-8a09-45d1-8b1f-269376a4be63", "comment": "Malware payload (Mirai)", "value": "0db78f491a1b594cf86ebd159a2842fc0d54cccafb30b2228e717ebc80beb9b6fb46ad5f5505b4db121d08ede0bc024d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478371, "uuid": "8d837530-5a76-4b26-9561-619ddbc6731d", "value": "T1BB13F2E392D4CE45EAFC4278C0F33B0765D1A2F95668ED51E28034BA9D68FD614206B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478371, "uuid": "4b11d97e-a941-4ba0-a4c9-22a46d4cdd58", "value": "768:Z1o6GK33bgjXYJ94h+K6YlEmOnGVlZouWc+eyKVfAFSCynbcuyD7UHQRj59:zoyUjXYsh/qGPZopb6fA0Cynouy8HyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478371, "uuid": "650f3eec-2c5b-4dfb-a5d3-28f61e0144e9", "value": 43976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478371, "uuid": "e56d153d-bcea-43e8-b4e8-8d81ec5201bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478371, "uuid": "cc3aa07b-c348-4c3e-bad6-9d496276a752", "value": "sumrak.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623d01ee-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768463653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463653, "uuid": "f7ba3edc-f02e-4c40-b9fc-d4cce3682cad", "comment": "Malware payload", "value": "6fb72ae73398e8fe34463e350fa386da", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463653, "uuid": "124dfbe9-46e0-4036-9f64-99c908beb90f", "comment": "Malware payload", "value": "b090037faf9081ec7021cc602794aea872c6522964094d92012c03ac1186b2c2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463653, "uuid": "a151fa1f-1531-420c-9aa6-d3bef92f1415", "comment": "Malware payload", "value": "4e7a57f8625bf1ec8f63ead0f54a0f0b247526a0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463653, "uuid": "b9f5da4f-c816-41ff-adb3-0c38872e9e81", "comment": "Malware payload", "value": "54104c020fc7c4636fbd2bbc268acf1f2d2482924ca29411f35e4fa9e4137c9e27762b6beab1575ed781e005052dfb64", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463653, "uuid": "fa69a16f-f489-49fe-b42e-a74739b8c117", "value": "T1D56523EE2A5BC5FCC02186F4DB2C26DD086BA337771DB44AC4270BD06279E56B6C7126", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463653, "uuid": "c31d9332-a019-4ac5-984a-620b915bcf41", "value": "24576:57uA4YTZQzSCSX1Qw/IonI05T9E348ol2ylwu3V0kjAzGoGJJTd/Fy6CeF00biq2:59T6zQ1Qwp5TCo0y/V0kPJTdFy1eemib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463653, "uuid": "f3d6991e-9f6f-4bba-a351-334e08c1d6dc", "value": 1453811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463653, "uuid": "25e17915-6bc0-43a1-9289-1b94e39b0fc3", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463653, "uuid": "df201882-8bff-4b85-a435-674575c32bf5", "value": "NCERT - Cyber Advisory.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc34e163-f1ec-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768466059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466059, "uuid": "29fa5a0a-2b99-4633-ab5e-36b9ece4a764", "comment": "Malware payload (AsyncRAT)", "value": "3de0e78153209ef9aa5207d9e5285f10", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466059, "uuid": "be477b47-ce72-4d74-8754-a1f97cdc9736", "comment": "Malware payload (AsyncRAT)", "value": "b0f0b0021f713025260ef66b20bc58eaf21f789dfc79bf35552059369a857dea", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466059, "uuid": "41b78c46-3374-4960-84a4-5d49603e44bb", "comment": "Malware payload (AsyncRAT)", "value": "c4e5c7b76be50944f0f3a40a1713fdb12b57724a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466059, "uuid": "ce4f9e4b-4e14-4534-b6b4-d4c8d9cf9812", "comment": "Malware payload (AsyncRAT)", "value": "848a88269116772448567e6c4854a6e9e11112eaad58f9316a81f9cee50c63453fc79b04f2ea6bd4b37f5e7ac66fb936", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466059, "uuid": "6c1d47e5-4cf8-429c-94bc-feb80a912428", "value": "T1C62423A67853417F13762A3930BF861C74632892214EB5993F9C6CCF4731AA59CBBF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466059, "uuid": "504a3fa0-b954-4ae3-a3a1-86fff85cadf6", "value": "3072:dmY2xZCes89vUGm/+qY4t53mLYBhYKMPu5gl4acTmU5h18CcfQpLbm62h42rT:V2V9Y/+q9nm84fBLcTmUZc0LaHhPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466059, "uuid": "7b0e3f77-a6b7-4153-86d7-c8af5490a416", "value": 226861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466059, "uuid": "a3ff4890-bf5e-4b0d-a37b-570c57f27cee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466059, "uuid": "12a124db-78a6-41b1-9e8e-ba269ee00215", "value": "EASY.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594aac2e-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435721, "uuid": "de58094b-07f6-48bd-b9d4-b5b65bff18a1", "comment": "Malware payload (Mirai)", "value": "deb09296f820d50900ae683359b2ac3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435721, "uuid": "0e73db12-1990-41f8-9504-87fdbedcbf32", "comment": "Malware payload (Mirai)", "value": "b1f0280e9207cecace9d49169630945086e5a9bd8e757dcf58a5a33f9ff7f726", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435721, "uuid": "2fed5d45-b64c-41c6-9483-1836360773e8", "comment": "Malware payload (Mirai)", "value": "eedd5c22ada8c5b99608be660ece28a1f24092e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435721, "uuid": "a61e9d2d-fa3f-4b1d-90f2-8cd87cc26671", "comment": "Malware payload (Mirai)", "value": "5c1c44b054eb4a62ee20e6381cc23d13be990af52dab8c87aa3c43a507b03e5cd5b0ccb7f5c1139e45fa5ef4f6762da9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435721, "uuid": "8257efbf-2791-42e3-9ff4-75369cc7a36c", "value": "T1F3C33902F98184FDC0CAC1340B6FB63AA976F1DD1238B2EB67D4AF122D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435721, "uuid": "f00538bc-5a45-4613-8b4c-a6c92d350a97", "value": "3072:R4835ggckwwNZbcnITO1yosFmIxnJdhgtDb7BG/So/ozQPphojgaRFt:RH35ggckwwNZbcnITeyosFmIxnJdhgd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435721, "uuid": "79afb5af-95eb-4756-ba93-7f835922a77b", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435721, "uuid": "37685cb8-5746-4690-8c6e-a21b9908ef9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435721, "uuid": "faadb5ff-01af-4fc3-a578-fb1fb3450f39", "value": "systemx64.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429b43b0-f213-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768482498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482498, "uuid": "daa78b51-5c21-4301-82ea-5ef0e8fb51af", "comment": "Malware payload", "value": "898dcaf01be86b9547eb2d5d16dcee38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482498, "uuid": "c2dae1e5-af9d-4b31-bf98-49891f1b1eef", "comment": "Malware payload", "value": "b209f35379876f5e69b4cb4d39a1b7b3a3d62d784ca538b44789127706d766b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482498, "uuid": "0f604728-ad11-49fd-a305-b3fc299efdc8", "comment": "Malware payload", "value": "dccdcbfca47f4b1a9119afbe31807a75d4e41548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768482498, "uuid": "12d8a0b5-50ff-4e3a-b9a7-49bf9d2822b0", "comment": "Malware payload", "value": "d6b172aaefbc6f01280a1c0e9a449583db42e1182ad6e4c187a087ecd5791b6f70d483f9e12a2d7872fa6f7dc9a7aa44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482498, "uuid": "678792a1-9a73-486a-8a7d-29d620c6f2e8", "value": "T1B4E73366A33E9B7ACD6D277AD17B402E09C08DEBAC571CAA41DF1BFD07058B58398350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482498, "uuid": "4b6c12d3-2c30-43cc-9db8-623ad5b46d37", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482498, "uuid": "7b62b7cd-eaf4-4f88-bf07-16ed33bf9a06", "value": "1572864:PU2sy1HwnxL2ZkHL/ctw1caz1SFiVxpeF/+UR7xXs/wmgvnFG6H8g:PU2sy1HsxiZkr/8ujcF/TR1Xs/enFGVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768482498, "uuid": "f98df12e-cc1f-46ea-a724-c26dcdf896e4", "value": 69858750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768482498, "uuid": "717a39d9-f3d1-4400-acf8-8bf85d70a86c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768482498, "uuid": "fc8c780d-3e3f-4235-a98e-a062f2b3baca", "value": "XaynePackMakerSetup-5.0.5-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec77caf1-f22d-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1768493950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768493950, "uuid": "c6514374-17d7-47f5-a311-2fd29a152600", "comment": "Malware payload (LummaStealer)", "value": "95e7c1270aa1f28824c362e63a9e0f3e", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768493950, "uuid": "504e2b3f-7fc7-4fb5-8afe-d84dc99b94b0", "comment": "Malware payload (LummaStealer)", "value": "b28c97c1752c8923c3886dd20cf7785b9a1a5cf2c4dbd749d74266ef43f3f76c", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768493950, "uuid": "96e68827-454f-46b0-8e46-7bf4498ee727", "comment": "Malware payload (LummaStealer)", "value": "071595300bfc0c8a7822b911dc5fea15ceaa9f13", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768493950, "uuid": "209c727c-d505-42a8-a8bc-4e9e3c3aefa3", "comment": "Malware payload (LummaStealer)", "value": "e0e1a6347864552d269986871e85722ceb41f73bc35cf5611078d8571caa2394cd06f5944565a49677600c50598fa5a4", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xor", "colour": "#F3D023", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768493950, "uuid": "abcdeb24-5bad-4c3d-92ff-f3b5e1774e94", "value": "T15F423993039487AEA3C409D98118311B45F2D5676C7D219DFF936ADFFC2E98294B8732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768493950, "uuid": "a05a03ab-b3bc-4f40-8b99-64fe9ae8759d", "value": "384:fqyP6V8FnzwEQcgOVOZZxxHryf3o+R65uO+RGRWvAv5e3wm:SFVTEQcp4tWf4+AcYRkS5eAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768493950, "uuid": "c3682b4a-05b5-4b00-9bc5-11318a8cfe29", "value": 13077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768493950, "uuid": "e0a990cc-8689-45d0-9fff-45a45507db01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768493950, "uuid": "998d7c6e-0e7f-4402-ba3a-3dbf356090e6", "value": "Service.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0180317e-f201-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474658, "uuid": "3d306c05-1a75-444f-816c-fa450bbfeb10", "comment": "Malware payload (Mirai)", "value": "9f0fc0ca4f0bdd09d6975dd6175e3109", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474658, "uuid": "497800bb-d1b8-40f1-8ecc-2c10a560eb24", "comment": "Malware payload (Mirai)", "value": "b2d6c58c2afbaa7d2e5633ef86622cb4bc5e0b7f4438510f8b10cf968d084acd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474658, "uuid": "f5ca532f-2eb3-4bbc-8c71-9b882e6ac34c", "comment": "Malware payload (Mirai)", "value": "d7d29aa47169f834a5931ecfb445a5da3ce9479a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474658, "uuid": "660cc03b-fc7b-465c-b61e-dda8bedad2b5", "comment": "Malware payload (Mirai)", "value": "de61e56bec106f801859accaeac654dc4567cdbad2697378fb679b2fed33734a7709da7e48f63712c0ddf863a31c7dff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474658, "uuid": "d5b1ac2c-2082-487f-bf72-df81162cdc5a", "value": "T105734CD9A8025E3CF95BE6BD94220F09F920231557D30F2BA5AAFDD3BD731549E02D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474658, "uuid": "b819ca07-cb64-4d3c-bf15-dac703ce8004", "value": "768:beV8Rybk/IC0kYqyZb5KwXpTjeqFkeQPP2oUX2AvUqhud4amJsSrjPKP88gd/K86:bv7Gqyl5KwGAZXYqwWaQrjPKE8gdS88B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474658, "uuid": "37f95d40-a11a-47df-8e0f-6d3aa4d9acdd", "value": 78804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474658, "uuid": "6a06706d-8ffa-45a9-b099-7509fdc7431a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474658, "uuid": "5a1a289e-4631-4eb4-8ff9-7b191dcbdec4", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ef051b-f1e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768461480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461480, "uuid": "b33216c6-cdcf-48cc-b329-938e8c7494de", "comment": "Malware payload", "value": "580cb60d5502e16ebffcd9b1331547df", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461480, "uuid": "294aac2d-16ad-44e7-a7ca-b6b57e704cd5", "comment": "Malware payload", "value": "b5906e2072c688724dc03b7f5c7e3c6733ed8feea351366604af8d2d54238057", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461480, "uuid": "e85aaad1-b70d-4be2-a591-02837c1326c8", "comment": "Malware payload", "value": "4447e2e9668a06dc909039c4112e710378e56db8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461480, "uuid": "c5f78de5-e438-4aa9-94ec-e2929d8a07cd", "comment": "Malware payload", "value": "2e61b446e932ce07431869c2abe095d8ac8f1df61573fd08a4e4cecbe645e99dac25724b1d95db4d57d7296b206241ba", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461480, "uuid": "9531b355-2433-42ab-b2c6-3cb4a779ba45", "value": "T174F502C4C8432970AB2D6811CA2FD63D201F70A352276E296E59B2E87E5D4F7CD652FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461480, "uuid": "53a00d37-0c89-4bfd-952d-0681081861fc", "value": "49152:dDDuQSZLvsprz3Uhrf2mVL4NzhgPxJBLn7Tq6hIPhLdvy3/oWTE9fPO0Y3FZv5sD:dDDOW6WPhLw/ogE9njlJHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461480, "uuid": "47740f00-1801-4350-aa53-d02997c5d7d4", "value": 3392421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461480, "uuid": "076d5ce8-a39a-478f-b046-667cfa0322af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461480, "uuid": "22f56ecb-c208-463e-91b3-aa3a65df0912", "value": "RFQ-OQ#1895365.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c9f896-f1f1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768467843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467843, "uuid": "bf647aa5-5205-4909-8bbe-67fcc7357ccd", "comment": "Malware payload (AgentTesla)", "value": "e498b05b8afe955afd64f032e9b08c17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467843, "uuid": "9ce4a1c4-f41c-4dd2-b566-36ec6896acc7", "comment": "Malware payload (AgentTesla)", "value": "b5c01959c7f98813cdd2421b0e4b5fdcd74267d48b41a9b2c86ba26734b589eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467843, "uuid": "331df6e9-b271-4597-908b-e31cca8e278d", "comment": "Malware payload (AgentTesla)", "value": "9c9c0cace023dca9ed40add3d35fad34c8534433", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467843, "uuid": "9c5b2c77-c67f-465d-a223-eb2112698e36", "comment": "Malware payload (AgentTesla)", "value": "e65b2c41dbd88c0f1f38356302996d9b9ec4efb44a3f36fe52ba57368d41d3a9dbd2577f6e1243c2595fbf6041e5becc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467843, "uuid": "8b04c3d1-5644-41e4-bae6-9781449a2081", "value": "T19A1523614C36EB6D02B9FF34647BDD1E66960C7C5109916EB77C988707DBB8C0A1F828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467843, "uuid": "b8c5d11f-5ddc-46ed-884b-bf4863ce270d", "value": "24576:yROvSOZ8FZIK8SYZCE9Z+/f+jTPndcTshlG:o5IK5YZCpWfPGgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768467843, "uuid": "a3b63e0d-b438-479d-9633-2d9767b667f6", "value": 923481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768467843, "uuid": "da8a5ef9-bf92-4889-8a6c-9651e97935fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467843, "uuid": "2c3f67fa-f066-4353-ad6a-d4eb02f25e30", "value": "4090ar.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da62895-f1f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768469658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469658, "uuid": "84cac1f9-1f26-46bb-909e-c4e8f9d3e034", "comment": "Malware payload", "value": "0b01a6563de9dbab6d1dbc2754a5f6af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469658, "uuid": "4dc5e8f5-89a2-48d1-85df-b3b86d24d9ba", "comment": "Malware payload", "value": "b616848f6dc82e8d689816ae533449297b72e53fc1001b1662cf004793012120", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469658, "uuid": "c26e3b93-7157-4b4d-b35f-eaeb735df43a", "comment": "Malware payload", "value": "d85e3abe946a55abca56867150f63b0b633de8f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469658, "uuid": "84de8268-e635-485e-a96e-28700574611d", "comment": "Malware payload", "value": "68d6ed0e5afd3f632e1be055d03ad09795a23d27cd008432a708bb5aa7ee7a1666954c32fabd9a97c134363220a079df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469658, "uuid": "947c8546-89cb-4d78-b372-751537bfa109", "value": "T19204F100FF09092BC1CB6E742B7F2771B73D4A2528BBD218250ABF6616B387A49537D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469658, "uuid": "d6f49b77-8fcd-40a0-8865-45266c52cc66", "value": "3072:ozdurayQy5HEcMf3onvswyRegQ3EbVZsLSIrutZFA0byR2SV2sH4gB8tv1:ozdurafekcMwnvSvQ+Z4NCFA0bysoPbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469658, "uuid": "95d92c2c-ec96-42f3-9998-be2a12dac58d", "value": 185581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469658, "uuid": "87e769fc-1484-4302-87e2-6fd6a6ca55e2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469658, "uuid": "90683dda-67c6-469b-9a6b-8b61177e233c", "value": "npl5h1u1kw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60098c90-f1f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768469662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469662, "uuid": "58efbdca-4d52-4de6-93fd-a304e60930ea", "comment": "Malware payload (Mirai)", "value": "a1f767ee71d45068e339a735ee44bbf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469662, "uuid": "2e597bcf-f836-42a0-a1b9-e97cd46cc790", "comment": "Malware payload (Mirai)", "value": "b64a77bc28d2cc794151fdbe969e7548ffadc26ad00d796255bcaa9512002193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469662, "uuid": "d3f8da04-fa69-41e0-a891-cfa943a302c5", "comment": "Malware payload (Mirai)", "value": "158226b03ee3e9dd22514bd3fad31ce8290ff486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469662, "uuid": "d47da4a3-847b-4224-8b82-d331476d5ac8", "comment": "Malware payload (Mirai)", "value": "3f8b5ae06560423c83bd922d71108148692fcc4240e9aa40bbd0b56c2d5c8cc6e83c470fe1d0e2052afdd4bfa3d1314c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469662, "uuid": "ac7653a2-c590-421c-8659-f1a88757b037", "value": "T143D3E069F890CF63C2D1653FF26F5648371343A8D3EA73419E149A223BE79570E3A891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469662, "uuid": "22959bc1-183a-469c-9e56-c63a627327f0", "value": "3072:rponhnSMaw91mTI3KQ8NQChaBVqv29Uk68vQIi/4YGs:rUhSjw91mTI3KtZkLqiUf1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469662, "uuid": "5726634a-c5d8-468c-b5f9-e729ddb9d6a3", "value": 140992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469662, "uuid": "1f22eca7-c124-4580-becf-e58e4ddafe56", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469662, "uuid": "76147073-fc10-4ea7-9c86-b987f81ac197", "value": "51q638eo0i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04561e11-f232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495708, "uuid": "12121cd0-010f-41d0-b4e3-220b2ee38216", "comment": "Malware payload (Mirai)", "value": "af3df9d7c840ee37fd4f5170971e6d1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495708, "uuid": "998e3ef1-c4c7-44fa-852c-221c9963b071", "comment": "Malware payload (Mirai)", "value": "b764a4697649ed6d93c94132bbb3e1b432d5242f3f395599c203e6fa772937df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495708, "uuid": "f09c1d4e-1b79-4908-aca2-1cbf4fa243e0", "comment": "Malware payload (Mirai)", "value": "e2078999512af4faca3f5d9feeff92ff3c87c2b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495708, "uuid": "c0aeb1e5-f129-453e-b4d2-011d39abaea5", "comment": "Malware payload (Mirai)", "value": "8e2d4d7342d9fa32bef3f5d159a059e0dc49546008d98d344d7ab8c5eb6242c3d9cc64f30ca398fd017ac92c2368dfd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495708, "uuid": "94dca4b6-9c0b-4d30-bed1-48db4b245a0e", "value": "T1DED32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495708, "uuid": "c1ab0ee9-fdf7-414e-8401-6908df448e7f", "value": "1536:9roGHNTUZN/4IBUiCxfytetewkb1/a3wwo7lj0JvAhhHr5+5uQfqIgv710:nmvUiCxVtCiwh7lDhLzp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495708, "uuid": "3f87bd16-3f1a-49b0-aa00-76d02b7e2794", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495708, "uuid": "8b31df4d-c666-4267-b75d-5c75e54eed80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495708, "uuid": "a9633725-4c4a-4d3e-bcbd-4692033e2977", "value": "djmario.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcc606e-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463619, "uuid": "ec301b72-c844-420b-a898-544d1139f36b", "comment": "Malware payload (Formbook)", "value": "56f51ab5671f4f7a99ae90613c88fddd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463619, "uuid": "c0fbf826-5ffd-4310-8b86-a5a48744d008", "comment": "Malware payload (Formbook)", "value": "b7bb8b7264e4deecc1009400a76c2b8aa1e6c7d972f7908d9b0ab79cb6d788a1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463619, "uuid": "fe626cd1-d5a3-4256-b14d-7d62a7887c98", "comment": "Malware payload (Formbook)", "value": "6f4e9d77eef9a47533fd2d9566c47d17f1ee332d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463619, "uuid": "ff639610-f463-49a4-a69c-a2da7b1f7b4b", "comment": "Malware payload (Formbook)", "value": "3b0e96d7045eb6190a0fb60040fc586777c1b10e90bd619ec1f75c8efefc76669c4f255d46613348a134b850a89f8e6b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463619, "uuid": "22657851-10d9-4fa1-8fbd-8ec97f5d01e1", "value": "T15C558B48D7D171CA20387099D380F718DFB27A218C2B92575B52EECFE092DFDA792664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463619, "uuid": "3d03d120-2a4b-49ad-aeca-1d1d374544bf", "value": "96:7O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3O3T:Dj0AQDqAGhMOIjIfnuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463619, "uuid": "8c9fbbbe-78ba-48ad-8378-1ff4a97691b8", "value": 1339761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463619, "uuid": "647ac3e2-8204-4cc3-911e-7bf201a58654", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463619, "uuid": "1ac10da6-1abc-4646-a933-4561104a74a1", "value": "\u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae_5734.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acddd04-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768466137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466137, "uuid": "7a1964ca-f5df-471c-8c55-859eb638a18c", "comment": "Malware payload (Formbook)", "value": "98d444daae2ff67121cd1d65a63a5bb6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466137, "uuid": "eca87237-bcd2-4098-b47f-06c3d0566d6d", "comment": "Malware payload (Formbook)", "value": "b824470ef9a3b58d253689fb4736e3c9f39aaacf1bee32cbf113f94117bd1d48", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466137, "uuid": "c94feb9e-4118-48b8-bc84-044964c10da1", "comment": "Malware payload (Formbook)", "value": "dc0417319e7ae45269e5e33eb32064cfa6fffa63", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466137, "uuid": "e37b5bd9-15a1-4b1c-a7f1-0f59124f9a58", "comment": "Malware payload (Formbook)", "value": "31a6f3e740f8e59c4004e897068c7e5ced93b42b4b61cbc32211906a790468bf8b38a41e7c435ee05cef81018b20f872", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466137, "uuid": "a5cd3d63-68ac-4c33-9874-065270791481", "value": "T1156533D42C9AF877093A5318307BA64D58708ECF8C65B1BE7AFCB9C613ED340A45617A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466137, "uuid": "5a94bf0a-845e-4a1a-be65-fb6b0e8f7ff2", "value": "24576:x1rjWqPsASLtyP95DaDVLQI6PZUXdLYLaUCdKyfNymY5dBWDHKE151mzl6:xN+AKt2IqGtELaH0Sb7HEzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466137, "uuid": "ab31af29-4dd4-451f-96f2-5b5ed1723de6", "value": 1418867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466137, "uuid": "1c8b122d-4329-457f-9a9f-0cdad0f14390", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466137, "uuid": "694d582e-ac3f-4e4e-80b7-194e59316958", "value": "w1cshg.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e655c7f-f1f1-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1768467888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467888, "uuid": "f05fd552-36a7-4950-8816-08e637cac76c", "comment": "Malware payload (MassLogger)", "value": "297e7e90438f31ab11ea6e80f382ea1e", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467888, "uuid": "e6a10a74-c95b-42c8-b74e-1d81f9c589af", "comment": "Malware payload (MassLogger)", "value": "b8ef301324079d1aab7e18d6f6f89c13bf18b6c02a2c400a7c278fc0e905adb1", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467888, "uuid": "b9087164-36be-4565-aafc-b77d538589aa", "comment": "Malware payload (MassLogger)", "value": "9b4f3f65667c8145c9a5211ebbfa3501969e3389", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467888, "uuid": "5268dfd9-9f98-48a6-8127-458fc9373964", "comment": "Malware payload (MassLogger)", "value": "c788ce65dad9f3858ab1b02b1ac12908ad831e611455d155ef313720b2e3d9da6e3bf79a97b14242c47737c4e2c87b9f", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467888, "uuid": "10235605-087e-4bd4-822e-837b83624ef2", "value": "T13C3523116E657CB965104320A1BF6EEE81A29F3304B8D5DAF9FCD0D93F72B04635B826", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467888, "uuid": "93ff09c5-fde8-43be-be0f-4fdf765b37ae", "value": "24576:JPgDP3Dl9CGJxp+FbM+1A4Yio1AbnfHNN2kJeVtHxmZyI5:B+7vtx+FbTA8vNUrMZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768467888, "uuid": "4044ceb8-ac02-4bb2-813e-aeea417f6b27", "value": 1090035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768467888, "uuid": "ee240bbb-5b5d-4908-81ac-025678b62c2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467888, "uuid": "40a1d463-849b-49ad-93fe-d2e0dd9085e8", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9d7c99-f1f4-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768469143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469143, "uuid": "025f929b-a3d1-4622-b506-d96d56af0e43", "comment": "Malware payload (AsyncRAT)", "value": "92d717973ec9ba85b6e8e51f54b767f0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469143, "uuid": "dcd35e23-e97b-474b-87d4-8333abb3cbc8", "comment": "Malware payload (AsyncRAT)", "value": "ba71e29cb4efaf88f6781c45de08fe6c878bca75553dde82c09e4c3612d1d834", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469143, "uuid": "e0a4bb9f-6484-429d-9001-cfcc52ad44f6", "comment": "Malware payload (AsyncRAT)", "value": "70db3b4bd20ce133278a1789768ebd0aa2c84acc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469143, "uuid": "c7700edd-201e-46b4-97a0-c67741f8f106", "comment": "Malware payload (AsyncRAT)", "value": "b95c2045cf6275b26667bda87577859cd58dc57b5a2004c544e428aa909a5a0b405a1904bdd4e9c766fa09fd4a68128d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469143, "uuid": "c3f0cb50-07cc-4181-962c-30bd6014a06d", "value": "T1AB232B003BE9812AF1BE4F7899F26145467EF6633603E54E1CC451DB5613FC68A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469143, "uuid": "eef9724a-4abb-42b3-bdfa-2522e4d6ec3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469143, "uuid": "222a780d-3e1d-43ff-97fe-bcc9a5a04996", "value": "768:lugLnJTr4U8VPWU3zm5mo2qjAORoACBQvSNjPIazjbsgX3+G7oC8FV8zBDZhA:lugLnJTrP8u2XORzPSKa3bjXuG7oC8Ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469143, "uuid": "552278cd-b108-46b3-a5d5-3959abb4a549", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469143, "uuid": "cfcd6acc-53ee-485c-a65d-3aba998bddca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469143, "uuid": "457693f7-f670-445c-a03d-b5b1af211c4d", "value": "Slimjet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea5d3ee-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768463862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463862, "uuid": "9746a285-fe20-4faa-9432-7088fca60fd5", "comment": "Malware payload", "value": "a8eb29ad63b0f818e5bfbf8b676536c1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463862, "uuid": "e163b914-9dc5-47b3-b7cb-3bcfe5f4599c", "comment": "Malware payload", "value": "bb585a7f30f1754ebe35807f1f05c03dfc24492ad90843d5caf6ab597ea5f3ad", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463862, "uuid": "a5df3d6a-2c71-4095-ab45-3bb8621bfed7", "comment": "Malware payload", "value": "21c484917d1e318e5e44a8e6c37142f4b0c50a6e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463862, "uuid": "338108b0-a90c-42ac-97d6-478e8d13ef43", "comment": "Malware payload", "value": "d9ed222b9fc9ba1f7903cc45022d5ceba42a273f68e9a1413c563c59277f8fc5ed208b67478c273a7eb842aaf0c22790", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463862, "uuid": "cab8da38-89b9-40e6-8e13-c732682015a3", "value": "T1BB4121CFFA064524C53347954AA9EC1EE9509C7387A82095FD9C54C58F323BCF2A42EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463862, "uuid": "ea72cc68-8b37-483e-a142-04cb7c47b870", "value": "24:XRPzBMxWNbuEMkoOMcMO6RMto7uMvlOMonN3NOJ/gAsEOwv80j1HUhG0f:XsWNyqSQo78N4J4AsEOsgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463862, "uuid": "e55a2b6b-709f-483d-891b-dbf247cbee2b", "value": 2235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463862, "uuid": "dd8d791f-4678-45ef-8c23-09a62acda188", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463862, "uuid": "5dfe3ec2-c9e7-4fda-8011-b7ed06857e3b", "value": "main.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9133442c-f238-11f0-a129-42010a9c0007", "comment": "Malware payload (MeshAgent)", "timestamp": 1768498521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498521, "uuid": "54143729-d5b3-4a30-ac9a-8b28a75c10a5", "comment": "Malware payload (MeshAgent)", "value": "35175b2367fff4af67bb388f8d1fcddb", "object_relation": "md5", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498521, "uuid": "e123928c-c41c-4099-b5cb-e0d607a68400", "comment": "Malware payload (MeshAgent)", "value": "bde5b0c082a903684d086caa4ebde2879ea2e6cdc2fbeb18d1f8d78e451ce7a5", "object_relation": "sha256", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498521, "uuid": "c03270cd-2ad2-4b4d-b95d-090e3910e674", "comment": "Malware payload (MeshAgent)", "value": "ba53e364c85db7a42606badcf078abd6f7954af6", "object_relation": "sha1", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768498521, "uuid": "aa971380-606c-4b25-a7ca-518da1af6ba0", "comment": "Malware payload (MeshAgent)", "value": "7e4645ca4249eec31d2da9df937a797baac1a5db8203ddeb2a71c9c7995aa6f3314e973d62abff2df04c154c5a81a078", "object_relation": "sha3-384", "Tag": [ { "name": "193-149-187-81", "colour": "#0CA120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498521, "uuid": "eb7582c1-4954-4725-9a28-54a01f026daf", "value": "T1D4F58DD2A3A600E8E9B7F23C85568517E7F1B81753709BCF16A44A761F236D12B3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498521, "uuid": "ff6c123e-3b30-4417-bff7-4412be602f60", "value": "fb0a8b4a81655f744a37af985e009476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498521, "uuid": "4f81286a-205f-4e1b-926f-843a319eaa0b", "value": "49152:rdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxM5S0y:5HvfGfZvZj1/N/z/oMkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768498521, "uuid": "c8203e64-86ef-41ff-b845-f45fc88cbe80", "value": 3519176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768498521, "uuid": "f6378783-7ca0-46be-8c8f-42c8e11004a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768498521, "uuid": "e67c4a66-cbce-4cea-9b8f-360622b15bcc", "value": "exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b082c547-f255-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768511029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511029, "uuid": "6b9fec1c-3802-40c6-9702-4acd15867669", "comment": "Malware payload (Mirai)", "value": "e2d34f6809be39c09b5e7967421f2bdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511029, "uuid": "fa7f60dd-dc6f-406d-bcbb-a520f59faba8", "comment": "Malware payload (Mirai)", "value": "bf02d91e46ced101cd61907416ba5d93ac60cbb14cc3d5680a06ccc5ef8b7272", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511029, "uuid": "d2656683-f922-41aa-b1c2-e30a39665896", "comment": "Malware payload (Mirai)", "value": "4a7818cc852b95ce9eedf4b99410ed7dfcdaffdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511029, "uuid": "400fb287-f72d-4ab3-865c-7236daa7bccb", "comment": "Malware payload (Mirai)", "value": "ea71f8281534195a303563fb39408f0af9529be920d313df01d9b39382cdefd80440e5cb737380ebc13bba6cbaa4c9a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511029, "uuid": "d7a0d8fe-e8d0-4430-a7b9-b7f7a5acc88c", "value": "T129A2D11572632D65F3ED1C3DC9AE8357FDA70BFC80F6327669445620C94D24A3E38A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511029, "uuid": "53cef6dc-44a3-436f-9edc-7aed0ef34db2", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjthymdGUop5hw:vvQn4j+ZO5fKAlxRs3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768511029, "uuid": "86c547b3-606a-4544-9707-1a817f2ecc8c", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768511029, "uuid": "9f06bf6b-218e-449e-9b3a-5cdb211f57c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511029, "uuid": "f156c988-31dc-47a5-a065-a982af7ccaea", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0becdd7c-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1768466085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466085, "uuid": "0e42b5de-adf2-426d-a7d3-7c86420f5088", "comment": "Malware payload (PhantomStealer)", "value": "aa4fbf6ba4f3caaced66058d0053765d", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466085, "uuid": "fc316d6e-a502-4426-b312-29217a57882a", "comment": "Malware payload (PhantomStealer)", "value": "bf73f538cc8750a1fa878fa39ff1040b0520b005b7e2de3bc525223bc29d7c11", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466085, "uuid": "5d2ccbae-a1bf-4cfe-8e31-1ecc6063af62", "comment": "Malware payload (PhantomStealer)", "value": "9d35e1ab2fe1ac7fc1110b9bdbe9be28e5aa9c29", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466085, "uuid": "e4dc2da8-edc6-4226-9c77-aac14db8d739", "comment": "Malware payload (PhantomStealer)", "value": "b347ed8b2ad303877ec93fe75b457e2962562c181d4b413d6a3718b3bfceab8a7fbdb998bd7436cc60c3b1195b03f060", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466085, "uuid": "9d017495-d5aa-41fd-aefe-af4e9d6f99c6", "value": "T10AF533012BD82EAD0FFCD368706F1D0B2AA54F61508AE6E371ED74C6973EB816057E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466085, "uuid": "f87b3d3f-f4b5-4516-9cfd-d6b3a4c15b9c", "value": "49152:xmLOxFXranU1qcVlLkmOdrLkuSu3JJ+eFUiJJHD0W19:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466085, "uuid": "8fa2b041-90ce-4284-b960-e2527c53ace8", "value": 3379053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466085, "uuid": "3f60fcf3-15e7-4adc-b374-e655307a10fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466085, "uuid": "6a2a1b1a-46a3-4044-8252-5e4e51ecb08a", "value": "richard.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5958ef2a-f223-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1768489408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489408, "uuid": "267b9f7c-ca01-4647-9f16-940f601ab155", "comment": "Malware payload (HijackLoader)", "value": "a6d569441d4173a206c2c3730517d5e9", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489408, "uuid": "53a831d5-5bc9-497a-afa9-4562713fe212", "comment": "Malware payload (HijackLoader)", "value": "c04722211255de54faafc17886be1a4bd3fb78dda3854f43d17047689a1d9a32", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489408, "uuid": "20f1d5b2-5c99-41c7-9ccc-b3a36d5d4c3c", "comment": "Malware payload (HijackLoader)", "value": "10c884caeae05409121263932e07f868c5f2ebb8", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489408, "uuid": "05fd4640-18ee-4a73-a08c-d2013dbb3106", "comment": "Malware payload (HijackLoader)", "value": "bf0d31e6a3934f0fc506ad457a4b2d016eceec00d5e5f91566f061bc9a0ba5bd3b02f1e09cae3ab88e5148ccdbe28cc1", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768489408, "uuid": "6ff35fc8-d2f2-4355-bfdc-3e11b3876eb4", "value": "T1CF763354FC5A934AE690A63DE92FDB64E1F8EE018F51D4470254B2B4AF3B032272F54B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768489408, "uuid": "7804528b-72b5-4b60-a840-81d00690c212", "value": "196608:erNnNUCpdj9Jndd6pX3yJ0nmX5xHGEBwi:CNNXxGpshw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768489408, "uuid": "e5f54934-9f95-4c29-8fe4-ee81027cc196", "value": 7720960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768489408, "uuid": "0bbbad8d-ab86-4892-9ef6-97a95147aa34", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768489408, "uuid": "9894c4e7-52a5-4401-b61c-690ee4f69e4b", "value": "LFGBOPVP.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a0a5a7-f234-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768496814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496814, "uuid": "10448e5a-cca4-4b14-8ed8-a9afaa52ad53", "comment": "Malware payload", "value": "1003a20a5e940381b8ed3d9c1ecef57c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496814, "uuid": "ff4259d1-ab61-40b5-8e07-8ab23738b190", "comment": "Malware payload", "value": "c07d06adc9c7e3e5516508f737e02ec20dcb167b341705127d695d394b983cfe", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496814, "uuid": "f5d43c14-34fc-409f-9bb8-4d754879a4ec", "comment": "Malware payload", "value": "85b7f26a301a802ea4020af0d0deac2e733ead3d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496814, "uuid": "4489b343-3e01-4422-b6d1-7313d92651e9", "comment": "Malware payload", "value": "f86572b1a0f95507bb4d4d07af222afb88d7e3a5aaf9d139c80a05ff2a3beda7634ce14f8457c83ab5116bc6e5d068c6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496814, "uuid": "b4afc01b-e7bd-4960-a55e-8c639dcacf67", "value": "T1E2C2E83BC844AFF01B6FA1A2DD4B2C158595432576343A0DB5CE99EC2B39321CFD51EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496814, "uuid": "c654cc43-5717-4983-943f-dff493af4833", "value": "384:K6reezgkuN3QffcGeTVhujjTXuum/KntRJdc69+aI1/oJePDxU4s/a+O/Ph:KJCgkulQffcGAUzu4hh6U5av/Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768496814, "uuid": "15bdaa66-3b11-4e42-9b27-38631e01dd0d", "value": 28281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768496814, "uuid": "2c468e3b-7270-48fa-8733-c11fea600cab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496814, "uuid": "196edd75-a4a2-4817-bbf9-96fa53ca407f", "value": "andre.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f362cb45-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1768463467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463467, "uuid": "6ce617f0-2ef6-4cbe-8667-815933c6d26a", "comment": "Malware payload (PhantomStealer)", "value": "f6bd5fdbc0205d413b60c477b64ef877", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463467, "uuid": "6d0d54c9-08de-43c4-8ddc-2cde65b1c9a5", "comment": "Malware payload (PhantomStealer)", "value": "c612385efecaca9ec7446fdc629d871a12fbcfca9ed45c653faf20361d3105c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463467, "uuid": "ca0f97df-b355-4413-b76e-94d8ff026d67", "comment": "Malware payload (PhantomStealer)", "value": "328681b0c8f54c3cc693a211e2fe09b232b27d74", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463467, "uuid": "ff710cd4-3718-4e23-9dd7-11e3718924e3", "comment": "Malware payload (PhantomStealer)", "value": "5d4518e4cde40e1ed9b40980d97b572b61c8d053c70369486932321c866fa1f716146392cffcbabd4bd9eaf5f457e246", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463467, "uuid": "0f3da1d4-8a82-4178-99a1-38b08630027b", "value": "T146661A48EE048DD09B764EB93F737AD580D565536D8B42B8F83E54B1AEE3180F861F28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463467, "uuid": "81958547-5beb-45cf-8b17-89a389a8d3e5", "value": "196608:/4W5Fr43V9Hz2E5s2g8GT83GhlUFRKqcwREsvkA3BoeSY6vnDZHucL5rNF:/4Wc36UBm8xkrwXvkA3BfS/f1H35hF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463467, "uuid": "e3256807-463b-40fa-9382-62bf60a2c335", "value": 6522444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463467, "uuid": "572385e6-4bd3-4c00-b935-7b3262cf09c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463467, "uuid": "77b75b28-3227-4637-bdf0-cdd52046e509", "value": "DOCUMENTS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1195a07-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478469, "uuid": "56ae5977-598d-4683-8e4d-d7f1110f2f3c", "comment": "Malware payload (Mirai)", "value": "e485361dc8a684615abf779b92936364", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478469, "uuid": "80710047-4ae9-417e-a2e6-558553f63413", "comment": "Malware payload (Mirai)", "value": "c65b5e2e02bc092b78e4a07f7a8cbda2f84968e119fccd531a669930ad64be49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478469, "uuid": "da938384-d414-431f-8316-7a46753086c6", "comment": "Malware payload (Mirai)", "value": "5f32fe346be81ab07aa5c07a93394da53e9dea5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478469, "uuid": "ffd48001-1a76-4ba5-9c1a-513dde9eb465", "comment": "Malware payload (Mirai)", "value": "1baa118896effc44a23003faa39cd4bfe8f7adcd32bf47b62298a279300957cd0c37e56081206b23de60a4af53dd1e7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478469, "uuid": "1de1ce36-43e3-4b07-b4ef-eaf3c6f8c4ba", "value": "T19B03E7D6B551BB39C2C146B7DF6F411A33489798D0AB3353C82C17D4B98F94A0E5BB0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478469, "uuid": "8ee4d36a-70ff-4a3b-8110-a877d02fd524", "value": "768:tdKD64khjVcSBcCmTlH3mLwCVy/Jx+5H8hG1rmCd/574y7fqUydjRuLEpQ6NHfeu:t3QgcCSlXMeZW95Pk1y1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478469, "uuid": "314e29a5-d156-49ae-9e24-e8aa9fbf5281", "value": 39728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478469, "uuid": "a4b33530-53e6-4eb6-8c69-7e557d06f934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478469, "uuid": "d1e7d622-c39b-4211-8282-05eeeedf73ca", "value": "sumrak.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1d7e41-f250-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768508847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508847, "uuid": "93ae6966-0868-49ea-8327-b2354600faa8", "comment": "Malware payload", "value": "87012fadc2ddffa9be41f320459cdc02", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508847, "uuid": "348d173e-17e2-4df3-95c7-aa2a42cf9b40", "comment": "Malware payload", "value": "c66eb1b2afd0c196a0ea89d5f90c1ea36e349e825cc5fd8df6efae766da86c24", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508847, "uuid": "8e45ad81-8e16-4e3f-9b91-5d29607b600f", "comment": "Malware payload", "value": "2d03a54b224700b4b93896ff0bfdcb359f3ab170", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508847, "uuid": "cec5dad5-a9fd-4114-a3bb-7e98be25f514", "comment": "Malware payload", "value": "d2cfd5d06af9c7868ae563079dbdf83bc1c81e4b3f3f1ba92aea6a96d4963c8c4fabff36a8dc5fd5de47b34a3e63f5de", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508847, "uuid": "deea63ca-04e1-4af1-a82e-b48f155a9de4", "value": "T1FEE42A067B95CF23E16A5332D2F71C004BF4A5467623E70F3A9127B929833669E0677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508847, "uuid": "bf8fab71-0535-4b8f-9b3d-4c033719aa93", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508847, "uuid": "e40c903c-bc6a-47f7-9d57-9ec96aaa0406", "value": "6144:ViNwWGyLmX1E+ntBjW+7s+gjXrgkfmWA5EbijtZUQiPDRcZguofZ962mgxyBa77:VDyMtBjW+7ve7HmKijXJiPlcFoR9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768508847, "uuid": "838047cd-c5de-4261-aeed-499fa5596d77", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768508847, "uuid": "0611c6b5-c029-41ab-aaba-1d394de31e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508847, "uuid": "56fc86f9-2438-404b-9af1-402aed3a7086", "value": "array.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19022029-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload (Kaiji)", "timestamp": 1768500467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500467, "uuid": "a6793524-b2ca-4449-8db0-f9702001e117", "comment": "Malware payload (Kaiji)", "value": "e1e890deb41f47805f47b334eafe26a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500467, "uuid": "5482f341-d3f1-4fc8-b6b8-9d37ece7f78e", "comment": "Malware payload (Kaiji)", "value": "c7c98a5ba966a7ff410bee89fcb3c3f4088c17dc4b1dc0ec5382407b7c4e1f41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500467, "uuid": "91a576e2-ed96-483e-8c46-2b177e264ea6", "comment": "Malware payload (Kaiji)", "value": "1f32baece3ddc48b8d1959b15702350a68e17970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500467, "uuid": "c88de782-3ddd-4a89-b510-355c475ea3b7", "comment": "Malware payload (Kaiji)", "value": "fc5ab3d583c6c966c0af5065916e10f0b138c0a580b648409cb02ea50ebda928bd510cdac2181660ab48d9b7b80c702a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500467, "uuid": "d2befc8a-931f-4aa1-b136-042f7623bfd2", "value": "T102B5D615BCC42BEAC02C5F7898E6896623A45D044FF2573625A4FBE9B8762347F47C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500467, "uuid": "9c0535e0-f509-477e-8f5b-7cd84da0c422", "value": "24576:kO+PuaNFZRml7/I1n0uOakVXFYd+lCQYWz1v:9eNxxd+lCWz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500467, "uuid": "f1185745-e7bf-4ef3-a796-7a485674fd22", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500467, "uuid": "1f9225dc-930a-4d8a-b3c6-7ab24f31e4c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500467, "uuid": "b1a09a8d-58c9-491f-90dd-aa40d155ee8a", "value": "linux_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc5b495-f211-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768481602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481602, "uuid": "31f3d5f6-e7b8-40ea-b563-c5dc6637e56a", "comment": "Malware payload (AsyncRAT)", "value": "eda815959b0889e34360da8713650a31", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481602, "uuid": "7ab76d8c-7780-40a5-833a-003d6446e93a", "comment": "Malware payload (AsyncRAT)", "value": "c8c4f2f6c86ebf60afc9073fc0bdee91a1376097f824d25cfb5bfb9eabcce17b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481602, "uuid": "47f546d7-6917-48c4-95c2-7e8c5e30972d", "comment": "Malware payload (AsyncRAT)", "value": "37273eaba8e45c735ad17df672667aa587724c8f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481602, "uuid": "b5bcf602-e282-49e2-92eb-20dc9c98ab07", "comment": "Malware payload (AsyncRAT)", "value": "6a9d1b630ff16eca3ab81e3759b817332d0b25e2c9b1c61ec4af4b1525fa2d5b8eadb8c81760c01013a55b4261df9727", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481602, "uuid": "54385a50-d5ed-4129-b94e-a051856926c3", "value": "T1E2638E103BED813BF2BE4F7499F26245467AF2637603D64E6CC4518A1613BC68B42AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481602, "uuid": "38211452-a8b9-4107-bbd2-3fe1ee9f0a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481602, "uuid": "43023c02-6fd7-470a-a26f-c6370f7bb84b", "value": "1536:CuKYpTtyC2Kfob3lk3bHXSMeaZCKu2E8KddTWMqJPhlCgXHh+bHTeF5:CuKATtyC2gob1k3bHUaZtPKX7qblTIHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768481602, "uuid": "9bafaf87-43a8-4b66-8dfc-f0ca3b2e1113", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768481602, "uuid": "a49474d3-29d3-4f7b-bc78-56b73f08b37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481602, "uuid": "4fe8213e-2845-4c7f-afee-a3d5e3481af2", "value": "Waterfox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175ac240-f20e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768480278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480278, "uuid": "023fd752-0d81-49b7-9759-036efa67896b", "comment": "Malware payload", "value": "6aa345742f02a14a9c508419c7f08dba", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480278, "uuid": "25549c97-0eed-46cf-84f8-7fcd10bef248", "comment": "Malware payload", "value": "c9a5e60fd024d07aaf86a0403edc8a3d0af5fcf8bd3216925774096f6ceab326", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480278, "uuid": "3a0dafaf-ae35-468d-bdc8-51793a79bf66", "comment": "Malware payload", "value": "f24b759219eead7aa99adeceff8cbd4834a292ec", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480278, "uuid": "3a549086-9c85-4c33-b1ce-823d57c22861", "comment": "Malware payload", "value": "c4ba4faf18b1c5033d5c830be450f4eee85220fa179d8059526e0ff33867d8ddb984df6db16dc5fdce33fd4cfe052e55", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480278, "uuid": "0505d31c-2b2c-48a3-b516-71f7138c527e", "value": "T1D2B53341BFC74FF4F2A5A578160078827C7CFA741BE84ACFB39C44485AB52E1A6FA605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480278, "uuid": "29116c11-a052-4394-890f-394eaf4f3922", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480278, "uuid": "05b3b08a-f727-4f54-a4df-170ad7a4c75b", "value": "49152:EgwRvFs8pHZZqygAaByTlT+dSAOJoNQiTIhxExqFBo3LWXWM:EgwRtsiHZAy/aMTp4NQiaEY+WXWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768480278, "uuid": "75ac7916-67e9-48c5-9acb-7535d6e8e1c9", "value": 2343255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768480278, "uuid": "773483c7-080a-4a43-a0b5-d6a2f5cdf19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480278, "uuid": "cec300a5-728a-4665-a04e-bc0633b9a0c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16387fd3-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload (Kaiji)", "timestamp": 1768500462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500462, "uuid": "7493432f-b139-4900-8cb9-3fdd093789be", "comment": "Malware payload (Kaiji)", "value": "87d63afb25f96b8236737fc2a7dacf96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500462, "uuid": "f753438c-8ecb-46b6-a9e4-e50d7eae932d", "comment": "Malware payload (Kaiji)", "value": "cb37d6a32f360d1e79907595a2b0d00916cb3e7e306dc320711b3e0019d991d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500462, "uuid": "5d186412-040d-46b6-94a3-ae08dc97111f", "comment": "Malware payload (Kaiji)", "value": "9e11d20e21139f3165078fbb508e03f4c46d050e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500462, "uuid": "bec650da-e247-4b83-bd48-c90d9e3bacdb", "comment": "Malware payload (Kaiji)", "value": "723e1400d5169742f529766d9e257477307186df7c4d05a67d3cf318f060058ff6b0d3973af0f6e88a5392ca27685bd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500462, "uuid": "2e4df7c7-fcd7-44f8-82cd-d0a7621344a1", "value": "T1E3B5F80ABDC16F7AD59803354AEE165A23513E495B91072327A4F7B83A7733CAF1B488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500462, "uuid": "57fcc329-6155-4849-9808-c2833cb6a63b", "value": "24576:mU9tyqIId8F9/dQbZ97G8J9C0OVXc8RuMFLGk+koAe0G4Zz1v:AqIIqrlQtG04uM9Gk+CeCZz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500462, "uuid": "a9ef3d70-75dc-40b5-9e7b-75fa68c79094", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500462, "uuid": "c4e9cb8a-11f6-4e0e-843d-f7ca656ef5d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500462, "uuid": "939ccb81-d4b2-4f88-95b2-cb5f22319fb1", "value": "linux_mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba35591e-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463801, "uuid": "31365abd-a1cf-4386-abca-1ae23933da0f", "comment": "Malware payload (Formbook)", "value": "d9fa849295c06371b5f08a9e5fcff97b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463801, "uuid": "67480099-716a-4958-9f76-8db1dfecf23d", "comment": "Malware payload (Formbook)", "value": "cbf209c6bd98f98216c3c1f6f82956cf85ac1f7841e3d9212382a7d56d04bd9e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463801, "uuid": "2575be33-31b7-43ef-8eb6-a05a6c07f0d3", "comment": "Malware payload (Formbook)", "value": "26ed9974e2113bd905fa1a7bded9da77cc88e53f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463801, "uuid": "5ca2522e-cf78-45f1-9f0b-9fe409284f3f", "comment": "Malware payload (Formbook)", "value": "b930f6054314122aeef9617a73cd310909f9e437cf4a5c39ef2fff5ccfbf0164334ef2eb577734ec553c14900353ec1e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463801, "uuid": "fe3dc9f1-ec0d-446b-b013-902005399a5a", "value": "T11FA376883FC6F07193657433692FA0EEF27E0C91760C8196DAA760D4BE5CB18E2B595C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463801, "uuid": "251d8a24-f1a9-4eba-a7c7-b3de162fe666", "value": "3072:OT6fPJptwTmqAz7vcHk2CzlZR4GRricgg54oRuyrrP9pn19e6msCLP/:y6fPJptwqqAzsk2CzlZR4GRricgg54o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463801, "uuid": "7c0facaf-5695-4104-92f1-485c8d2d2ccc", "value": 101442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463801, "uuid": "11ba4586-383b-4d1c-beaa-b255e3f80d65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463801, "uuid": "b896a27d-88ea-4877-97c4-0e5ca6c96210", "value": "Request for Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d46758-f223-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768489513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489513, "uuid": "30eb7522-833a-4f88-9b64-a81136a6f001", "comment": "Malware payload", "value": "bce6ac7d5e820709267e55309d91227c", "object_relation": "md5", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489513, "uuid": "934f7a79-b179-4f51-acff-3e1f3005c19a", "comment": "Malware payload", "value": "cc3d3d40dd45115d1a492998dd0a502df2f5352a555dbce0bed7da87c3a370ce", "object_relation": "sha256", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489513, "uuid": "7f56eae1-57f1-4d7a-8777-6da027ee5903", "comment": "Malware payload", "value": "0afcb65348bbec1bb0aa1c57a7c3dfd53b0d349e", "object_relation": "sha1", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768489513, "uuid": "065462d4-e759-4a2b-bb4f-64fcb9bde238", "comment": "Malware payload", "value": "0c4c39af2f5d23690f8aadfc3658cbe2c3bb3f77423bd4bb19ee5dddc9d1d0061a92c1bfdca33af268aa7ceac1aaa385", "object_relation": "sha3-384", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768489513, "uuid": "fe07806a-94f2-4008-9cba-25cf11255ad3", "value": "T125E3F9718CCA9FF8833A1890454CEF0AAE764BDF4229142BB11D3695BF504B15BAF97C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768489513, "uuid": "da6fcea7-33f6-4174-81f4-014322a525a3", "value": "768:eWI2OKSzOM8+YxF0p7GBGsIImHYwquG+ha92WYg:sYlGsI0uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768489513, "uuid": "4483da15-3b26-490d-af0a-b8eba4cb5f5b", "value": 144795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768489513, "uuid": "cf88b7f8-c477-4dc0-884b-59a342b3a7ec", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768489513, "uuid": "7dbbb355-f282-4e0b-82d1-192151562ed8", "value": "client.msc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb82646b-f20c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768479775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479775, "uuid": "a2c01390-301c-4528-8f9d-34c7125b8362", "comment": "Malware payload", "value": "32fce90d8981d6cfba0cd1232b186b7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479775, "uuid": "1d7f6f19-0a15-482c-8bdb-0f2618f8c390", "comment": "Malware payload", "value": "ccd60b3ac39e403f2605cd4b4a3d78fa13c0fc187808a9e5adf1db9ed5458507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479775, "uuid": "2e088a19-4f1f-4698-80e6-0a9c3365f9d1", "comment": "Malware payload", "value": "904bd1f352f3a80c874fb8ded1a88216161df559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479775, "uuid": "52959eb2-effd-442f-ba05-914694ab7ec8", "comment": "Malware payload", "value": "dd77e2c5041bcc4f81d45c216bcaaf5460757722572d56b14b643fe5818f875df18e9a620e916a41986f6c1a86485f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479775, "uuid": "eb5d7511-a58e-4a33-b123-7f9b0af3141f", "value": "T15905E1F071D900B4F492C7B955BAAA5A8F236A1137F5335B75C3CF487F6A23804A22E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479775, "uuid": "e1ef167f-5e81-4f88-a381-9d6d30235ec4", "value": "5242b0ed4763da1225bd5bdb010c64e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479775, "uuid": "e27875e9-cc85-45c1-9b56-98621a9fa4b9", "value": "24576:rvbjxKHlQ/Jrv0CrjdHKgmWR/he5QxbEn1u7MHUt:r5NrVwIX4n1u7MH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768479775, "uuid": "03f9fc12-3322-4762-a0da-cea61ef34d94", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768479775, "uuid": "839d44ff-6917-4f3a-ada3-d70b96586e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479775, "uuid": "59bf469f-bd15-4bc6-8125-64e0b0990143", "value": "msys-2.0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3658b4c-f256-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768511463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511463, "uuid": "91ce1874-1586-4eb2-8124-23f332646b60", "comment": "Malware payload", "value": "3e0b4b0f5e24a18e6f3d1bff974d1b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511463, "uuid": "3c026388-aee2-496e-908a-f753e204feab", "comment": "Malware payload", "value": "ccfdcc3204454746b92fcb1f4e504ac9447064fb449805086eb73d46e8cf7810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511463, "uuid": "f2163b94-1039-424d-807e-a39b4421b2b2", "comment": "Malware payload", "value": "36da39beb61493faa3c58af62ec7235115414d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511463, "uuid": "b75307b7-13ec-40c6-8c6e-84b22adc47ca", "comment": "Malware payload", "value": "8d09fde42670e091f07149815e254e05b5780ce2876ed001ad2676631fd109850437d0034d42fa79d3d39c7f8c43895a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511463, "uuid": "a30c5b84-e0c9-4db8-b222-8ad8ceb35de1", "value": "T14C15AB4146D1FC8BE3712A7082A9F34D9A653F30EEA5470B61BD316C5A7BBAD800E357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511463, "uuid": "cbc6e5c8-a334-4413-bd95-1bbc9db5856d", "value": "dc6ed794f6887c00d3531b39caf32062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511463, "uuid": "1b130fd1-5769-43e7-a30d-9f6d228825cc", "value": "24576:UDfKIjKNUWX1Z6f44rK57YZf2JjBn5J1U20:8iPF6w4M91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768511463, "uuid": "40dce62f-0791-45e5-8274-202bb9c11c08", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768511463, "uuid": "dec341be-bed9-4dbc-99db-8f026f5270d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511463, "uuid": "2c96a0aa-ce0a-48bd-abfe-b4b33817115e", "value": "Bootstrapper.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6835a6f-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463446, "uuid": "4a22850c-68d9-48f9-bdf0-48dca1b39c80", "comment": "Malware payload (Formbook)", "value": "3359f9277392e60f5a4a4b283906ca8a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463446, "uuid": "ac1fb5f6-922d-4645-a505-22acecf509cd", "comment": "Malware payload (Formbook)", "value": "cd37d27236c576fe12d6e246689ba3404ce6fcd0ef9c0ff8c0e5ec6c09b1f60a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463446, "uuid": "fc2ed5b9-2c55-4412-a36a-34f85aa586ba", "comment": "Malware payload (Formbook)", "value": "7e63f20efa9c9889d60525ad121d1b4a15026eb2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463446, "uuid": "ea62b25b-231d-46e7-9150-9286abf182c4", "comment": "Malware payload (Formbook)", "value": "85242b1e14093be368d1ecb0b2283e529a49f7803955ee0a1d517568632614fcbf6676d5cac1b7d5d01123f659adcba4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463446, "uuid": "bd25afb5-e36e-4405-8af2-120f863606a6", "value": "T17A6394CD7FE6B671276160732D1FA09EF62E5C88790C8095E3A7A8D0F92C318E27565C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463446, "uuid": "eb32ada8-a592-4ccc-833c-379482cf0b13", "value": "1536:fSHmCsjI0M94B+4ipYyri6r+jXGGoFQ9OXV8V4sq2ZxnmFe:cmCWF+4ipYyrifwl2/m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463446, "uuid": "176af431-cdc2-4de8-a4a4-c3bbbbc097ba", "value": 68742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463446, "uuid": "b398cf39-027a-44be-9e5d-239d98fbdeef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463446, "uuid": "3e1ca4e2-e4a8-4a3d-a8a0-4eda6bc0d6cb", "value": "MT103-11320260889711219008262_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5cdfc8-f200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474647, "uuid": "02efbd30-008f-43ca-9d07-d194c0252428", "comment": "Malware payload (Mirai)", "value": "f446de0a146f9f3e55ed7973c00b98ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474647, "uuid": "374a6ade-c8c0-4e79-92f3-3d39c20b4409", "comment": "Malware payload (Mirai)", "value": "cd448c4c5ad8fad3437f718a8412082eb4e8c2892caafd40a488a338661fdd33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474647, "uuid": "022639dd-156b-4540-b005-625ee8be80da", "comment": "Malware payload (Mirai)", "value": "af1b451e402b10a2b601574c305f91c40b20027d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474647, "uuid": "3679bf9c-3388-4c10-9dd6-3461fa55f66e", "comment": "Malware payload (Mirai)", "value": "98583de50b7719017f4576da7bcda252bc4a4fdc92f6f3bee115f19e81fb8b7ea89be5730ae38c89d0a6787c0ab68168", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474647, "uuid": "a4cc67b2-dced-4a86-9a55-636fb748c34f", "value": "T1EC834B31693D2A17C1D0A47E12F74758B2E22B8E25E8CA5E7D720E0FFF54A506413AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474647, "uuid": "2aceef98-51fa-45cd-9b60-32a438752dfd", "value": "1536:/AYX5uNKUq1et03jRI5AnZPrqPSj/sYxJmsRE3udoScta5ZN:/pRFJDsYHjK3ud8a5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474647, "uuid": "03d868a3-063b-4d14-8c3f-dbf86dc336f3", "value": 80864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474647, "uuid": "5076da18-7710-422e-8b60-1b3d577f1854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474647, "uuid": "43e667ec-7714-4469-9394-2bca1adaecc4", "value": "UnHAnaAW.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabe174d-f255-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768511073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511073, "uuid": "3aef3961-67c6-4241-9ca9-09cb9a325b9a", "comment": "Malware payload (Mirai)", "value": "52fca9f892f8b9d02fbc84a882eda83d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511073, "uuid": "25ca65d3-9e99-46f6-a9e4-9adcef14ca0c", "comment": "Malware payload (Mirai)", "value": "cd4797f7b75fe137719c45b5b6f4cf1293aef55fa8f59ed216c69d3c045dcb01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511073, "uuid": "e2d4e109-e2a7-4b54-b32d-efc20a58f737", "comment": "Malware payload (Mirai)", "value": "b780802b17518cb3649f1f295685887dd5e522ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511073, "uuid": "46847fc0-9d8d-4bfc-9427-e16f7ce0e538", "comment": "Malware payload (Mirai)", "value": "9d43bfeba94d28512c5ab64c747dbc897b917676a4c378571de7efd6c27a0556d829bd18187192edea7ee25a6324cb6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511073, "uuid": "2d9c1c83-47a2-4c6e-86fb-bf71be304316", "value": "T130C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8675F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511073, "uuid": "8ef73d65-af75-47f3-a1ab-3247351ca5a8", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHogrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIgrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768511073, "uuid": "4c3c6859-4264-4b99-a04b-a4ebd2ecb226", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768511073, "uuid": "7d862a6a-775a-4023-bd33-b9cc5c6448fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511073, "uuid": "03855dcd-3b3c-4ef0-8d1d-c66215327e92", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de6001c-f1e1-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1768461015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461015, "uuid": "0cf9a7a7-c628-4efb-a57a-3be881bb44c1", "comment": "Malware payload (PureLogsStealer)", "value": "89785a2ce26ebbb9b7336ee6e0325b99", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461015, "uuid": "a8fe2230-f73b-41da-b7b3-8a9251e86326", "comment": "Malware payload (PureLogsStealer)", "value": "cd58ff0d92eea20452fe4be4e4714e35226a5184bcac5cd49439d927130017dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461015, "uuid": "5676a4cc-aa71-44ff-820a-994ac27fefdb", "comment": "Malware payload (PureLogsStealer)", "value": "9f18541f5f339dd6d68b6f3e98f855c9e813a55b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461015, "uuid": "5799722e-5815-4ac6-825e-816f2c7d1cc4", "comment": "Malware payload (PureLogsStealer)", "value": "fbcd41756b7664499c6f0ee4bab1e1840fbe86de114879da3c544968f0f9c8c7e0893d4e0032dbae84f8cb9e05f372de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461015, "uuid": "5e1b4e49-12af-401f-b042-617583ab156a", "value": "T1E0B384C939CAF47343B935276D1BB05AF12F4D82760C80A4D2D766A8FE68708E635D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461015, "uuid": "04f419a6-dc54-46ef-af98-bdc955d0f94f", "value": "1536:WniV3jT0jqWarR4E6lIcZ4iUK/mUJUbyzMNVp3xG51Sl2r4whuEmmzXphfj+9Ig3:WiVsT15t4XExkoVrUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461015, "uuid": "a3a143cd-a44f-443a-bc8a-4c7a5edce1bd", "value": 111513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461015, "uuid": "15d6e9ea-4b43-48f5-bce2-532c2d3f3e6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461015, "uuid": "3df09cd1-240a-4e6b-9110-f1903884f243", "value": "PURCHASE INQUIRY FOR G M VALVE PVT. LTD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038b67d9-f232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768495707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495707, "uuid": "6c175f01-11ef-45bf-ab0a-68367f4a32f9", "comment": "Malware payload (Mirai)", "value": "24fbf84c23483a743b197efd4181c2f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495707, "uuid": "29c90498-413a-4403-be55-2fd6fa68f8a1", "comment": "Malware payload (Mirai)", "value": "cdcda4765bc21b10793948ac026ab1f8c9cb724ab3068f89199c515092b5eb99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495707, "uuid": "4b7a9f9c-f620-43f3-969b-47eaa1d48ce5", "comment": "Malware payload (Mirai)", "value": "2436f375b2e832153f94e15ffac96515d9e08df3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768495707, "uuid": "7427bfdb-3af4-49f0-87bd-8b5f7d9a945f", "comment": "Malware payload (Mirai)", "value": "8f754e2d28c6711a806790d34921fdb39bff3bf6da95ecfb9ce79020380ad9cb7f38d49e0218edd9abd0942b5e1ff92a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495707, "uuid": "282d8c19-62bd-47c1-ad17-2a9960fbc1f4", "value": "T187E329C7F800DEFAF80AE33748530905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495707, "uuid": "93d15d0d-a2ec-4d04-a8af-84f843e9c772", "value": "3072:RwmzTDH86Jr78VOfJFjAv02idcmQ9c8VvjbirLCDsyiC4yn:Rw2TDH86J5njAv0HdW9cnL/yi9yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768495707, "uuid": "a55dee32-f67a-40ed-9c52-d84fb6d95168", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768495707, "uuid": "f3230264-d8e8-4b58-b068-bb142929ab30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768495707, "uuid": "3526cb78-994c-4f5d-9249-6ceb7405e42b", "value": "djmario.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2ed3b8-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768463348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463348, "uuid": "34e3eef2-2454-47e6-b5f6-4e7b98dc08c4", "comment": "Malware payload", "value": "6b044ece0c9d39de202956b9f61e1201", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463348, "uuid": "43c43413-46e7-40f0-8182-c068ae66a6b0", "comment": "Malware payload", "value": "d0f176d052da0bcc50181aeaa57d49eeb90171fc2ff1e4d2e88caf73b4e4f601", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463348, "uuid": "4a456376-0f3f-4929-ae7f-2b5c29b4630a", "comment": "Malware payload", "value": "950894f2b715bd4f5d5be09216ab6f7988153de2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463348, "uuid": "05412666-e76b-46d4-826e-b7b8f06ab75d", "comment": "Malware payload", "value": "7cc017a4dd80852b11bc38a17a71c18ca7df3cf637bdc2d956b76a873be0165d9ed98fec823091a49fe6d4fd3b647faa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463348, "uuid": "8c7b1d1a-76db-47b7-9aa8-654ddd585b4b", "value": "T13616E812BA0C436970640DC2B965D7CFEB0211EE566685AEFE1B3CC7BF806B43539D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463348, "uuid": "074e1dd6-00fa-4ba9-aa99-17913cf2f51d", "value": "96:XdKyd7RdqNKLd7/dkdK5ePd4VdqbKtd7QdVddldndd0bK5ePd4HdZaNKwd7Vd9bc:6fgjSyW9wVIv0sOfOf0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463348, "uuid": "dc6c061a-a3cb-4476-a4cf-2b6af30e5c8f", "value": 4342640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463348, "uuid": "bc965284-8dfa-428d-8cc4-7190c1cec061", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463348, "uuid": "2228d03b-1ebb-4cbc-8738-c36c0df7c552", "value": "\u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae_5734q57.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcbea0d-f257-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768511914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511914, "uuid": "e60467a3-fcfb-4c55-be08-038d96b696c8", "comment": "Malware payload", "value": "afdb60b8fe0c15fd399bf0afd26dcd55", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511914, "uuid": "73a86c00-4378-48b9-822f-ece7576c2e9f", "comment": "Malware payload", "value": "d2a8553db005c7167551925b48ac0b1d9535ccf52f8c094695b96c040f3090c9", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511914, "uuid": "8e6203ae-f09c-4ea8-be7c-dfdaf190760c", "comment": "Malware payload", "value": "442a0ac22adf8098b0324300e8255eb6830aa743", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768511914, "uuid": "d5b0e640-3f25-49ec-8c62-30204af5f44a", "comment": "Malware payload", "value": "36bb03819e882170f42b14c0b7a6d03de78fe363bd5a3ed1cb5bb6ba14e3cb13a89dfb1478b722a1e4b8654b3697f117", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511914, "uuid": "c007d9f3-4138-4136-9462-ea51f7731ab7", "value": "T1FF76335A36591DE8E02AC07482064BA3AF7274E51775F6FF02C046292E7A7EA1F3DB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511914, "uuid": "e7f0af38-0ee3-4c77-bb91-38fbed071435", "value": "ba92da29136c12e0a679d7df716b18f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511914, "uuid": "905761b2-65c2-4839-b9de-5979b36764d2", "value": "196608:McympmJ6uxyLBOqYDh21LqwohITfV6Kn:vmJ66jDcBqwoYUKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768511914, "uuid": "16290e05-969e-4576-87fe-64d0c8e57190", "value": 7664640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768511914, "uuid": "f7eec44d-01e5-4170-b580-6079c15bb351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768511914, "uuid": "b537d157-3a7d-48d0-8993-fe2d8a310080", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cecd040-f261-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768516043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516043, "uuid": "94a5d5bb-280c-4ca6-a361-030d96c938f4", "comment": "Malware payload", "value": "3339229041a6aaedfc037afefe58813f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516043, "uuid": "fbddbad5-83ed-4743-b411-bc8913c1b942", "comment": "Malware payload", "value": "d43329ee5af52665bc4afc3f7dcbe1d8aa13528f49d7580df15a9c9ced50c0ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516043, "uuid": "0b1056ee-06be-4af5-941b-4caf513d8ab9", "comment": "Malware payload", "value": "1121e690c877b23a623f57b8d339b494c20b209f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516043, "uuid": "94ee9712-7b5f-4e69-9b68-33e7798e91d0", "comment": "Malware payload", "value": "18f6a18326d634c75765f46608167a11f32cad73ef8a5be0c0554b12ed6e6a4d97fec661ce3fd8d042604a63f83d277f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516043, "uuid": "a52e0fa9-ad38-460a-8bf0-17986c7a0e45", "value": "T1A1C37C5773E540BBD1B6CA79C8638A56D7B178110B24DBAF03A402162F233D18F3AF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516043, "uuid": "bb8e5975-609a-4298-8ba9-56117aef3959", "value": "1851ff453adce0cef5274e320d5bed3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516043, "uuid": "21c53838-2954-4107-ada1-d35a992ae059", "value": "3072:1mcqYHq7Aiytzg2ScpvgJcG5sqYX6UOHNlBS:g0Hq7AiyegZgJZSXmtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768516043, "uuid": "37f03c28-4838-42e3-9f67-4d8004b353ab", "value": 127824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768516043, "uuid": "411ab309-3d73-463f-8cd4-c7b14f3187e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516043, "uuid": "1c1124c2-f8de-4568-aba6-bcb9addad348", "value": "VMProtectSDK64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb54c8d-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435730, "uuid": "e4301507-05a9-40d3-8404-610d4648fcfd", "comment": "Malware payload (Mirai)", "value": "6d69ceda5023e200ad35993da752177a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435730, "uuid": "921de237-98f6-4c2e-bd46-a95ad827c4ac", "comment": "Malware payload (Mirai)", "value": "d714978225984dba91184dae9e885da2275c28f7c2e49898f18d74d041202b8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435730, "uuid": "91965938-d5a6-4671-b1d8-60b024b10a63", "comment": "Malware payload (Mirai)", "value": "52f2b8abff6d3f88f5387b157c0c73ee5658be61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435730, "uuid": "d8009c32-3b62-4da5-aaed-de1ed09174ab", "comment": "Malware payload (Mirai)", "value": "71807ddc523766c167cfdfc514118f6bc31be410db27711bde3abf1158753906030a84c848827e751232473d6dc4d60a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435730, "uuid": "cb3da4c8-ddf0-4904-ae09-80582a90890d", "value": "T1D2D34A2275391E2BC4D0987E22F74761F1F167DA25A8C90E7EB30D4FEF252206517AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435730, "uuid": "6a5ac6f6-b195-4f82-b90f-64752d1a12fc", "value": "3072:cBldhO3+cB9BT+iLgXxm/4b30p0U8bl8DwnpS:aldh2FB9AzmonbmDWpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435730, "uuid": "1f80a87c-49b6-48f1-a4ba-b8f3d096096e", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435730, "uuid": "2ed87d67-74d5-4d9d-a427-43c5095e6307", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435730, "uuid": "0e25e984-7409-4326-aff4-bc57370214d2", "value": "systemx64.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0d3db2-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768466089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466089, "uuid": "948f4b1f-b9fe-45dd-afe0-0d806e21cdd5", "comment": "Malware payload", "value": "ede70fc5ebcefae9217fd6ea16bbaa86", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466089, "uuid": "17e624db-523c-459e-afab-6a0ca265f65b", "comment": "Malware payload", "value": "d73c7ce04f0dfdb56656fd9e1761ca31e4b9bb9724ecb16e98b6990d79e7b176", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466089, "uuid": "8cd373bb-4d2a-41e1-8534-8c459de58feb", "comment": "Malware payload", "value": "e60f0beb22926e098209eed35f8c65234d018bdb", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466089, "uuid": "20c5a6be-5f27-4915-b1ac-9729458b5edd", "comment": "Malware payload", "value": "da9c085c2e61917ad2fa5bfe3f715c2646200e233ce37037ce1d1820c2d8726384dea4c547f993c57c1e68cf0feb57d4", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466089, "uuid": "fe6468d6-af52-4f93-90f0-851ba160126a", "value": "T114163322AF690FDD466C933CA1BB1E2F27D01FE4948A70DE52E465C3255FF20805B9E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466089, "uuid": "16483606-298c-45ca-871b-e6219b93c75f", "value": "49152:pM9up+vNuHTaj+sDULrNNZ46lvXtxTzNT+CFlur4fs:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466089, "uuid": "2daa9b78-a171-40b0-8eb1-01a83ccc141a", "value": 4039584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466089, "uuid": "977c2fb2-c0ec-43d9-ab2c-c66b5c61341d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466089, "uuid": "ad26a5e9-09ef-4e5b-a243-66e62028b5d6", "value": "tesst.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b698d2-f202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768475339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475339, "uuid": "41b58eca-6e34-44cc-8c02-9355e2796c02", "comment": "Malware payload (Mirai)", "value": "654c5c064bfbe03ba4deb6bc92075199", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475339, "uuid": "e736f734-123e-4edb-bcae-cc6be9967fef", "comment": "Malware payload (Mirai)", "value": "d76f8bd1b486b69682eff485b41f47848d7cd72b4c1e20fabd44b37325d384b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475339, "uuid": "26ec5c88-3ea3-4f44-ab22-40be4bf82611", "comment": "Malware payload (Mirai)", "value": "d987b2f127476c760f2e6f75d648f175d69c4a75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475339, "uuid": "7f1519b1-8b0b-4287-a371-eda01a5b643f", "comment": "Malware payload (Mirai)", "value": "d26701b576caa61bd96e2ea07536de4b62dcb5a699fac52fb488af0550e770454876b474c316ffa3ecdad7f8451a0aed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475339, "uuid": "c3783ae2-64cc-43fe-b023-2783bbd1ba15", "value": "T1ED130895BCD1CA2AC2D0227BFE6F519D336163ECD2DF3217CD241B10B68A61E0E67A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475339, "uuid": "848660bc-fd5e-4d58-897e-6f17f4e8b789", "value": "768:JNhH3mE2352yz0p3/2OCUsAXvBo3r/LG+F76XSZ7aNQrX/PVsONkEhPN/:l3ge/2lUsqBo3G+F+XS0NQb3SONkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768475339, "uuid": "9185bc96-0e1e-4944-a2b4-a744577aae9a", "value": 43204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768475339, "uuid": "f5bb9009-72ef-432d-a0f4-fc41d0923e94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475339, "uuid": "876b7dc3-694f-435d-a747-6471222e2c16", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1386c7bc-f23d-11f0-a129-42010a9c0007", "comment": "Malware payload (Kaiji)", "timestamp": 1768500458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500458, "uuid": "bee4eedc-c2e0-4be6-b326-a6619a0f6276", "comment": "Malware payload (Kaiji)", "value": "52b927b9f67b45fe22eaeda848023704", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500458, "uuid": "c079e5e1-bff5-497e-a7d8-7d07c018760d", "comment": "Malware payload (Kaiji)", "value": "d77b6eeb506ebd49b1f348eafd01f545cf41df13641a7417bcd8f34bdaa239d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500458, "uuid": "a39d2b08-4ca3-46af-b7b0-5390f51e8ac3", "comment": "Malware payload (Kaiji)", "value": "22d4a8a355fa1b9d862128580a1f43b8e5e52256", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768500458, "uuid": "267d03e8-365b-4181-a779-7018447c22d6", "comment": "Malware payload (Kaiji)", "value": "fa5e30d3999f679623ab003d6c8a19e467dcf2d050e14840553ca96a8276b877b140f5c2317ea0f149b9cc23d2eb8338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500458, "uuid": "099bf9c3-8cff-445e-86d3-7822c02d2b76", "value": "T175955B85BC9DA912E9C97EB56F2502D07225FC4D9F81C7177A00BBAE6DF23588F21360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500458, "uuid": "03588289-b969-4bd3-86da-999fb8b9e6e2", "value": "24576:/wRmgu8dG9qDQtfTBmW0NREmCNPCB98U4TprOEa6QWgrz1v:/euCG9qE5BSxAUrz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768500458, "uuid": "0f24fe2a-db5a-48f6-8026-a6effb26a52a", "value": 2031616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768500458, "uuid": "b1455d5b-c06f-4e27-99c9-d7812169a36a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768500458, "uuid": "eabad03d-c32a-4802-aa60-6c0ecf18dc8f", "value": "linux_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba3f4f0-f21d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768486808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486808, "uuid": "7897fd98-d527-4f20-8a69-5f37974a8bbc", "comment": "Malware payload (Vidar)", "value": "9604daabc32570c30d2e027453e7143b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486808, "uuid": "dd3b3959-8b04-49f8-985b-8351985ad5ed", "comment": "Malware payload (Vidar)", "value": "d7b77f266c431111f29832fa0892eb710b4c90faf8c4e2aee6611332324f4d59", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486808, "uuid": "19986985-adb0-491d-8e4c-61404c914deb", "comment": "Malware payload (Vidar)", "value": "114346ab4064edbaf7e3946cf34d62deb67956c4", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486808, "uuid": "81f00e03-7099-4802-af99-dc93dca79303", "comment": "Malware payload (Vidar)", "value": "a7f4e6a28c2c440565ee6e62a0b42a52a29b61ad04d4649de9dafcd4113eb3344bb683891616a03ad4cf23a616bc468d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486808, "uuid": "e004fcc1-4415-4bf0-ba15-c9ed84c460ea", "value": "T135932A0A63F520BBE4B653B494F242539A3279B15B7A96FF22C4C1BD0F236C0A531B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486808, "uuid": "63aa94e4-64fb-431f-beab-07cacfd95789", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486808, "uuid": "9ae252e9-187d-4cd3-8be3-57abd0503b50", "value": "1536:srae78zjORCDGwfdCSog01313SHXZ9cSvnXH3nXH3nXQAwgQAwgQAwgQAwfcs5gx:0ahKyd2n31R5SbHDKpjolp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768486808, "uuid": "859e6ea3-8531-4385-95b3-87e9c0e9a7bd", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768486808, "uuid": "29fdfc67-a3b7-4a8d-a124-46dfbdb4cea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486808, "uuid": "d26b136b-008e-4545-bb67-646a30b0ab95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3df9e3-f24f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768508473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508473, "uuid": "b92d5987-98c5-49d4-bb98-eb7532978f67", "comment": "Malware payload", "value": "50612c44ed978363773804e93b577efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508473, "uuid": "170afbf3-51ca-4d72-8fd0-e89ac038c052", "comment": "Malware payload", "value": "d891ecba5a22e89da9112084fc223e03a1afd30f7b3d27a6be27474c4ebc4f91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508473, "uuid": "3507520e-0986-497b-bc4c-1607edacc5ed", "comment": "Malware payload", "value": "7207b4a913cf5a57ac1393c5364ae29e2a711f5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508473, "uuid": "0804cd1d-9e55-4475-9875-fd337bd4fa16", "comment": "Malware payload", "value": "aa7a08b75280d3250fd592136373103a1a5f9b32462d60a9d7b308108a8ef6012f53e66162ab31026183017d342f1c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508473, "uuid": "8fc50c5e-3bea-4eab-b6e0-8d482399af96", "value": "T1B8C35B57A3B500BBE5B78638C5A74A09EB76B8410762ABEF0394425A1F233D18D3DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508473, "uuid": "14f4e1d3-1555-4384-85d0-c9d8d950c3ef", "value": "ebeae7d93c6f397530cc3feee02d4ebc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508473, "uuid": "a8f694a7-89fa-40e4-80b8-57e9d0c27d56", "value": "3072:wLR2am8Yuk4SuCqIwd2GgzsOpgyzfWHDrB7ijPGyuIWC+vmXO/2iePL3zfbHPyeO:ePZTXIw50eW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768508473, "uuid": "ce9e8367-6e07-4ada-a773-d177531527ee", "value": 120864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768508473, "uuid": "4d937b41-56ba-49a0-bdc5-4848911199a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508473, "uuid": "2f0ad6a8-58fa-4850-a286-e011c38b808b", "value": "AcPlugin_Test.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca972d67-f1fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768473707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473707, "uuid": "43004ada-b6d2-4c21-9920-0154927b72bd", "comment": "Malware payload", "value": "03df7414e3f384dc589b846747c88432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473707, "uuid": "70edc2af-8a17-4ec0-9646-a4a4c69e8f63", "comment": "Malware payload", "value": "d8c33d38a4f1f55841219e7397bc1a15327f58b69f01c2b9c1d2de3d376876ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473707, "uuid": "0d7ceca2-0a0e-47c1-9ec4-c4a078b1bb7d", "comment": "Malware payload", "value": "c424b8bb5459a871b2da8e3805b56d223b1a3c32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473707, "uuid": "db33ebd7-6bde-4626-8641-619066becd23", "comment": "Malware payload", "value": "7fc2e5bf36b2593992d9fa27763aa307ed4fc55bdbe1592694ede6836766aaf78025477c940f653cbaf1b15a3d608648", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473707, "uuid": "6b746555-9817-4b33-bbfb-679d4322289b", "value": "T1E664290BE6E210FCC5DAC434476EE662BEB178F956207A7F1588EB311F9AE20631D711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473707, "uuid": "c4955576-ad09-45f9-8939-1f2110154a44", "value": "6144:GcFSTA1xp4yK4sxwaE3Z8GobfufDZH0XmfCLT6slwBDCDxRvR/ZqU:GcsWK4sxwxZ8/7ufZGmfCLT6suBDaRvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768473707, "uuid": "54b92f5b-496d-4bf1-ad23-6b48a1843416", "value": 317312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768473707, "uuid": "ea10433c-92c1-4862-89ec-24d3dde700d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473707, "uuid": "faa9ddc6-e1fb-4a5d-a282-95dbfde0c3f9", "value": "xmrig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aec9ef9-f24d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768507450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507450, "uuid": "29322ef8-8c28-4b29-90f3-da16814d2db6", "comment": "Malware payload", "value": "5a2a56ec90a9e18a186e8aecf57515f5", "object_relation": "md5", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507450, "uuid": "ee223f0a-3e4b-4b38-b847-40c4aa9234bb", "comment": "Malware payload", "value": "d8ee3eb9725b14981aeca1cb2e9e984d39d6e8c6f6cec7f8a6d1cd4b15f7b45b", "object_relation": "sha256", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507450, "uuid": "facbc993-19c8-4320-9ca8-183f6897aff0", "comment": "Malware payload", "value": "9f87f409dd4d608d9b66a0aac083e6b5e2f69918", "object_relation": "sha1", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507450, "uuid": "bd633f85-41ed-4433-864a-8d6ce24e088c", "comment": "Malware payload", "value": "ef8aeb6b9a09ee4b2d38ea44408bfa78bae7102aa3ee3b11dc0875c7e08ba6af579def1bddf9f8cf09d888059a3cdb19", "object_relation": "sha3-384", "Tag": [ { "name": "boot", "colour": "#E3D972", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "EFI", "colour": "#2EFABE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507450, "uuid": "552b7a78-18e3-4806-8b27-9654271bdcce", "value": "T18CD59E47A3F511F5E5BBC274C66B861BEBF278062234875F43A4C9991F23B319A2D312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507450, "uuid": "5ca36af0-eb83-4ef2-b96a-799d6f5d3325", "value": "49152:xBX8sDNWlH3fq7RDKM/nQhhBlKuEXHHm+nD/Lwua4bw:xF8qNUu8iHHTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768507450, "uuid": "8ddc105e-617f-4fac-8b5f-8f869ed67ef7", "value": 2855368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768507450, "uuid": "af19e9fc-7ad9-4cfa-bf1f-4f4e589391d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507450, "uuid": "16f43bff-ccbb-40d8-86b0-67f4029193ac", "value": "bootmgfw.efi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf877bd4-f239-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768499055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499055, "uuid": "eddf283d-29b6-4770-8e9e-1454b0b6f9ee", "comment": "Malware payload", "value": "4d46c5480c6ea5bbbbbb8ee00e832562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499055, "uuid": "d148d53f-0a0f-4c03-bd5c-4dd4be7ad3e8", "comment": "Malware payload", "value": "da23f2f8f56b914c11beb31d1e3b4d663abf4ecb750554475fab11bf5d0a66b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499055, "uuid": "e7032c3d-327a-4fc3-9c63-e28b48f2d6fd", "comment": "Malware payload", "value": "e80347863382db7c8aef6a0cb2f2d4fbf75bce41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768499055, "uuid": "8d641e32-5f0f-4fe9-9c0a-afb4e52dcf0b", "comment": "Malware payload", "value": "f325e362485ace3b089d969fee1b34a87d879ecce6d8165419c5b8028d679f00293cbdfe727d924028d4608f69afce80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499055, "uuid": "26ede94b-5811-4959-9420-68a0b8737d98", "value": "T148B4392E71F48B6FD07AC17689924B639532787C073681FF1380C2A5DF95AD0AB3AB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499055, "uuid": "d32df3f0-9c2e-41bd-b38c-2ab58992c43c", "value": "1cbae310ee78602a6e6491b2e8f2ebc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499055, "uuid": "caa703fa-36fd-47a7-ad32-5e88e7d2dba7", "value": "6144:zkj2XIRmj13uBUwU48quXeRlnMWejKKp0JQIyn4dugWZf6qqDLu4blXA41RD+xW:zaRmgay9sKKkQl4uXqnuiSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768499055, "uuid": "cb069584-3d7f-44c6-85bd-fda7378eb6f5", "value": 533024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768499055, "uuid": "97eaffae-a1e5-4a4d-97d0-f76d520df2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768499055, "uuid": "8b1c256d-0357-4279-a6bf-7d30a74c09a6", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9867e886-f202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768475340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475340, "uuid": "80237c81-b98d-43ad-b0ef-6540e7b05a15", "comment": "Malware payload (Mirai)", "value": "b8119c8263c6196dcdc6780a0ac9d51e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475340, "uuid": "60834531-302c-47de-9002-8f8b0ac65934", "comment": "Malware payload (Mirai)", "value": "db38e19b34076eb5009db83647e46f11dd723112f9435daac7e1b18ca2b340e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475340, "uuid": "f19fa15e-095b-49c1-9852-f43077d562d1", "comment": "Malware payload (Mirai)", "value": "8552d1f53c87d04eef89d2d6653e4eec6cb24d84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475340, "uuid": "2d2a20ae-4a76-4f5e-b265-629632874e7a", "comment": "Malware payload (Mirai)", "value": "cc24db3c797aff4f3ed684f49b7811dd9e626c61ba6dd00dab13e6ece0904844ea5851abad58f51b2a40a4919168e5cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475340, "uuid": "8b7a4f15-b247-4534-af9b-8774caaf73e8", "value": "T132330785BC91DA13C6D412B7FA2E41CD332523E8E2EF7203DD262F21368A81F0E67655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475340, "uuid": "aa746d81-7f2b-4595-b650-aa1af3b8913d", "value": "768:Hff7Nfbo2qi9QbVm0wkhlgdkkA9TqTbTkjLZRkxfrX/PLHET8LPNOvqV0q3//:rNUQ0wclg1A9T4Tkfcxfb3rET8Bz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768475340, "uuid": "686e1ab8-0b27-4540-88ea-61672b8f8603", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768475340, "uuid": "64f8a7c2-703b-4b31-980a-cb74c2e7d7d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475340, "uuid": "6aa19d56-528b-456c-8b53-57950a44defb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291b472c-f1f1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768467852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467852, "uuid": "d83a12d2-d502-41c0-8128-fa9635a7cb7c", "comment": "Malware payload (AgentTesla)", "value": "f477c68f40101a7f286d9a6c3d692eb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467852, "uuid": "a8d7b83e-4bfc-4cd4-b414-0838f248a047", "comment": "Malware payload (AgentTesla)", "value": "dbb7db644c70a35ee55f59f17806c4549ac15edc2a5460623c6405af90671133", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467852, "uuid": "a0a5cbf7-0334-44e9-ad1e-7a15dedc51c5", "comment": "Malware payload (AgentTesla)", "value": "0e6f4191d46ed51354435c15e0f7a2fc3f2caf9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768467852, "uuid": "873d9087-967a-4201-8593-f3661a1c6f35", "comment": "Malware payload (AgentTesla)", "value": "9692812f9d33327364be67f83faed51e13215501aa906c96127cad18354a7e6a8b04cb51f8018c8970efd9311e497a49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467852, "uuid": "97cdcc14-e338-4fa1-b211-c441739a744e", "value": "T173153360AEF8AEB903DDE35864FF5A499D900E46E47964CF326C900B5FBD7066C0DB48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467852, "uuid": "60e4bc3b-a2ae-441c-a360-de7d06889aa6", "value": "24576:2cyZzg7aefuELP2ENz1p+VDZgco0GBH7/yPxaCLRjmJn:2cUg7swBEwBe2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768467852, "uuid": "a8a7d97d-55b7-4406-a67e-c0a13c6ce55b", "value": 954247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768467852, "uuid": "6a489611-1cad-4c2b-b9dd-7a9ebb014a47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768467852, "uuid": "604f4882-bacd-40ad-b894-2f08710f9d85", "value": "oveead.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a960de0-f20a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478538, "uuid": "5a19cc29-aabd-4bce-ba36-21e5f1f635a6", "comment": "Malware payload (Mirai)", "value": "3993f77d8bbf0712efe98455f63d52bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478538, "uuid": "ed9621b4-3f15-485e-99a0-6e22648547c3", "comment": "Malware payload (Mirai)", "value": "dd11fb42426fe54bb03c7d183de9ead271fa5546403a6cf2ff34842c32036543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478538, "uuid": "bee4c3d6-ee84-4ee9-9678-4e4af7c7193f", "comment": "Malware payload (Mirai)", "value": "73ac01d1597811747dfc873cab7d9f312b21bff1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478538, "uuid": "447f2eca-857e-42d3-8a75-7ae2e6270ed0", "comment": "Malware payload (Mirai)", "value": "3cfeded44907033507aabbf18a7477ca4279e5034abf0253821cf1eb2940e9f99679c0b2a02c9517f073327ab08853ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478538, "uuid": "3e48dd85-038e-40f7-9091-5657c3fff9b0", "value": "T1A2E34B17B5C088FEC4D9D1B84AEAA636D972F4395274B10F23C8AA2B2F4DF215F1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478538, "uuid": "8d7c4d7c-7d63-4b00-b36d-fd687c6da896", "value": "3072:E2wGzt+1/HSEP4W2w7a5hh5C201tR4JGBEiTf0B7iqp5lN1Ey:/w2+FkW8tqtjRWpV1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478538, "uuid": "a17ca481-8a31-4f66-8903-13211479ff53", "value": 150536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478538, "uuid": "fe2e46b4-d462-4e54-82f1-6c69a0311395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478538, "uuid": "df38d29a-0694-47c4-8f8f-562621f007ce", "value": "sumrak.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fce0bd2-f263-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1768516987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516987, "uuid": "dbc4377c-9069-4f80-9962-54a638d96a84", "comment": "Malware payload (Stealc)", "value": "6df64e2c86edc63dd0fad2fa03721f4b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516987, "uuid": "4c406a35-a3a7-4e0c-9c02-bc9d6e94650d", "comment": "Malware payload (Stealc)", "value": "de0e5d92c8315b68338c60c01187cd7417f087bd64de4edfc4bf0bde605a5787", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516987, "uuid": "7cdee5d2-a41d-4dbe-a8e5-172374e7b4c4", "comment": "Malware payload (Stealc)", "value": "28dde23490442ea22d3b33ac6d7f80bef4d1907f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516987, "uuid": "97ae18b5-533a-4c42-9c70-393f21a22111", "comment": "Malware payload (Stealc)", "value": "278edd5f0d60be0e86416f9f11d309b91f0f2fd34f7c23205b4bf2dd228f8424b492e1d9f9cef028abcbad0e7ef7f7a6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516987, "uuid": "cb00258c-28fe-46ca-be04-36522366e33e", "value": "T1235522686794C646E9B623B42E31F278077D3EDF3510D20A0FEA6DDB76A2F158D01293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516987, "uuid": "92f0a01f-daab-43a0-ae44-f4aba4fdb5b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516987, "uuid": "cb2a77ff-1eb9-4607-ba69-81353bb34575", "value": "24576:Ju9TEIVJmtaZ4hUw0sGefBG1ETgist8DcJgChBgZ/k3yrfN7Awc9pPbe:w9tfm8Z4CwX3fBVgd+Ezhk/iybN72r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768516987, "uuid": "35e85c85-3b09-416f-b4de-6806d4928c7d", "value": 1300480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768516987, "uuid": "91381db0-56c8-4ec0-bca0-91b5187c789f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516987, "uuid": "0e06644d-1963-4623-8e6a-487573ee354a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2034b95a-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768466119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466119, "uuid": "611ef531-bf8d-4008-8325-66dae0bfe485", "comment": "Malware payload (Formbook)", "value": "b6b9f82ea98558ba2721d4c3d0c37cfd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466119, "uuid": "9b144dbc-d565-4296-9d6f-f0b297285cea", "comment": "Malware payload (Formbook)", "value": "dea7b8093cfdd19ab98eb2281539bb34333e7ba5102888e5ae4b07be63d1d27a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466119, "uuid": "6b9bc6d1-923c-4acb-8c6b-5b10691dca11", "comment": "Malware payload (Formbook)", "value": "5f295d2a9bdd6acd1f1b33b9377894fa93b8b9fd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466119, "uuid": "f5637cf0-59bf-439d-9324-ff26a41b5153", "comment": "Malware payload (Formbook)", "value": "29c93d46bb7801edd4d90fde511633032c546ff4be3ffb5cf79ee2918a7b29a4cf1ce9b672e3a3664f9a2bb7ef96db8f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466119, "uuid": "bd57090e-6c89-452e-8ab4-f34fa4698468", "value": "T12B6533650F69BD3D49A8A35CB47F1EAE47B11B57B808A2CEF79C06C7941F7818832C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466119, "uuid": "2ccfcdc0-4f62-44b7-aa9c-42e80606b902", "value": "24576:a7tYwMG8DUyVsuuWgpPaBI2tLDSq0nUkpH0/jElAVXKMhgGOfywShrALY8aPN3eZ:ctIU0PCiveUOwo+BgBfnFqPQYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466119, "uuid": "c4595bdc-1330-49fd-a9c5-8429d5258b9e", "value": 1412037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466119, "uuid": "f31a35d7-505d-46d8-b199-85995e1b9cd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466119, "uuid": "99241761-5068-4da3-89b5-6850474a137f", "value": "SECOND.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5968c01d-f21d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768486831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486831, "uuid": "e74e6f43-8793-420e-aa7e-00dbcbd89454", "comment": "Malware payload", "value": "f9b3cf4d2330c8055e85dfb5f661a8b5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486831, "uuid": "420a2070-5685-45be-8730-18f9a483accf", "comment": "Malware payload", "value": "dedc10ea2c4608a502c7a6d53e2196d3dd1dbd10bdd118d65e7a8df2996ddfaa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486831, "uuid": "4b1f4c92-e6b2-4d0e-816a-fc25dd4b85b3", "comment": "Malware payload", "value": "1cdd5fc3cc7415ae1a50bb4a78585ea47022828b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768486831, "uuid": "aca27173-0383-459a-add2-031573347ba7", "comment": "Malware payload", "value": "31360e1886866fbc44e0108b3123d60970e936c7959326f92f6f13c44068d5f147759f72bdb649913045910543f2daaf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486831, "uuid": "5d54a40d-cc87-43a6-89ac-ba6e74b27f21", "value": "T193B53300B6BDA4B5F51D6EB059DA5B03A8A4EEAC073015CF9A057D43DA3F5D3C23A287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486831, "uuid": "c6bf8b81-8dc1-4c85-b7ff-c25e8e9deb25", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486831, "uuid": "728f0ef3-8ce9-43bc-b4b5-4734448b766a", "value": "49152:IgwRxQ1ruLWnUsES7BA5rwKN8FQr0WD1Y729:IgwRxQsLAb2G+06a29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768486831, "uuid": "871c105e-c69b-48f4-bfdb-2b53b63cba8a", "value": 2354344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768486831, "uuid": "4ea68fcb-bf49-45db-9a1b-afe2cd934769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768486831, "uuid": "16b024c3-e180-487b-b5b9-85a48589ea40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0e6048-f1f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768469550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469550, "uuid": "02cf315f-38e4-4333-9ab5-be5c027429f9", "comment": "Malware payload (Gafgyt)", "value": "6d529ecc623c2e8cb3263d56025733a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469550, "uuid": "4dc20839-1d22-44b9-aaf4-055b183f32f2", "comment": "Malware payload (Gafgyt)", "value": "dfaf28ceeb208d963e19dafc870ca19a48797b66db7cbbde87f405080449308c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469550, "uuid": "2c2fc15e-d8b7-4e44-92a7-e9903d18c2ef", "comment": "Malware payload (Gafgyt)", "value": "a90801a983d2ae6d926cfa6b308e851c0978e2df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469550, "uuid": "b34cb652-5c15-43ad-a44a-5e725679f7f7", "comment": "Malware payload (Gafgyt)", "value": "da4e78edb6806fe325d015511de9b17c48bf2c04485c3f5e79d08de00e72e31e6d592fa05c659ae08eac5fb743d5a0a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469550, "uuid": "5b79a4e0-dc67-4071-b74c-f0280991d2e8", "value": "T109C3F141FEC380F5E0C243721086A7A68F3AEF1A0424C66AF78CBB7479C5797655E290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469550, "uuid": "08f5eba6-7fe1-4eeb-951b-c5522d7ef4b7", "value": "3072:rOlNTZa+Ef6jZ8Wq7mBL4NRLsbFyzGAKA6nAGg6:aPGfczzp4NRLsbFyzhF6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469550, "uuid": "cd31ef43-e1b4-4df5-866c-5c6a7b8979a2", "value": 126575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469550, "uuid": "24eb2738-d4a3-4b93-beee-ed6184aa3e98", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469550, "uuid": "7b18b9e5-15a9-4ad1-b4a3-def1858845ba", "value": "di7n0tmrr5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb38bad4-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463480, "uuid": "314db02f-06d9-4fc9-9ac1-24d9b3cf00ff", "comment": "Malware payload (Formbook)", "value": "a98e0d5794a603ef6c2fe39bad4eb105", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463480, "uuid": "30d7490b-0e05-440f-969a-c3c09e8c532f", "comment": "Malware payload (Formbook)", "value": "dfb2a22e84be71624b988cc49b0fdcd7c3cbd40b0da35f74ac9f4cec3d2af7c4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463480, "uuid": "a53e0168-cc05-434a-a240-b6ad41f73288", "comment": "Malware payload (Formbook)", "value": "5f56bd22f7e3ffbc7e94149716451e2bd19d4a5b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463480, "uuid": "2b9d350e-43f6-48db-aee5-77cc83690d28", "comment": "Malware payload (Formbook)", "value": "92897b6c44404f81017a70bb1b25218e53390abc9bb13ab3ca84d33ab3f8d2befea0493d64166b07a79c8d93be79800b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463480, "uuid": "5f89d275-b022-4f6b-a329-0b9db35401c9", "value": "T1076394CD7FE6B671276160732D1FA09EF62E5C88790C8095E3A7A8D0F92C318E27565C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463480, "uuid": "b6496110-bd6f-44bd-ade0-321f34c5d1e1", "value": "1536:fSHcAsjI0M94B+4ipYyri6r+jXGGoFQ9OXV8V4sq2ZxnmFe:ccAWF+4ipYyrifwl2/m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463480, "uuid": "9d4eb030-0a9a-4c8e-b4b0-da6ec4752f03", "value": 68730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463480, "uuid": "df8b0016-9254-4b3a-a667-d8efa93d584b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463480, "uuid": "e76c0b12-fef1-41de-be17-73d777ef0ea9", "value": "Overdue Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a27854c-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463130, "uuid": "adee8226-0b39-417d-8270-4373ddf5ba98", "comment": "Malware payload (AgentTesla)", "value": "77e2dcc112ed8e3b716ca3a6dee9a6b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463130, "uuid": "30e2f7fa-f56e-4e0b-81f4-3a539d2fdb9e", "comment": "Malware payload (AgentTesla)", "value": "dff8ed7a253f8c757db595038b427ee24fa50261844cd73bdcdf4ee166b735a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463130, "uuid": "1ae61e6b-f7cf-4728-b181-ddd908145844", "comment": "Malware payload (AgentTesla)", "value": "4f88610d369466bd997e1bcc9c3ba90d4f503b8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463130, "uuid": "dfc0c0ac-57ab-4dd3-ab92-31913053db23", "comment": "Malware payload (AgentTesla)", "value": "84f8c38095a039e98df15505c9aa1c299dd57a1e56bf6891a4faa3a410af85467baa809ee1519aa24ee941421aef9082", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463130, "uuid": "01019779-b516-40fe-8a99-8fd80213fd91", "value": "T132934A60D91D05B70FC3BB88BCA90660C56C9314893758A1F5EE870EA2099FCF77976B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463130, "uuid": "9deda1be-9910-4a2c-b5c1-82c2e65d890e", "value": "1536:XvhsdFgsT++LMdLN1kSg3TAafbXox7GkLHJkONc5xTFVF7Z:/hsngsTfLON1kSdafrY77LpJNKxTFVFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463130, "uuid": "ff214d90-811c-4c89-ac25-e510ae3e5199", "value": 94157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463130, "uuid": "c6145eda-3ada-4a6a-8f3a-e1d6590740a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463130, "uuid": "07f48ded-119f-4dae-a54f-02ca77133c40", "value": "2026-01-13-0368.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47a9aed-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463469, "uuid": "3cfb1e1e-b300-410e-a860-17795e040ccc", "comment": "Malware payload (Formbook)", "value": "5d9c407dd416f7e1fdbffbbb6cb6d0a1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463469, "uuid": "3e7e25d3-7b5d-4f31-b71d-8d4fe47d9126", "comment": "Malware payload (Formbook)", "value": "e0c8aaf77a03d2e0c7714c4ea006242ebcb0975aba2da13ddcf84635ecb81596", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463469, "uuid": "1497ac05-c2d5-44e3-958f-6e58dfe19194", "comment": "Malware payload (Formbook)", "value": "aa9536c56c4decbb507e2f4fe49cdb324c406f9b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463469, "uuid": "d5d80277-fbc8-48d5-822f-dc611d0d3c5d", "comment": "Malware payload (Formbook)", "value": "fd2af3e81cc60dc24101367ac3f05fd126c14243a0ef68bf5235e04f49d7edb23826402fad32de7c84c3ba94d764bf17", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463469, "uuid": "4f7a6af0-c7cc-49e7-82fd-43f90cbfd054", "value": "T120A376883FC6F07193657433692FA0EEF27E0C91760C8196DAA760D4BE5CB18E2B595C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463469, "uuid": "0e1aeb62-f0a9-4ab0-8d85-5caa1c3948b1", "value": "3072:O36fPJptwTmqAz7vcHk2CzlZR4GRricgg54oRuyrrP9pn19e6msCLP/:a6fPJptwqqAzsk2CzlZR4GRricgg54o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463469, "uuid": "36a4fd86-839a-46e9-b292-65b143c4d1fd", "value": 101442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463469, "uuid": "74ebcc48-53d4-4022-82a2-c9c80a606e1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463469, "uuid": "d7a75fc8-ee34-4953-bdcf-2c440e4e0bec", "value": "FullAgencyAppointmentLetter.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c51cd4d-f1f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768469549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469549, "uuid": "6ffe3a14-5ce8-4204-b247-1e986a00edd0", "comment": "Malware payload", "value": "09326c1222205c1f3afd9b748d8e1471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469549, "uuid": "a024cdec-76c6-4c2f-b057-cb4922416ef5", "comment": "Malware payload", "value": "e10692967bb5a326e6ed70633e8849786575d23f7d114b8ee0ea54e25b33e355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469549, "uuid": "83318376-8bf8-4772-af44-b7c308a8d3cf", "comment": "Malware payload", "value": "8bda96141fcd0516b0832adad42954661c297254", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469549, "uuid": "c857db4c-66e0-4720-8520-63b910dd92aa", "comment": "Malware payload", "value": "cb45da4530f222732942538dabb94fb0f47e21e6fa5c7b3533c4ef56c86de8d13d82d37e76fff92157e6600d5a4dae99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469549, "uuid": "35fe0781-d024-49dc-a59b-61a46d1f18c5", "value": "T1ECB3F153F682A0FDC09BC274825FC617F92779803318BBAB2651A6333E5BE1137187A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469549, "uuid": "91de8e37-d361-4f55-bbbe-05d516b7ccb6", "value": "1536:NovYbQVtiDor1/JKM3LAaBJEcJsjUN4vDbHvLsP8vQavuQSbbQDQdCa/6qvRC:Nov4QV8UZfEc547bzsOQaKbyQ/yCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469549, "uuid": "eeb71286-e26f-46b8-8043-bc0a2d84dda0", "value": 115104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469549, "uuid": "c4d0320a-7e34-47c7-a093-b8d123ef1df0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469549, "uuid": "ae541bd5-2e31-440c-a31d-636801302636", "value": "su552aq3og", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc24f097-f200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474649, "uuid": "77b310d9-ef2d-4e26-b38e-120436f7a9da", "comment": "Malware payload (Mirai)", "value": "b07fc13b4be32e5d7b5a585e4227acd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474649, "uuid": "1e28b3e0-5627-4882-bb68-07e686e56fb4", "comment": "Malware payload (Mirai)", "value": "e5af202f652e2fb7253b9dc7165d118d254d41648c06a1dfb87e7d10006aecb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474649, "uuid": "a064b4ad-6c01-44ec-a46c-d51fcd08bf7b", "comment": "Malware payload (Mirai)", "value": "ac9585b7a739b95a501de9f6f77508c8097f7dca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474649, "uuid": "b70b8cd5-7b91-429b-99f5-e24eb6c2d416", "comment": "Malware payload (Mirai)", "value": "d023a03948a99ad84e647d9828049109eed8b2219d9eaa359ca4f49271a8249b970aabb30c149c4e5c4efec872f5686a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474649, "uuid": "40e4c87a-b51d-406a-929b-972373bde4e0", "value": "T184A3C71E6E15CF7CF79D873547B78E219688338B2AE2D141E14CDA015EB028E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474649, "uuid": "7a33c5ce-9cbb-40bb-bd65-01b83e5af951", "value": "3072:pqunD7x7p9V7Ebcn/kqWdH3faIfaazOBC5M:pqunHtp/pW93S8aazJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474649, "uuid": "d1409de1-66e0-4a26-ae02-5705656ece70", "value": 101132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474649, "uuid": "a5f1b787-6e80-41a4-b377-f41093cd7b96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474649, "uuid": "3e419124-83b1-43e0-ac89-5355290d97e7", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a858cb9b-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1768478374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478374, "uuid": "3305a745-d6ef-48e5-9f33-52da80eb33e1", "comment": "Malware payload (ScarfaceStealer)", "value": "ae58baecb219cb6aa250c82e61244f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478374, "uuid": "ca57636c-191f-42d2-86e5-7c522bd9f186", "comment": "Malware payload (ScarfaceStealer)", "value": "e6e7c5a19ff2f9239416f9e4b624dd10b42b26560a1f0d476be8d297765801ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478374, "uuid": "584ab637-7a77-48e0-8b28-37a7387509b2", "comment": "Malware payload (ScarfaceStealer)", "value": "4f7b1a74f2376c031897f186b9c342c49f6b8cc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478374, "uuid": "ef5447dd-8bfd-4726-981c-95bc801bfc73", "comment": "Malware payload (ScarfaceStealer)", "value": "86c6c0efd5a58a1159991f6389f593e3af87a464af875f1274db06b8c87f033d6b76d399fbad3703e5609001fdd9eba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478374, "uuid": "bbd94b5f-6c8c-4333-8471-7b36a4cb8ea6", "value": "T1C5E623EBB4C462E8D4938F70D38E67CDB4F1B5064ABB692D37CE2D025530E878645A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478374, "uuid": "81e93a59-6f21-4382-8873-26d39df24a66", "value": "c6e890f2bf1c766e673a9f6fba99f26a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478374, "uuid": "4ec9286f-f405-4f7c-bba9-679de4b434bc", "value": "196608:0zmn4NFXOYWU9GfUsVfjclHKBS0V3e3Q3gcZHn2L/iN6ZfcKOx8zcXi89ddBiji9:yiEqYHMVEy5n2L4guPyidB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478374, "uuid": "0bccb434-ccf0-4c63-89b7-2effaae85834", "value": 14433280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478374, "uuid": "287acac7-0db5-4101-bafb-f521247e2645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478374, "uuid": "377b40c7-3e60-4ce5-b037-808407d60eac", "value": "G\u0430l\u0430xis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8341b6-f1cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768451619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451619, "uuid": "12202004-26a4-44f0-9fc4-dc4bddb061e1", "comment": "Malware payload", "value": "e02af98ed092ed54c42f93fb8ecc4f78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451619, "uuid": "3e50e5e0-d939-4c24-8d25-b67e91a2847f", "comment": "Malware payload", "value": "e79751620d99c5e7bcf429faded8d6cd9e13d9c897aa8128c5224eb4e006a5f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451619, "uuid": "512db8ab-8dba-42bf-80c5-c81e8b9b9563", "comment": "Malware payload", "value": "eabb8b61f9cfc6df12d2fd792d9dc9b8eac343be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451619, "uuid": "6cb12156-47fa-4980-9215-af5861b3f808", "comment": "Malware payload", "value": "079add9569d263cb8455dc9b25718ca505bc0ff77dcb5209d6ce8064c3827a380ce18f061c7c240bbe23fc6bd79c8ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451619, "uuid": "669af723-7e9f-4a45-ae94-2bc19499e890", "value": "T13421DA96A7E25E07CC8612B3CEFB5B50F321BE58899EF443E3122A150D3E24A1F21159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451619, "uuid": "d669ce18-e8cc-42af-a76e-021382bd1f3a", "value": "24:Jr4llMRgP9qD0at6EoKGiArUlFSy40VzLCkIddx2HIRGIUdCpFmFmFmF8NoL1:J0TFqDPtArkFSy4CzL5IUgpUUUiNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768451619, "uuid": "c245db40-e070-416e-8cb8-60912022780a", "value": 1288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768451619, "uuid": "4c380eb5-91e8-4ffc-841c-d186fdb3a008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451619, "uuid": "82c5d5b7-7521-4c2d-860b-4125e589ea4d", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c86bb9-f1e3-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768462015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768462015, "uuid": "a8d3f9f1-5921-4977-a8d3-549c0397a237", "comment": "Malware payload (RemcosRAT)", "value": "6439965d3d15c9ca71ca8c91d674a07f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768462015, "uuid": "055440a3-f9e6-4bd9-b7ba-392be9f8f7ae", "comment": "Malware payload (RemcosRAT)", "value": "e81a2db8cb80396874720064cdfbf62901b1e6b96e8395d6a9846bf930f7efa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768462015, "uuid": "243e3c03-0031-47db-af5e-369cdd41e5f6", "comment": "Malware payload (RemcosRAT)", "value": "9aed2b24c656f3cc2864f2fe4a9c4df117a77fa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768462015, "uuid": "761a7a67-0253-41ad-b372-f0b442237240", "comment": "Malware payload (RemcosRAT)", "value": "21cb574da0e484e74eacf9c9edeb32e64c10a59f02bdefe3fc19cf45404f917d9ec0fa561910d3b953f0df451dbb1afe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768462015, "uuid": "f7c83906-9b73-4800-a4c7-0c108a4f680c", "value": "T151550268229ADA01D6A15FF51972D2F52B706EDEE820D34BCFE9BCDF7864B804548343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768462015, "uuid": "78df71a3-6dbd-4de5-829d-e38281fc8c40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768462015, "uuid": "37fd8a6a-ce0a-42e1-ad9b-68964a0cb1a9", "value": "24576:O2jKeZVZniNEkVR4mGg32mKKJedWJ4W+aZ:hKeP0O8RdGm2mKFdWCW+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768462015, "uuid": "d6e9410e-bd8d-4546-9e9e-bd62239fa1cf", "value": 1333256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768462015, "uuid": "6ae52a77-63f3-4ff5-af3a-8e67377b72d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768462015, "uuid": "862fc095-da30-43d2-8987-a6df419eb81a", "value": "Abkar Elekt specs dimn_siparis 1000 Metre,H07RN-F-NHXMH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71c11e2-f210-11f0-a129-42010a9c0007", "comment": "Malware payload (Tofsee)", "timestamp": 1768481378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481378, "uuid": "fb6f0f3b-094a-4875-801e-98da3c19bdd8", "comment": "Malware payload (Tofsee)", "value": "aca69cc64c0b7c1931ac8854f272f070", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481378, "uuid": "55899793-83ca-4bdb-bd32-60f7a57bafbd", "comment": "Malware payload (Tofsee)", "value": "ebd3fbf7c640740cab28c5967ef5f81678b9923a3b052254e618151bb10ebb2a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481378, "uuid": "c34aaffb-b67f-4b25-9566-dec27fe1d6f6", "comment": "Malware payload (Tofsee)", "value": "80980f76257027a8872cfa7c66ddd7215f9611cf", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768481378, "uuid": "291c27cb-b9af-430e-a8bf-6dca91ce7c0e", "comment": "Malware payload (Tofsee)", "value": "d9d2278dfefa36b28f15c3ccb80b06db098ab6e105c19cecb2d641b86435dffd81cda90d53ffa695e2b1517be2a58747", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481378, "uuid": "a779f0a1-9720-4d79-a6be-8c5747ac7a03", "value": "T104C52201A92C0A3BF43911FDAC61A305C20C3F17FBB55B09DA7A778F967EE49294A153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481378, "uuid": "06e0a0df-1414-4917-b3d0-87862aee71f7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481378, "uuid": "92501c2b-f0a2-4726-b57d-7c59c6a8ec63", "value": "49152:g96E9o3719Rep530FOxTkiI/t9CqtzXp0+fWvaP0dUrJDyiFEx/+pjh2kqkiuCs:q6E9i719op58QTkVLtzXp08+IhyHx/9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768481378, "uuid": "07fcbda7-a4d0-454e-aa53-8e23e3ceaf35", "value": 2607949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768481378, "uuid": "866700df-2369-4b47-834f-bd8540a8a35c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768481378, "uuid": "f3259ffd-e7ee-4ad1-9f98-d93b084016d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56da8f8b-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1768463634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463634, "uuid": "54343112-2a35-46dd-87a9-884c68349c73", "comment": "Malware payload (DonutLoader)", "value": "6614a4fcb5eaffa5a960d51339ab04d2", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463634, "uuid": "9a4ba9e2-88e4-467e-a34e-ea5614312993", "comment": "Malware payload (DonutLoader)", "value": "ec3a1f90de2419df029e622a480b483970991723ecbb4f2a8f350f384d0b34e0", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463634, "uuid": "64be2550-c26d-4518-ab32-8cdbbd2132c2", "comment": "Malware payload (DonutLoader)", "value": "5f73523d02c560010e95d779b449236c33cb7974", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463634, "uuid": "905cc429-063f-461e-8828-3ac6b864fd36", "comment": "Malware payload (DonutLoader)", "value": "c1685502a3d8926ff5730cd2521c5dacc1e82d09d7a2decc6bd72cd47447dacc799df538b15e14078ebdb9dab7e9f988", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463634, "uuid": "7ce3b50b-6234-4a1b-b9eb-aba2c4c4cfde", "value": "T1CA661A372693B8923977EDAD167086100C473A3379DDC918F9E4326721E1E1AE536CBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463634, "uuid": "40e3a98c-9179-419f-9d20-3d98ad2879a6", "value": "24576:8qxH9dy64zWZdL3oHh7q4cz0KiM8Umyhh6Bj5qkd+jWztg7b7ecJYYDszTVhNWF4:UazZoLC2Mi9uqexFVJG82v6vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463634, "uuid": "0e157c81-e296-4f2f-a8ff-6c9fbec2ade6", "value": 6722841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463634, "uuid": "6e928051-6604-4b84-9ccc-828e29672eb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463634, "uuid": "ab07b1ca-f548-4d6b-9c9a-9865203a4e9e", "value": "jvtwksat.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5577d0c1-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768463202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463202, "uuid": "95528575-603a-4056-a23b-636d822faf42", "comment": "Malware payload (AgentTesla)", "value": "2e11cb781a14609ee5b89be758944311", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463202, "uuid": "3e4ffc80-df3d-4791-a70d-072b39eb4cb1", "comment": "Malware payload (AgentTesla)", "value": "ec45ff5bdc815803a2de7feb4df78799b3f841e59651e5a46f3ff7c5c63ef6ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463202, "uuid": "1d441a8c-5c74-4bb6-a5ba-0a7656d86c9b", "comment": "Malware payload (AgentTesla)", "value": "4592ff11b499d514ac18e8ae3709045645933544", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463202, "uuid": "b0fb3cce-e3f4-4d74-ba83-2735d0d90601", "comment": "Malware payload (AgentTesla)", "value": "bad35aa953d21099d2863a81a78a37886ac2515065d24adf5f8e9c0158671dd365c457d355fe647322ad2972c022cafa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463202, "uuid": "7fe1a591-88e4-463e-a79d-a8a16ffdf247", "value": "T19F934B60DD1901B74F83BB98BCA90660C56C9314893354B1F5EE8B0EA2099FCF77976B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463202, "uuid": "a74ddcb9-8046-48ad-8a69-a44b155c73a2", "value": "1536:XvhslFgsT+lLMyhV2s1w7DlIxRcoafbqoOujjWPKkk+AY5K7IilIz:/hsvgsTyLN2BDe5af+buHWXBA+K7Iili", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463202, "uuid": "7470ce8b-9815-4a18-be7e-bf288b36177e", "value": 94038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463202, "uuid": "b547e24a-8db8-4ba8-8436-b98f0944dc69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463202, "uuid": "14d8b26e-f5cb-45bb-852c-df4408664ae7", "value": "2026-13-01-0273.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19f0d5c-f20b-11f0-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1768479329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479329, "uuid": "ff40452b-67e4-438c-bcfb-3d25ea709966", "comment": "Malware payload (UmbralStealer)", "value": "bf225d62699fb08769f5f676908b7523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479329, "uuid": "ef2c56fe-2606-4ec0-96f6-184377626b97", "comment": "Malware payload (UmbralStealer)", "value": "ec4b781a75ed63b685d8a8fb115630861f5492f8bdc9fd76aa3d320ac2eddb37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479329, "uuid": "317f3d68-da39-4e46-bf06-b35d5047b6e2", "comment": "Malware payload (UmbralStealer)", "value": "d5e87f22acf406a666eaa084f05d1ad1b6959a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768479329, "uuid": "bddb07c4-94ae-426a-8ca5-52b12a9b6df2", "comment": "Malware payload (UmbralStealer)", "value": "8289f95f3f5b7035c7e19dd71a765a261f0ccd77b6b0aa288190d608c9ea983729d3cb9be57c6c125510970aaf112c9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479329, "uuid": "9fd9e6a2-f6e2-4fbc-a473-8e8152a18873", "value": "T116346B4933B8CF17E25F8BBDD5B0149F8BB1F143E90AF78E0C8895E82411B42E949A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479329, "uuid": "3f41aacd-d60d-41d4-9bff-a639c91e0034", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479329, "uuid": "dc4e54f5-d291-407f-abf4-8911c185fbde", "value": "6144:1loZM3fsXtioRkts/cnnK6cMlHlwoyAmB5K0/Cwhl0gAb8e1mPi:XoZ1tlRk83MlHlwoyAmB5K0/Cwhl05d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768479329, "uuid": "b0e4b9c9-5994-4390-bdf2-e85bb96e5763", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768479329, "uuid": "d6c70ffc-5efa-4cf7-aab3-d911f418cc9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768479329, "uuid": "5f496d8d-7f10-4d70-88a6-d091d24140c9", "value": "Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f45c6e5-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768463192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463192, "uuid": "e580e987-f8e7-430b-83cc-fd6a01fa938b", "comment": "Malware payload (Formbook)", "value": "1fc89c9a57935a83ed4e684e20873ff5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463192, "uuid": "1a6ef42b-2117-4b3b-a196-6b49e012f612", "comment": "Malware payload (Formbook)", "value": "ed420e0df3349ba0dbab01a8147806529c59f317033c10cdd5e6cc189f6a2950", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463192, "uuid": "e26c5707-50a0-46c3-a13c-929e9162d0b6", "comment": "Malware payload (Formbook)", "value": "cf9adc408febcc4f1b264ea5464f906981b56886", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463192, "uuid": "6b835db6-b592-43c5-b23b-2be866847693", "comment": "Malware payload (Formbook)", "value": "b0fdac0ba4d9dec828d3f1c0ffb53c909567873604d4d9211db947c12d91e97f4368f8b13a9135a4d601883139f3898d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463192, "uuid": "d8997165-a6a9-42e0-88e5-3bd4a2e6c016", "value": "T1B97374DD7BE7F475139168337A2BB05AF22E4C80754C4191D29A6584FA38B08EF3BA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463192, "uuid": "0005f08d-0254-4f48-a75d-cb8d5bfe8269", "value": "1536:e72aviADD8KXPZvFb2Fzf66NvgqgHaRmgsXnHjBvy5gTnH9bxrh:e724iAfhFbYcoR1sXDBvyU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463192, "uuid": "c97c9061-d095-4f50-8b84-2aa0427d0b38", "value": 79935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463192, "uuid": "aafdc867-261c-4829-a240-5126cc19c0af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463192, "uuid": "068ad192-1511-4578-8772-872474e14bd6", "value": "DRAFT BL No. STFHK250222712.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa5c3c4-f252-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768509516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768509516, "uuid": "4c48b2d5-27e2-4e5a-b2f6-b1d3e4f74cd1", "comment": "Malware payload", "value": "b15d89f1556288c0263d370ada800a3c", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768509516, "uuid": "825f90c1-1e6f-4323-bdc1-5da3b7f127a0", "comment": "Malware payload", "value": "ed9a60e9bfaffb1b0ba7c05fe28d568e303bc6a78ba9af436cbe9a7d78106deb", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768509516, "uuid": "d626c1e4-1d89-4b84-bbe9-30443d26e4b1", "comment": "Malware payload", "value": "92aabd52995a03355d38b87f552892632a193e52", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768509516, "uuid": "c9a11bd8-eb41-4e8f-9d22-42c0927bb2bc", "comment": "Malware payload", "value": "5c154d85330c753e478e51086e01a28c5591756d69021a4824d268aa7c9f1ee4514cabfddbdd2f920083681b2b451122", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768509516, "uuid": "a098afe1-fff7-4991-b9e1-25b82a62b853", "value": "T15993290A63F620BBE4B697B495F202539A3179B15B7A97FF12C491BC0F236C0A531B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768509516, "uuid": "53ed33c2-187b-4644-9026-03a36b0257f9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768509516, "uuid": "5847c7e7-58fa-43e3-9f71-07c96220584e", "value": "1536:Lrae78zjORCDGwfdCSog01313rs5gf3+Q9hH:hahKyd2n31g5SLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768509516, "uuid": "597252da-92fd-4ae3-90ca-a470669fb154", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768509516, "uuid": "29f34d10-9965-40d2-b211-15e279412896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768509516, "uuid": "3c262716-90cd-4f5b-a255-8a35373ccb5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a192cfc-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435722, "uuid": "683e34d0-4bb3-4d15-ab7b-2bb939a994e5", "comment": "Malware payload (Mirai)", "value": "6418932eac03f0cf005c36e09b7526a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435722, "uuid": "7552e12f-e6b4-47b3-a3ab-22f20c396e40", "comment": "Malware payload (Mirai)", "value": "edd36921560633342eafed3cd855211f4d8ea6aac5dc6d82842841fdb8ebefd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435722, "uuid": "3fa8cf73-8a1b-4e2a-bf52-f3cd6d510fd3", "comment": "Malware payload (Mirai)", "value": "905072012aa66bef6672586d2d3f450cff9f4fbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435722, "uuid": "625f7b9b-34b4-49d0-a879-c0de2134ab5e", "comment": "Malware payload (Mirai)", "value": "822e43714151797a5304e337079709efed6a9cbf333fe555be659a031a556acc59fb64f54614b82f052d9c8e9fbf289d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435722, "uuid": "b6066ae3-0cf6-43f0-9bdd-f8e4b010f7f6", "value": "T1CC343C45EA414A13C4D117BAF9AF428A3332A795D3DB7306D9246FB43B837AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435722, "uuid": "e7e6835f-70de-4cee-ba92-ee7d91afca73", "value": "6144:yjCiZsR3wLScaFskxWjKwRe9krgbMiMM/9oUexT:yDa30ScaFskxWjBYsCN/Czd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435722, "uuid": "8d390a7a-8d1b-4347-b3ff-904e5aea43fe", "value": 230868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435722, "uuid": "309c8b43-bfb3-43b3-b875-069392d0c0fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435722, "uuid": "5709fbff-2daa-4dec-9697-631352a954d3", "value": "systemx64.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f845c8a-f1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768435731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435731, "uuid": "6c2901b1-146c-469f-8024-0841f09a2ce4", "comment": "Malware payload (Mirai)", "value": "8597ccf27aa9074bcbee566511168088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435731, "uuid": "4fa99a18-5e25-4bc5-bf8f-2bd297d7dee1", "comment": "Malware payload (Mirai)", "value": "eef45f8fd300a217d20e2797596d9d7ea168177dbb5afe8e924d72500765fe2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435731, "uuid": "932bff24-9e3e-48cf-82c7-958509aad021", "comment": "Malware payload (Mirai)", "value": "a884da40537dd79f059287ba49965cd35a93fc18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768435731, "uuid": "faee8644-9f11-42df-a71e-aa2ef647fe57", "comment": "Malware payload (Mirai)", "value": "0dc2c5f08e60fb1093577eb4f91002ebf22b2fdd361fb31f0144513b3e6bfcb10c9020ac33ef0d8646e8eb431ed1caa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435731, "uuid": "c46b5142-e65b-4f80-b71e-d10e92765184", "value": "T14CB339C1B643D4F5EC1641306277F73B9A32F0791239DA97E7A49E327C92A51DC0A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435731, "uuid": "cada2736-2fcd-42ca-ae6e-d37b7493981c", "value": "3072:tbcWYdCLFaGFhu3/45g1jcV2w9NS+AMFfpd:tbBYdoYGFh0/45g9Dupd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768435731, "uuid": "5d86a9c9-4583-4c7d-97c9-4e2a63fe600e", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768435731, "uuid": "581b9473-ac46-434a-b866-81b3b58a8e62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768435731, "uuid": "82aca895-f13b-4748-8a70-a776cabbddef", "value": "systemx64.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a79a1a4-f1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768466083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466083, "uuid": "0c34b051-99c3-43f3-b695-6d7849fd91d1", "comment": "Malware payload (AgentTesla)", "value": "102b41f0d4660c390fc3706b79f91de3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466083, "uuid": "9464e050-490e-4176-918a-2ad2fcbbb884", "comment": "Malware payload (AgentTesla)", "value": "efb66153fb82e130439f0d5252bca14cfa5697f6c3523d56df2a41558e555b94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466083, "uuid": "ef63be28-8a96-4fa3-8e1a-2832c6c10f29", "comment": "Malware payload (AgentTesla)", "value": "7602bb9c3b909f22ebb60e06ef9f6bf862085ecd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768466083, "uuid": "940c509c-d8f3-4bd9-a3db-557f49a70674", "comment": "Malware payload (AgentTesla)", "value": "870c85543a9bf17b32849472b70e814fd16b987d4f24172c082d38d0c58501c1556fa5b1df0b78b14f13c5cccd780f01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466083, "uuid": "c0a0ed2c-9983-4308-ab24-352a5de4aee7", "value": "T1662523403E7B1DA689D8C72230EF4B8A1FE05E6C809658F7A3760CDF5D7695D818F06A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466083, "uuid": "c4a98ee9-f98b-4ecb-a32b-1d81b2c9ebd6", "value": "24576:n4zGpYF2WSOQNQx5yJ/9WULSHhtxCkIn8:465DJ6cz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768466083, "uuid": "83461cb4-140e-4d6e-96b4-7b9dc0358715", "value": 967597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768466083, "uuid": "21f4a20e-919b-4fec-b818-88fa7d8c2c14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768466083, "uuid": "8e35bbb6-2094-43e4-9705-2d13ddac79bf", "value": "STEINFTPP.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1256186-f1e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Blackmoon)", "timestamp": 1768460779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460779, "uuid": "da382405-4836-4742-8b30-15fcedc5908b", "comment": "Malware payload (Blackmoon)", "value": "d9bee44b595289a3aaed6997542652f8", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460779, "uuid": "b67c5cdf-0dac-408f-aa3e-8c971b553811", "comment": "Malware payload (Blackmoon)", "value": "f074c0e0d7f7bfd40f5892a338d0a48e3844a46a389db57f78e44954c8f8196d", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460779, "uuid": "54f7dcda-1133-451e-95b6-455776652553", "comment": "Malware payload (Blackmoon)", "value": "c0eaf051a9ed3849c1db52f1644b4e68123e6df4", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460779, "uuid": "9d7ac55f-13dc-46cc-a529-d2a51504299f", "comment": "Malware payload (Blackmoon)", "value": "0bb0c20f01ce1d23e25110af4f50aa352bc9a1142bca994ba63587c3065b9375885c02456c447c464d9663ebc10c5010", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460779, "uuid": "5553d506-d03a-45b4-8630-2a67c0d2fb8b", "value": "T1D1363303377A2979FA2B31B1B6144A7A5EA0FB310597CD20459E8F816E7A77DEC210C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460779, "uuid": "2bf06889-fa54-4acc-afe4-55d2ffcdaf7f", "value": "c38362e0e37590c08f252fc98b1f0136", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460779, "uuid": "0fdd1490-d8cd-4d4f-a301-1e141d8f9f94", "value": "98304:gUZ5ReGyxyIPcNznBoyxDYHLrEYaP43LG9Q2LfnsZc9QXFkxfGcAgqZp:geRefxyKuzBxx8vEYEyLFWz96YqZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768460779, "uuid": "637d4464-f883-4659-b016-ffbe92dabac1", "value": 4879784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768460779, "uuid": "a4e60e5a-cfee-4d24-8095-cf3209e11d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460779, "uuid": "77e7b7d0-3fb3-4970-8ee1-dc81894b3dcc", "value": "d9bee44b595289a3aaed6997542652f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab60910f-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478379, "uuid": "eeda6645-2b57-4f20-8ab5-ee882c193324", "comment": "Malware payload (Mirai)", "value": "b486e23fd1bb0aa9f3956a3c84b568e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478379, "uuid": "86d034b9-8296-45cf-b1e5-d0e27a5b6a17", "comment": "Malware payload (Mirai)", "value": "f08b61d20edeeeb8af701e75cc0d176bb15118231bbe1cac1ed9fc4d82d79d12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478379, "uuid": "f0f79196-b2c8-4253-a13c-3735ec4d8693", "comment": "Malware payload (Mirai)", "value": "12b1ffc949de1f24e53dad4b4bf59be6904a27df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478379, "uuid": "9f662fc7-70d5-41c3-b0aa-8b7a2dfac640", "comment": "Malware payload (Mirai)", "value": "c4911a69d0d811c97159462a7b9f64e61e2d6b0baa6f1a4477bf27eddc0b376ea4d83ff2aebc85cc98fef51bfcfb3522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478379, "uuid": "3f037087-11e6-482a-8951-c7f484a8136b", "value": "T1EA43F2A5A21A29FDCC2245BB9FF7139809F18751FE3AF006B54DAA4760880A53DD3BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478379, "uuid": "a1a1122a-5663-4845-901d-b8644fa61d5c", "value": "1536:KW9ufMW0oQvlGBNn/7xCVhsnw957PJO2JibzY75J0UcO3kVJux:l9PKQsBN/VcN5Lw2uGtc6kVQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478379, "uuid": "f6c36bc7-35ba-40a6-9635-5802f52b36c3", "value": 60024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478379, "uuid": "1f907a0b-b4fa-43f2-9177-b5986e811c97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478379, "uuid": "d50683ec-d286-4d85-820f-83fb03b3cbbd", "value": "sumrak.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcf7f81-f1f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768469551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469551, "uuid": "b54c02a5-7abd-4a14-9594-1ae6b0c4f8e0", "comment": "Malware payload (Mirai)", "value": "660e488985a963879e51b85ecb643bda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469551, "uuid": "b96ba4fc-b85c-40db-a62d-69a5753ad52b", "comment": "Malware payload (Mirai)", "value": "f0db93cd64e2b5003b9697d1f5cadd736e8aad47ad338b46e5b976ea385beaf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469551, "uuid": "7b9ff2d7-21b9-4ec4-bbbd-510563ff16b2", "comment": "Malware payload (Mirai)", "value": "88aa4536db3913502b98fc6e91d5219a4535cb85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768469551, "uuid": "d288b2f9-eee7-4620-a5de-134f5c26077a", "comment": "Malware payload (Mirai)", "value": "a24f25e0e1db2f45614e006cfbfde4bf17bf0ed13236717b8d748ea511829e6dc55f2efc6f82e8e8a01309b287411066", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469551, "uuid": "53612337-97d0-4547-9461-4fc7389e4443", "value": "T13BD3E068F0C0CE72C6E511BEF65E5688336707B8D2FE73408D149D3563EAA2B4E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469551, "uuid": "03a00444-e11f-4cea-b119-a225c022a025", "value": "3072:7D0ownSrawtJemCyCZl7P6SUbvHWi7tXaDDwPunI:7xwSuwtJem/8F5UbvHtXaDDwGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768469551, "uuid": "3d512856-f440-4e37-8a8a-af4ae8b82904", "value": 141683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768469551, "uuid": "971cb102-d2fc-41f2-8670-2560d672cbbf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768469551, "uuid": "27d7e351-840c-4170-9af1-52dbbcda69c4", "value": "ycqq89f5sd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105bfa10-f249-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768505606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768505606, "uuid": "fbed53c2-62cc-4869-96a5-92575f27569e", "comment": "Malware payload (Mirai)", "value": "0cef29936ddd876bc8c49a053d1e2bd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768505606, "uuid": "da9305e6-18e5-4ad9-97fa-38196b463279", "comment": "Malware payload (Mirai)", "value": "f1e6640dd2e7a1700e87b180a8afb8d0b26758d3a4b06786b330353a80e7e49d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768505606, "uuid": "a8198e1c-2af9-4067-a78e-b16c96ec1dc7", "comment": "Malware payload (Mirai)", "value": "d67332874bfe9c1f53c4bfbf59f37375fcbfa6f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768505606, "uuid": "bf270210-3f42-4a20-bca2-ca7198d9002b", "comment": "Malware payload (Mirai)", "value": "6e99c381082b3c48530aae11bddff358f889da01fe7d08ec0a951393f66148ca6ab68e28d5edcb3557e0feba3e8272c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768505606, "uuid": "fdc08edd-f50a-4968-bc23-96a73831b776", "value": "T1E6831942F98184FCC18AC134172FAA3BA965F2DD423CB2E7ABD49B023D4EE615D1DD94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768505606, "uuid": "5b944623-3534-4ad3-95ce-c3adce8bdf94", "value": "1536:tHL48d95grUckUnwU2HOQbc9FqFTO3l/KW5sFGvTfwHRnJTxhgiUD7n7BpgJIlRL:R4835ggckwwNZbcnITO1yosFmIxnJdho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768505606, "uuid": "034f5aa4-b0e2-4285-99e2-41a76db3397c", "value": 84928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768505606, "uuid": "d9fe9230-4834-4e9a-a0fd-e6ae3cfbe86d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768505606, "uuid": "e783f36f-03cb-4a68-851d-79f18b094303", "value": "systemx64.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207880ea-f1e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768460536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460536, "uuid": "6948ab41-55ef-45f5-a9e9-ea6934f87b3b", "comment": "Malware payload", "value": "5b9ff35fa199b4633fac5795caffab09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460536, "uuid": "185aec71-2fb8-480b-afc1-44f207e88885", "comment": "Malware payload", "value": "f3c1ee5ca277248857843ce7dbc7d01e0afaddf858ba26ab82301da66c241010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460536, "uuid": "c57aba0c-96b7-4e10-a4d5-e909023e9a8b", "comment": "Malware payload", "value": "50b416fdbece6410492e114e36c74e3014643634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768460536, "uuid": "2de2b3c8-c1d2-46c3-9cf6-c9c7de0d7fc8", "comment": "Malware payload", "value": "3ef02ef72506c1a31ad378461d19bbf6b1aa41391ad92bd822272a5d86e9256870f091ceefe3311b08217d50241f8bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460536, "uuid": "7cc67f2f-77a6-42fe-aa9f-f3e3725dde58", "value": "T17CA60299A7426748D53775BAC865C3B00A7B3E12A737C31B398F7B13A3071A49D0678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460536, "uuid": "077044ec-45cd-48af-a153-f323f364373b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460536, "uuid": "43986aa6-3e4f-4647-931a-a5a9d433093c", "value": "196608:dIVANHU5rowND/h88mbmIklyu9YIk1Ig7Hl+6Dj9eRJrzPQfG9I17U:AAN0lLJ/Hw0hkXVUnIGm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768460536, "uuid": "a7b92d8a-1c7a-4d46-b199-ae917f9db40b", "value": 10337792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768460536, "uuid": "020d3c4f-06b0-42c5-8371-c4e77459a745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768460536, "uuid": "07cfb85a-e64b-4865-a3cb-acd1ad8ab4a1", "value": "5b9ff35fa199b4633fac5795caffab09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e66696-f262-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768516640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516640, "uuid": "f097c34f-15bf-49f0-b7a2-0f3c44f98c3f", "comment": "Malware payload", "value": "3256e6ca35e1a6d1a60dbc9538685b58", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA584", "colour": "#E81DE2", "exportable": true, "hide_tag": false }, { "name": "Tsundere", "colour": "#F44FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516640, "uuid": "9e3e7cc3-9af6-4853-95d9-dd1ac82d76b7", "comment": "Malware payload", "value": "f3dc188781799030052545fb983035b3f3be2b4e77cdd7afa06b04d318abbe22", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA584", "colour": "#E81DE2", "exportable": true, "hide_tag": false }, { "name": "Tsundere", "colour": "#F44FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516640, "uuid": "b736eb35-aa6f-4b70-9516-ce9524e5374e", "comment": "Malware payload", "value": "f521bc9c35336af5047ca1d11de81a9100842bec", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA584", "colour": "#E81DE2", "exportable": true, "hide_tag": false }, { "name": "Tsundere", "colour": "#F44FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516640, "uuid": "e32c623e-eae6-4ee2-9ef8-27324fbde3c2", "comment": "Malware payload", "value": "68080d0830163fa6177bb8f842211fe0c64ddd07f06fcdf5c69e8060f8f3c05a40d242d70f2c7fd33f3175c311798eba", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA584", "colour": "#E81DE2", "exportable": true, "hide_tag": false }, { "name": "Tsundere", "colour": "#F44FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516640, "uuid": "57ad2119-b49b-417a-8855-19863602c3a6", "value": "T1C005B0B875047CD6666F576BDD96ACDC03B617239A8BA8CC50A8BBC30663375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516640, "uuid": "323afb21-56d6-4388-82d8-50d3e3da292b", "value": "24576:IgKmJgmz/mfJeQpE43iujGRK5naBXTHMYUfxMQ5WMu:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768516640, "uuid": "cd77ef80-d00d-41ed-a81e-0358d3602f42", "value": 795510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768516640, "uuid": "bd76b803-712c-43b6-a9a6-05708b2385b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516640, "uuid": "af0c307f-f088-478c-b778-95e05058ce43", "value": "ssd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0249e8-f202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768475343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475343, "uuid": "f5b3b8eb-ef2f-41e8-bc09-ada08ba4ac5b", "comment": "Malware payload (Mirai)", "value": "118becc04125169473547c7ef8699ce5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475343, "uuid": "add438a8-8835-4b06-be77-101b0c801ce6", "comment": "Malware payload (Mirai)", "value": "f57e5a1a788a3043a2888072361f85d67bc95c1fff1ef4cfb2f993f418dd21c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475343, "uuid": "3950e7c5-613e-4abf-9813-45abb37081c4", "comment": "Malware payload (Mirai)", "value": "8aaf2e0a79ec239589aedee605194c9709d64c41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768475343, "uuid": "b526ddc8-39a6-4079-92bc-d9d7bd08abad", "comment": "Malware payload (Mirai)", "value": "3cafe9f65312b176c178d36b70c1bae71b1e5786a20c1a9ec9d4610fac8fd16766ac9fecf076ccd0ec21478a3db87aab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475343, "uuid": "6907e378-5e32-4d3f-9b39-3f10df3968df", "value": "T1E163750E7E218FBCFBAC863547B74E219648339626E1C584D1ACE9016F7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475343, "uuid": "cde384b3-a4d9-46fa-aceb-2d1e9aa8c5b7", "value": "1536:snCutv3kYP09hg7HPyZPXaoylZ9MqN6x+QE9R+H6w:snjtcYPNAXON6x+QETm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768475343, "uuid": "47569a2e-e91a-458f-9bfd-1f6be4cdd7e5", "value": 69024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768475343, "uuid": "cefe53bf-2f0d-45ae-9bd3-620b218f9842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768475343, "uuid": "dffcfbc6-3424-4655-a8e5-0857941dc4dc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d34b13-f1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1768463706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463706, "uuid": "0a7277f4-2324-42d6-89c6-cc6500eae22e", "comment": "Malware payload (VIPKeylogger)", "value": "22f5cfab35dcb373cb1fe33637af5a53", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463706, "uuid": "bbc85d97-0a75-4c15-a1f1-1365e4161e7c", "comment": "Malware payload (VIPKeylogger)", "value": "f5ed5de812a2c6876241c4603d178874bb63ae268c80fa34ccd1375c99d6bd97", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463706, "uuid": "06da8920-505a-4016-8c81-7761d9370fc8", "comment": "Malware payload (VIPKeylogger)", "value": "64f6a6c9e0bad58344a98e771b138900136fd4b7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463706, "uuid": "c5f7adce-76d8-4ad4-bfe3-1f3b32752198", "comment": "Malware payload (VIPKeylogger)", "value": "204a046dec6eae8bbc3c2c7c37eb47bd96ce1f5232108140fc3fdd60583168b1055f5cf7666d02f2ebc66f46cb09ca0a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463706, "uuid": "6ab9d32b-83c4-41c3-9bb9-e5b423dd8373", "value": "T1D872043A965CDFF00B3E21F051873D0120649326A93A8D6C98D6C1997F2AB559F978EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463706, "uuid": "70ae9140-67b1-4365-997d-2061466fa072", "value": "384:PgL54tIbhl8r9tp7yHmHATIHdi1jZuHPb+iSkr:PgutalS77zbHPJXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463706, "uuid": "ccb221ef-be20-40fc-ba11-51c09535b5ce", "value": 16036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463706, "uuid": "1f396fcc-d67d-4303-9c3e-e482b074480f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463706, "uuid": "78aeb19b-d7fc-4a50-9e3f-96b0a0452462", "value": "Documented_Invoice_0152.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decc051c-f1e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768463433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463433, "uuid": "0dc34994-c847-4226-aa88-aecf43ca141b", "comment": "Malware payload", "value": "e2cb2de6611f8793011dc997332cff69", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463433, "uuid": "e7900ca4-a590-4058-a706-dc4a812ed218", "comment": "Malware payload", "value": "f6980136f17a325df1d7553f2a08c796da8e033e0ab64fdd1a416d262aaaa37e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463433, "uuid": "05b4f833-234e-46f7-a7b7-5418de9104e2", "comment": "Malware payload", "value": "8786631c05d4ed8a43b337d6e6916480046cf7d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768463433, "uuid": "a332f087-f4c9-4c9f-8f5b-9fe4f75c5b4f", "comment": "Malware payload", "value": "48588c1c71ef75e2001b54bc30ffb9b6da36d57a2af4d8d0476af15b3ebbcb2a39afeb6e13b6446edacf961cd1bdc341", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463433, "uuid": "97705db4-07a6-45d7-bc8c-b99fa4787359", "value": "T14D16D6A6D62B05E0C415F6D0AE3013F2DB456C8B7CBE052C789849FBAF775A13366D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463433, "uuid": "04318deb-bd30-496f-8fae-16769d0e18f0", "value": "48:MC9v87w2nzKbM7LNPHqh9v87wT1kQRoa7xrw+8Bd9NWwpNJxpOoMNtpltWhEOh1a:MQVUNJ5a+Af82pNboAMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768463433, "uuid": "94a24a9c-85a3-48de-b515-67979d74628c", "value": 4407520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768463433, "uuid": "3b1a7eaf-e083-4879-bdc8-4ad714180e29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768463433, "uuid": "1c02687b-589a-4119-b5d8-e34b9a65be80", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0e25f4-f24d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768507394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507394, "uuid": "b1b92820-8fa0-4937-bccf-2e75592159c0", "comment": "Malware payload", "value": "5c566902a2086d2fe54d9a5b90c5cdad", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX2.file", "colour": "#C8C562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507394, "uuid": "29b33680-58a1-4ee0-a2f4-e971a8bcaac1", "comment": "Malware payload", "value": "f72d8676074388c888569f109fb4872fa2e5ba804b04f8ba01e7f81e1e272e9f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX2.file", "colour": "#C8C562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507394, "uuid": "f7531e1c-4624-4196-9dc5-55908780720c", "comment": "Malware payload", "value": "d1ecb1f12442bed409c175ef45c423b4dc7308f9", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX2.file", "colour": "#C8C562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768507394, "uuid": "59d392d6-81c4-43bc-80af-7657a78a82d5", "comment": "Malware payload", "value": "6b1d99674547939f36908109dd14c478b867504cf7f35607890ff67dc145ff18172965f93be09a894382c33e035b3e2e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX2.file", "colour": "#C8C562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507394, "uuid": "4d9b136d-5f1d-4ff4-a6e6-8822912010fc", "value": "T1C1F63CD2EE50077AD69BA33AD8E2524A2330F145133514D7BA9417668C6BFC8173BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507394, "uuid": "47937f10-cb9a-4fbd-bc42-b52309e17ed6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507394, "uuid": "f74c93e0-af1a-4881-87a0-13dba292a6c9", "value": "49152:YSSrSoKvLJoHIK3AJ3EIrvkAaEdFNfIoOweUQgE9o7wQSx7IqHtz40bOiLZ8xfmL:Y5fYrnmKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768507394, "uuid": "3225899a-ee2e-474e-ab53-359e356938ca", "value": 16077752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768507394, "uuid": "644d4df1-8e25-4958-81a8-407804aba0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768507394, "uuid": "6221cf3a-250a-45ff-acd6-d8107ee1c9a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cde9520-f1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768464610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464610, "uuid": "17fbf361-9ca4-46f5-abfe-7061bbd8ecd6", "comment": "Malware payload (AsyncRAT)", "value": "283e7a8daf1062758cb434c37b31688d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464610, "uuid": "a656f247-a268-41b0-9b59-5e5bf4f4688f", "comment": "Malware payload (AsyncRAT)", "value": "f72f02a29cb44d516fe3ca42978be88788037ea0fdeec9fd0908eb11dee41232", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464610, "uuid": "d789dfbd-01fd-444c-8723-20ef3edf2635", "comment": "Malware payload (AsyncRAT)", "value": "802fb4cb4475e6ddc02e814c14887ff53f98bd0f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768464610, "uuid": "e78bb529-7496-4fa4-a3ee-2eb0bdea986f", "comment": "Malware payload (AsyncRAT)", "value": "3f59072bfafc1426d1912455d4c905da6125255e99b7db7e13b68bf883d56e4d06589971a06bc39ae3a6ddf551f7f457", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768464610, "uuid": "f0212e9a-3e42-41c4-8737-472e5447dff9", "value": "T14305011DBE25AA31CB0D0FFBD503510C81F588A7EA72F3A758D98DD71A64BC5850EA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768464610, "uuid": "f2e3ef7f-df77-449e-9084-eb07b7174945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768464610, "uuid": "f893d21e-96fe-45bd-b2be-c4b721c29d82", "value": "12288:BjD4kz6fnmQOkkPV5RtI4Tw/ptbJDguy6vIwEhSLKl/y5jZdlp85ooWV02Z/5BlW:1J6fmQzECWuy6vIwEeBoy02ZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768464610, "uuid": "ae23842e-1e73-4cc4-9df4-ab16074330a6", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768464610, "uuid": "22ce3037-e89b-4e36-b256-b4d5135e1836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768464610, "uuid": "3e32fe28-f463-4ea0-ae6c-6e60ef7f80ae", "value": "RFQ#2504767-PR-0576-2026d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a634fbf9-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478370, "uuid": "2f05e853-b177-49b7-bb2e-9b3cf0b2a338", "comment": "Malware payload (Mirai)", "value": "54da9c267ae3ce6a9a7a343fe7b2acdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478370, "uuid": "0e02f266-8ef7-4259-bef0-be22d186894a", "comment": "Malware payload (Mirai)", "value": "f88139129ef981da35beb1f4ab3101d571728e20c420bf44cb9879bc0fe2694b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478370, "uuid": "d14dc669-b51c-46c3-967f-1ce4a6ec0ac4", "comment": "Malware payload (Mirai)", "value": "23662b22ff1c081d2beacf974d3c4fe3a11f86a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478370, "uuid": "dfaf1e05-a827-48aa-905d-a57875f38e3a", "comment": "Malware payload (Mirai)", "value": "c3348e53cf37129d320e13597d19a20fdd8ca7397996e150562f2be915678bb98088706e4faaea06225fdb5469b2c604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478370, "uuid": "852f9503-6dd9-48a3-9109-51f420aff8f4", "value": "T12792C0B160121871E3305877BC2CC5CAB79E43B8DADD32237C801E5EAED280C7277646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478370, "uuid": "61fdd4f7-d283-4071-8f89-e9f4aba17e98", "value": "384:uwKDKSorwwViNZVYAhEPRqLiZA79/ukrMxHfOQMF91cLjzGbxKhymdGUop5hDs:uQfViHVYAWPRyiZY9VrMxHfOQMF91cjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478370, "uuid": "30d02890-c6ef-40ee-9b6f-99174449fc01", "value": 19996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478370, "uuid": "f870819a-125d-4b0e-afcc-9969e1e4aa05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478370, "uuid": "2c0f9f0b-632e-4b0f-aa35-5301600ae35a", "value": "sumrak.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2349d9-f1fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768473525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473525, "uuid": "0809d08c-8c17-48f0-80c3-5a1e5ef99d1d", "comment": "Malware payload (Mirai)", "value": "6ba71e678b809591bd0000bcd5b6cd56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473525, "uuid": "076379d8-aa68-4d6d-aba5-06989caa4726", "comment": "Malware payload (Mirai)", "value": "f89569a00e3116bf0f86287951d9d3759878c5fd6e4c0c9e9c8e43324be82b1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473525, "uuid": "3c78fd80-b0fb-468c-a644-91ca014db5ef", "comment": "Malware payload (Mirai)", "value": "e5c1c1200d7e4da18084581c93681ace2549f7a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473525, "uuid": "73689175-a18d-4bd3-8a69-7d9bdf048c95", "comment": "Malware payload (Mirai)", "value": "74fe9019fcb6b47f676f74167fe1bef3f44973d587f9eddb134d2e283f20aae54476936082d5ac6b65c18b1807234cb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473525, "uuid": "40374465-f3bb-47ff-aa74-6d955a0391e2", "value": "T18321CC5667D25E17CC8602B3DEEB1B10F312BE58899EF403E3612A154D2E35A2F21299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473525, "uuid": "d7241963-89a4-4461-9520-896a39c9a0bd", "value": "24:J2tVsgP9qD0at6EoKGiArUlFSy40VzLCkIddgHcQI5CIFmFmFmF8NoLWk:J2tVFFqDPtArkFSy4CzLT1IUIUUUiNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768473525, "uuid": "3c725b65-d1f4-459d-bdf8-6cdffd37a1f9", "value": 1280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768473525, "uuid": "a74c0bcc-e4d6-4c7c-8fa6-777d161462b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473525, "uuid": "cb70aff0-6000-4792-8471-2e15808b0ffe", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c59607-f250-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768508780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508780, "uuid": "0b5fd1ff-eb22-4d03-9742-3a7fa6141711", "comment": "Malware payload", "value": "3a46a31eed0ee6636ea97fdc075e82ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508780, "uuid": "14eb89f4-3221-4583-a1d9-aaffc04067ef", "comment": "Malware payload", "value": "f90586aef2fc2eb9abf2f60b2c89d77929b36f92c2ee14a72e97f5ec94f65df1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508780, "uuid": "99d6dd86-8505-48ac-af07-a692d86fc82e", "comment": "Malware payload", "value": "05162dabb1e96a704defb476cb2f7ce303e61995", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768508780, "uuid": "8b363a53-127c-4f8f-af3e-8df70d1fb966", "comment": "Malware payload", "value": "f5e0375a09cf1e98ddf51757de31efa76e43794a43ab8688a9f269836ef3a240f8b47d2f9bf800871697a4c43cb7e346", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "reactor", "colour": "#AD9C0A", "exportable": true, "hide_tag": false }, { "name": "reactor-hell", "colour": "#497226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508780, "uuid": "abc21f7d-ee14-4fe3-8061-6fe880ea90bd", "value": "T1A6151903B391AE63D2585732D2F74C0487F0E59277A3E70E75D6236A18037968E4B7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508780, "uuid": "1a203047-3d49-4170-8164-f6174535db84", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508780, "uuid": "4574300b-d365-45a8-8c70-75846ae33027", "value": "12288:MTPxxq/GI+8N8pPLHlp5lmceHSbIYPZW:MLxqGIkpT3eyLPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768508780, "uuid": "f6de06b8-711b-472e-8c5a-eb4928412e8b", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768508780, "uuid": "8af8afb8-c6b0-4755-8096-a049a4df9810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768508780, "uuid": "736c7a2a-d871-4d6e-85b1-b88fdd24e873", "value": "array2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3acce8-f233-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768496176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496176, "uuid": "aa523827-e2c8-4946-8f64-8daf134c5f14", "comment": "Malware payload (QuasarRAT)", "value": "4d94d2b1536eb63fcb0274560e57e1ef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496176, "uuid": "ee9c4b80-8093-4a8f-9a42-4ae2af6b5f02", "comment": "Malware payload (QuasarRAT)", "value": "f9378f177fa7b0a58f0568e9d2696750069ad6e901445d873ec732109f5c00c1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496176, "uuid": "fcff9ddb-e50d-4653-a9d2-16141eb3f624", "comment": "Malware payload (QuasarRAT)", "value": "7a2cda8b5484cf35fdebca5afc10b86b4df7d722", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768496176, "uuid": "ee4b9032-a89b-47eb-a5c9-3dc5e12cb67b", "comment": "Malware payload (QuasarRAT)", "value": "0aef439761b8850a8f58e6b91e7f0e616520df5fa3d10a18a46c1267a0ff0f64c5f5180664614427f90611fbdfbf2a85", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496176, "uuid": "58740ab3-9354-41bc-943c-6958bc2fed29", "value": "T134C523853BFC4948F6BF9B706DB666608A79B8A25D21DB5E06C0309C1D30FD59CA4F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496176, "uuid": "c533fe7e-9eb7-49c0-9ac1-a3100ca0f3e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496176, "uuid": "bc095103-420c-4469-8a92-9ce641243cfc", "value": "49152:9LL+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcmR:9L+2upjBVGVl/lQrCSZ4183DmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768496176, "uuid": "94078492-c568-4338-812d-af9a139a95bc", "value": 2617344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768496176, "uuid": "96aeac87-8609-43bd-a5f3-3ea67d95f958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768496176, "uuid": "2b74eae0-a848-43e6-bbf9-1f4a6a57b8bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a61ed37-f1cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768451534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451534, "uuid": "97fc082c-dcbe-401a-9de9-20420d0601c8", "comment": "Malware payload (Mirai)", "value": "b515b47f39a3be43726f3bc60e709e07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451534, "uuid": "f9230aa6-9cee-4b3a-8883-aada13e57114", "comment": "Malware payload (Mirai)", "value": "f94b0f80e388a334966348b28425afc527d24be0f97eaa2015c89db70275ebd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451534, "uuid": "c1ec0c7e-56e5-4a9e-930b-6154049131b6", "comment": "Malware payload (Mirai)", "value": "7b45c21201987277d8d52205b197d735a961da7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768451534, "uuid": "a51590fd-6172-419e-a9ee-aa9754023d98", "comment": "Malware payload (Mirai)", "value": "9b93e4f1502a0cd95fc51ee43b519174beb4cd39be5c0fb0848ec5f15177bd2e2f08f730e5cbd597f94a9ac4de9697d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451534, "uuid": "c4b7ef46-e035-45b6-a4c8-d6922391f03b", "value": "T1A021CE0DF7595E4FD9A710B8196B06263420BE5AF8134412B3359D7F6E3B1D4171A28E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451534, "uuid": "323e50e9-5482-4933-9483-3d1e29efd458", "value": "24:3/PAa8DzSWPpbP78Pwy74+CiCTHnhHCJtD8ECAfGrioxn2hgFmFmFmF8NoX1sax:XApP3hb/mkTnhiJt8DAfPZhgUUUiNsbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768451534, "uuid": "28d1b510-40f2-48bd-9dc6-3850bc160e4e", "value": 1364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768451534, "uuid": "89dc6c5f-aff2-4162-8853-a83c41f7b4c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768451534, "uuid": "7d7aea79-722f-4766-b16a-5b876d0c37bc", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024a4a1f-f201-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768474659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474659, "uuid": "849525b9-e16e-431d-bf92-8ea988ac148c", "comment": "Malware payload (Mirai)", "value": "12674a644881b195c6393683b1e19fe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474659, "uuid": "8a0aef9d-cd3a-4f0b-bd43-8e6617091fe2", "comment": "Malware payload (Mirai)", "value": "f968d3e1b8cb22cd7b2bb9652d4238d32d16c4339d9a3647d13e9776b4986d33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474659, "uuid": "eebba0c6-3ab2-45f3-b736-f60cfd5f5656", "comment": "Malware payload (Mirai)", "value": "eff688f1dbc8e90d6ad45781a7e2058771ad57ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768474659, "uuid": "c0de5966-5d52-479b-a9c9-472e46435f1a", "comment": "Malware payload (Mirai)", "value": "cf5858be6793224130053c3d03e66e5e779354fdc75ff4c43f4a06151a6c63368843c21028af49ae0f0ab10720014650", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474659, "uuid": "b348a450-c0cd-45b0-af52-81381e9a68c0", "value": "T121638E66D419AC94C4844338D4E68B792B63F808C3772DB6AED585BA4043EFCF9193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474659, "uuid": "ea6e3cc5-21b9-4d75-9d4f-686c1e55f916", "value": "1536:Wap3r4p2SFaRRFzwtkLWAMVvQn/NzHBwuhvjj2CT6:Wg8kSsRRFzUF2wMvjj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768474659, "uuid": "18710aba-6f1a-47eb-9667-1a5db688c740", "value": 72256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768474659, "uuid": "d72511cc-9357-4eec-8529-a33d746027d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768474659, "uuid": "8bec03e5-b237-4149-9806-cefcfd4133f9", "value": "UnHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61da7b00-f1fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768473531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473531, "uuid": "db82f7dc-3e51-47dc-8474-2ec485b05f62", "comment": "Malware payload (Mirai)", "value": "78b3db4c5859d75e49675b1d86043a91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473531, "uuid": "f3427593-22c6-46b7-99d5-ecf6263a3a25", "comment": "Malware payload (Mirai)", "value": "f9e17760cd72007bbd25827d545ac50911c25a8113913a0e3b739b52f3579551", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473531, "uuid": "71ea93bb-b23b-44e5-aa94-7d7444fc791f", "comment": "Malware payload (Mirai)", "value": "58016882c6dce926d3416db95eaadd9ec6fefbde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473531, "uuid": "e66f1219-6a79-40fa-836d-b6ae57059006", "comment": "Malware payload (Mirai)", "value": "ab7b4c2e9a448bcdce6c156bf8a6875758aa0932321c198aec002b220805c36dc638979dede70ad772c2567951b8792d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473531, "uuid": "92318c6c-f67f-48a8-a135-6de42e20c06f", "value": "T1FA214E03A2809E09CF16E6784FB11A103B01EC75CC0BD3CE5A186AA55A0B2C825401A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473531, "uuid": "4faa2869-e913-4c5e-b47e-e7b6c0f5e7b4", "value": "24:w5h3dGtSnUpzzbBWpzmIKWKBB5gDrmlzvGdikC7m17DCDFmFmFmF8NoLmk:wH3dxnUpzzbBWpzmIPNDrm5vGs772qDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768473531, "uuid": "f627fad1-eb76-4561-9c03-f696adcc6b9a", "value": 1316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768473531, "uuid": "f8243480-d05a-4102-be46-a873a3f2054f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473531, "uuid": "7ef12725-60ce-4761-9e24-e3aebea6491d", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3154553-f1e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768461668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461668, "uuid": "cf99a3e5-f33b-4bd4-a212-cccdeb3c21d3", "comment": "Malware payload", "value": "9eb7e77e3f95928b1e8b10bd298b5f12", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461668, "uuid": "0516955a-9b97-45be-aae1-00f02919f68c", "comment": "Malware payload", "value": "faacba7c22475a2c1f677f34049e9852b6e2e57287f6f420b4ab71adfee9aed4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461668, "uuid": "585529fd-7dab-4b0e-af79-0ad6d067342e", "comment": "Malware payload", "value": "2ea5b608c397f6823a1fb6a5d386630d9b3bc660", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768461668, "uuid": "5358c3dc-2be6-4f6e-b4fe-df9d4c302365", "comment": "Malware payload", "value": "bdf55facc22b9057e4bde20d12990497306b6900252fe88067dc7743f68403ebddfbf29f44c594f7e29a2ef5b42760ee", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461668, "uuid": "44834768-e13c-4142-88a2-8fa8a86ee7a1", "value": "T10441018FFA065524C53347A58A99EC1EF850987387A42096FD9C54C28F323BDF2942EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461668, "uuid": "0489ae6d-8cd3-48f7-a278-e129aedd257f", "value": "24:XRPzBMxWNbuCUlMkoOMcMO3HRMt3Th7uM6lOMonN3NOJ/gAsEOwv80j1HUhG0f:XsWNy9vQV7xN4J4AsEOsgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768461668, "uuid": "9d9b3e35-7870-45f8-9fab-cd661c8096d3", "value": 2217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768461668, "uuid": "7f2b73d8-cf7c-44e6-822f-8692db32f245", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768461668, "uuid": "a620bdf1-fe78-45ef-bef6-daca2338fbfd", "value": "main.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607af237-f1fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768473529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473529, "uuid": "3a19c5a7-f10f-4282-b92b-bee274d8d7e2", "comment": "Malware payload (Mirai)", "value": "35c6a404a39d32a84b4d571ae96d7e4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473529, "uuid": "e86759b7-d1dc-414d-bf57-685a9cb72af3", "comment": "Malware payload (Mirai)", "value": "fb6808dffb27cab7b2772804e4c3606e86791929014e7d34e5c20b08288fb678", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473529, "uuid": "32eebf2e-0045-441a-b934-2df361f8fc74", "comment": "Malware payload (Mirai)", "value": "48cc4e2b64d0448f350a8b98cb81ad1773b533ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768473529, "uuid": "b14ea73a-7dda-4d47-99d9-f67ded6c9380", "comment": "Malware payload (Mirai)", "value": "c7d88d7ac1cbadacf4be988450000bd975fc30b07824df591e3f4c899d49c8e834f808e22393f6d39532ce77aea1ddad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473529, "uuid": "f4afcd5b-6c3c-47c2-aa99-b07a51f04234", "value": "T13721EB26A694DD33C6A311F623C2AF4A2710DDA62866FF0BC9616C02DD242D0E132374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473529, "uuid": "19ed914b-a799-410f-8515-e29b7544907b", "value": "24:FlAVMoJFHxgxCl6ZSiSZSLRFp+fG/4w0rGuWpdruQ3kFmFmFmF8NoLT9:f4xL5sSi0SLRFp+S4w0rSpBH0UUUiNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768473529, "uuid": "95fc406d-6bf5-47fe-a6a6-12cf75adf213", "value": 1300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768473529, "uuid": "50e56386-cbd2-4f32-8572-c8c881acf257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768473529, "uuid": "8436e395-41d5-4758-96b7-cf315d132359", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b6f73f-f262-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768516591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516591, "uuid": "8347afd2-d6d8-4f41-949f-6bc309bbfc68", "comment": "Malware payload (Mirai)", "value": "50f094d90b49490a4366683df14aa5c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516591, "uuid": "60befa8a-0c80-406e-96ea-f24d37f036f0", "comment": "Malware payload (Mirai)", "value": "fd2f4e6b03338451613a8b03aa833ae37fbf746c4eaa67c76489b873306776f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516591, "uuid": "110be019-52a0-4fac-8b56-e2f0645588d8", "comment": "Malware payload (Mirai)", "value": "08631041f5a80788e09d927b1161948435123de6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768516591, "uuid": "b505f4a3-4590-415c-9cd8-cf74ab2ec9fd", "comment": "Malware payload (Mirai)", "value": "dba9da91ec7e37b45b6c2100fc1a77a8309018a872b50768701b4f0d6c9272d3df4fddc9a4e5581ba61dcfefc6141254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516591, "uuid": "125fafd9-e571-4d7a-b24a-f4dbcdac18a3", "value": "T1F6865B47B6E318FDC19AC470472FD563BD70B8984221B97B7698AA302F67E205B1DF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516591, "uuid": "efb44548-0ed3-47d6-96a1-665e0f160268", "value": "98304:nEmfCLfqpf1Si7ukqzX0WtP7cmNfCADtExRPERsbKP+gKTowL+TBOMV9qg2glMy2:CMssbKWmTLJMmtNpfD+I/Ay+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768516591, "uuid": "dcca0cbf-50c3-4323-9c22-ba20cd6f8f0d", "value": 8334576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768516591, "uuid": "46a425be-4d1c-4506-883b-98eafe615826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768516591, "uuid": "5b2b520b-d625-4163-8ccc-9038dfe229f7", "value": "xfit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a7fe7-f209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768478377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478377, "uuid": "fdabdf73-1f76-4af1-a53f-d0b60c381ace", "comment": "Malware payload (Mirai)", "value": "26cc7b6e4cf4c9f8d50c5b200c95ad01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478377, "uuid": "61e660b0-5bcb-4773-9e2f-54e06128dd78", "comment": "Malware payload (Mirai)", "value": "fece2b6a449fe224716f724f4f0b0d23f86e971471f3f1fee6e91e2cd7493876", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478377, "uuid": "319f5e35-c887-4cbf-a839-86483158c00b", "comment": "Malware payload (Mirai)", "value": "6abd65c0c11b21caaf5eb7de420460ffc3049573", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768478377, "uuid": "216eee7a-62e5-47b9-ba40-fd5862cc5f4a", "comment": "Malware payload (Mirai)", "value": "d98f57c4f2cc9184e76ed85bc2a8178515c8f8c16bb93ca80a77d38d6919a68c822cd2bfd14b96660026bd1f664aadd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478377, "uuid": "c7c911bd-c2f7-40bd-8044-45c3039d2437", "value": "T14C13F11BC7F91B56E06F9939849FB78D0F0063ED65882A3500F9346749C8FB74DAA6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478377, "uuid": "7ad635e9-1ee7-4b93-b661-2f2cfc6b8462", "value": "768:HWQEWiBhMtMAEOLI5EwK3SYBKJ0oISLBOoMERFdpOVNonbQZYzD+nbcuyD7UHQRh:HWlWiWMAEOLIe1SYY2or1LPJw8bQXnoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768478377, "uuid": "68bbc9b8-c5ac-4705-904a-c8c90dd43f0b", "value": 42980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768478377, "uuid": "52aa364d-6869-4d2c-b2e6-9c3470ea7401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768478377, "uuid": "c0201a73-e646-4a53-9940-bb42e49f762f", "value": "sumrak.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0b2849-f20e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768480393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480393, "uuid": "de531150-0c18-440d-b402-ac1c3329cc22", "comment": "Malware payload (Vidar)", "value": "8b2f839cd13daff7efc99b1030045ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480393, "uuid": "07259863-65eb-4711-81c5-f8078f39211a", "comment": "Malware payload (Vidar)", "value": "ff867619dabc87243f5bb05aebe4ed48a78fb0417e68c52a50a4eab571b25b92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480393, "uuid": "803743ae-4a82-406f-b7e3-9e4c19ef0d38", "comment": "Malware payload (Vidar)", "value": "ab91e5851bc98e66f89b8986730088c33eb086bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768480393, "uuid": "c1137ce0-ef2b-4ac8-bf33-fd97b804eb88", "comment": "Malware payload (Vidar)", "value": "ac7368aeab8a5f2973d7912406b22fb0170ee202e70d2205f38a7cab6d6866c62c31d3b2babdc468695a8f1e2b276b8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480393, "uuid": "5dac9366-2068-445c-87cb-c535050b9f87", "value": "T1DAA55B176C9408B6D06A92328D7A7190BA32BC150F2117C72E43727D2FF6BE1D97ABD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480393, "uuid": "75ad5381-c71c-4df1-b1a0-b63917213476", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480393, "uuid": "d90edaee-dfca-4058-91a8-cb7f49e3dc70", "value": "24576:DHUu8/SaC0EfZ3J6hasHs4zjaVYWRx1Cjp6ayigzGcwGMUjeleN4j42WcYy2o20:DHH8aaC/ZZ6hXfzjenC/yi1Uxw2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768480393, "uuid": "22cbd14e-d8e4-4756-a414-f22cf6370311", "value": 2089984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768480393, "uuid": "75ffd83b-9ca7-40f7-ae7d-3cb6dcfeebfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768480393, "uuid": "678ef167-f71d-45af-b269-5408a92eaff0", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }