{ "Event": { "published": true, "date": "2025-12-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-18", "timestamp": 1766102581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ad0d2f8d-5b33-4759-a22c-a769e5304d09", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9611055d-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052545, "uuid": "c9e17fab-e1fa-44b2-9902-9592d29118bd", "comment": "Malware payload", "value": "b953a82778f82dd66140916ab36e4627", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052545, "uuid": "e1547d81-50d7-4284-88df-7d9f7a2c7a58", "comment": "Malware payload", "value": "031c6bc2328cb229b20ee852b4506f036811e3f1bdff846668aec1aa43833edc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052545, "uuid": "dee09c85-4ad5-4e39-9e73-174335c215d8", "comment": "Malware payload", "value": "02ce6476e1ebc61287b40d13610ccecdd1fec05a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052545, "uuid": "5bfcbb9f-8482-4b4c-af39-0c208af61ada", "comment": "Malware payload", "value": "bfdf0424ca0b546eac3779dc21e00cbad57f35612a2816be7d3357edad3d18b2c4c68ba46182b28e9e1cb98c4eecbbfc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052545, "uuid": "5d431c71-cf82-41ef-8049-15db19c630eb", "value": "T18ED437F4D641AC5EDC31AF554066CC2AE4663A9A2B1F3DC6AB00F7DC1B09E58907E8CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052545, "uuid": "f066400f-533d-46de-bda9-661678f0048d", "value": "192:Yf7TojKVTelneS18rznvDWoDrW50KOqb+DsXo5g6m8XO+9tIY0JXcOkZVH3BjH62:jQ3IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052545, "uuid": "248e65e2-e557-4558-b4e2-155b860237d6", "value": 641661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052545, "uuid": "7055bb5e-499b-4a23-8660-8358143ea460", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052545, "uuid": "a8548423-b162-48fd-97eb-29dbcfe82507", "value": "Letter of Intent (LOI).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2306110d-dbe7-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1766044622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044622, "uuid": "d2ecd63c-2b42-4c07-9c5b-ab5695472e8a", "comment": "Malware payload (GuLoader)", "value": "3155da301a502e751a2805f5c7d3afa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044622, "uuid": "58ae9b7c-bcf9-4380-86f6-0aa6a81089ad", "comment": "Malware payload (GuLoader)", "value": "0399c34993fa4537408a571820f9f1d8b56c0348007baf90c2c93cd88085ac7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044622, "uuid": "0f4bd88b-c105-4cc7-870e-0c309bc79a31", "comment": "Malware payload (GuLoader)", "value": "c9e7a1bbda1067676758ad35b1ef4998309db367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044622, "uuid": "f953a077-3e10-4a3c-b911-66e255cc59b0", "comment": "Malware payload (GuLoader)", "value": "e969cacf48b3ec55ede2ce17348273a931b7a55263a7dca3ec6839dc8e222467d04090806fd59e3bb21960304768a370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044622, "uuid": "bc28d1bd-95c4-49ef-ade1-ad33d4fa2482", "value": "T18AC4F1223B19EC47D29011B449A2E3BD4BB4BE5C2D6A8B03B7F13E9F79747925C5E240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044622, "uuid": "0db01ea3-8fe1-47b7-8ef0-791500868377", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044622, "uuid": "e0f9603f-9b90-46c5-a82d-60f6deb6b1a6", "value": "12288:FbjSjfsuPHYofbUbzvr5/A4Pf/LGXXHPMaYQ9WN09KeF:FbOjfJPHPgvtA43/LyHmQ9y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766044622, "uuid": "e20c3b9d-9ef8-4eae-9372-2893fbcca311", "value": 560776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766044622, "uuid": "8861a6cf-cce0-4196-9f4e-4307f46c9b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044622, "uuid": "6bf80cd8-f5d1-4d8a-90b0-d6fa7ceddc0d", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c597056a-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092568, "uuid": "1ad05afe-006e-4083-b261-7211599abe58", "comment": "Malware payload (Mirai)", "value": "884ff952d09c860498409704f281fba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092568, "uuid": "8333ce7d-c17e-4313-b12a-231833a3b7b8", "comment": "Malware payload (Mirai)", "value": "0580273c3f41f5025401e4836e4eaab1fda97f11b92a9ed215aef432e8151ec9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092568, "uuid": "283e5c24-6101-4fc7-a226-237f0cf7a4e0", "comment": "Malware payload (Mirai)", "value": "ee8ad14cae60fc4d1ce94862ed27070381794c7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092568, "uuid": "a70ae16c-4340-4ce3-80e7-d4781a406d35", "comment": "Malware payload (Mirai)", "value": "b125af748cbe8b209793d39e4b475c015bda1239445550b9aa90073a2aae39e3a6ea0b2bc926d854bc3db0b35c3cf34a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092568, "uuid": "c56bde23-bbd3-4223-8195-115407b10291", "value": "T1C9F2F135E7D95BD5D5242432D91BC646AEA39F7EC0FF22352B7042B3AEC035B1634A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092568, "uuid": "1b384380-2132-4f63-adc5-63b2640a9c47", "value": "768:/8kUDTbWxEjHWfJtJBAwgbxnaDw2FoqRlHZrCs3Uozx:/8kUDfIELAtJB2VIw2FoMjr/zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092568, "uuid": "85847f4e-4713-4303-b324-3481ef658d1c", "value": 34692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092568, "uuid": "495cae13-dc6d-4fdf-9009-ddcc314aa801", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092568, "uuid": "2ec85f31-80f3-49fd-83c2-715738c34a8c", "value": "xparm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2165945d-dc03-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766056645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766056645, "uuid": "ed2b0156-ab01-4836-8103-50dd84593f7c", "comment": "Malware payload (Mirai)", "value": "7bca6dc1a006a8978bceb6e96d5a2e3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766056645, "uuid": "aab2a175-4be0-472c-a791-e367584f89eb", "comment": "Malware payload (Mirai)", "value": "059de12a99cb9a84a0e98a98fa0456ebef75eb408e61575d13a3d9759f5f0a29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766056645, "uuid": "c862c4ac-efc3-4f7c-b30d-7b83181ba0e6", "comment": "Malware payload (Mirai)", "value": "e0ce18174f7cebcd8cfac32d200662261fd8cb39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766056645, "uuid": "256a8870-81e2-467e-a304-14c08c3356ef", "comment": "Malware payload (Mirai)", "value": "30b39f204e11468e1938758ea8035ac0b4c347f4bfef4cd0349c65d19ce9fd36bac551c3224de2cce74eddf53c86c06c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766056645, "uuid": "81e3c358-1e39-486a-9d47-a5d2499c4d36", "value": "T187933B97B801EEBEF80BE3B644A30916B530F7611F630B666267BD97AD320D43915F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766056645, "uuid": "2047d597-193f-44c7-91c9-27e7701f5aaa", "value": "1536:CLJfj3Ql9izW+5NpLBhDX438qphMzA867WKj/zXRR/hgIlNQsRn:CVfjADiz539BhDX4PhO6aKzdgIlNBRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766056645, "uuid": "19525665-859b-4a89-8286-8b1c21ac65a4", "value": 90272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766056645, "uuid": "c7221602-d847-4a93-a1b1-6830bb8c1299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766056645, "uuid": "ac2021e5-22a9-4caa-8b06-10e91a04a8b0", "value": "nova.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9563ca9d-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052974, "uuid": "2fdf1ec1-aba2-4e96-9cf1-0e4e64c61473", "comment": "Malware payload", "value": "a7cd9fa8ab4bb4567c6e7761e6d9574e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052974, "uuid": "5eb85569-4fbb-42b3-a820-494203c9586e", "comment": "Malware payload", "value": "064a2db4f5ab66fb5be3007f5fc1e8a94df5cdf2577c122c9904c4d9a785f766", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052974, "uuid": "ae4238a3-2a8c-463f-a325-a3b651798637", "comment": "Malware payload", "value": "c2a1050adef103258791c31312a3ef0ccb98c462", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052974, "uuid": "c1a08c58-a8da-4189-bbc7-8bb7eb9adf90", "comment": "Malware payload", "value": "8124ce606b6a89506072d1b99310a05d234c86d8691f4f35f57cfe6a7f79af8614802a551cc4c5c4040a6f5bc3cb34b7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052974, "uuid": "780511b9-297e-4e99-824b-60bdee349dd5", "value": "T1CD11F11763C20741D2F0C97F12B6F7548B25B216AC0B670EA49801592CE6D08EC3AF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052974, "uuid": "8e240f39-1ee9-4832-b559-467d442247c3", "value": "24:8+YAlZXKs072XGhpRVKB4I0QNPHZsOSPm:8A4xRVK+I7NxsOSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052974, "uuid": "e4215303-0d1a-4fb6-b297-e9c9bb10266f", "value": 997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052974, "uuid": "854dd956-0ad1-4552-a68e-2d1f0743eee9", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052974, "uuid": "fee0557d-e1d7-4839-8bd3-b7374029c1a0", "value": "view receipt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd8c4f8-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085281, "uuid": "42b6baa2-f5fc-4ccd-a530-3bfe87a84dea", "comment": "Malware payload (Mirai)", "value": "5ef9b8e4270acd588e01963b100395cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085281, "uuid": "8cdd2352-98c1-482a-820c-6b98a7fcf3c7", "comment": "Malware payload (Mirai)", "value": "06afd91475307f87c937c04978d8e899f0729b1f213c751abba6cbd714ef960f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085281, "uuid": "a106be31-10d3-4c9b-a284-798835b012c7", "comment": "Malware payload (Mirai)", "value": "ebdfc09a1b11c8d14e26659606c021548e197dec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085281, "uuid": "b4491a76-8fb9-4a4b-93e0-a7936d87cb17", "comment": "Malware payload (Mirai)", "value": "0871475fa3b3e175d10984f94c4d71362ffd027d8cf846d28de90b1dbf018b8a0914dfc8bfceba1636f4efe6b20b1fcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085281, "uuid": "9b5fe9be-c430-4cde-a5be-955f2f2d8c03", "value": "T18223F113F0B88349DC0DF1F69F26B2D40C18C44F7982C5637624BD5AABC8B55A62CFA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085281, "uuid": "a1650c1d-6cea-46d4-96df-b98cc757f93b", "value": "768:qx8p/yOCnrY068Fxay8C82A6rt3GAK792D3M1t3HuDllamgXnbcuyD7UHQRjo:q2Sr1fz182R27J2DcbioTXnouy8HyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085281, "uuid": "5d6bc8ef-2b85-4f61-80f9-b78b5cec90c8", "value": 46036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085281, "uuid": "345d4f83-734c-44e1-899f-0b0e9d1ba9eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085281, "uuid": "23da6c61-5ec9-4783-9b96-3dfd538b1d98", "value": "byte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69921ae-dc1f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766068894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068894, "uuid": "1e3f3fd7-84d0-4b5c-8857-d834ff381343", "comment": "Malware payload (Mirai)", "value": "0c160535c93a31696bf4485d127eb46f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068894, "uuid": "2e0e4463-747f-48b6-86e2-c5c9bb61d609", "comment": "Malware payload (Mirai)", "value": "071b6898f58e62ab414e0d52ee7f8354a8677fdd40e7424957938a7eafa4d190", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068894, "uuid": "5ca1daf0-dac5-41e7-b0c4-19d780c50df9", "comment": "Malware payload (Mirai)", "value": "a61c87e827b2e5ef56e88fb9f9f60270839b9d3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068894, "uuid": "0e475bf2-05b2-44fa-9562-93057d8b8a6f", "comment": "Malware payload (Mirai)", "value": "e70c7772ad1643ba6e7a3ad109f887c53c7bbb5bbbc758936d5d536ecdba8b6776149f446727845a83f27b83f00f63ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068894, "uuid": "14d3ed2e-6956-4aa2-91ed-545227869d09", "value": "T17193C519BB511FF7D89FCD3746AC0B02388C958622A83BB67574D828F64B24F55E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068894, "uuid": "0b8856ab-adf6-4973-9fb0-702df974d416", "value": "1536:NUYh3d42HG6+8dkqWnyg4/RnpZH5FBwXw5zwbZnL:NUYh3u2IKg4/ppu4zwbZnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766068894, "uuid": "43b31863-9561-4692-90c1-1cda8210752f", "value": 88844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766068894, "uuid": "f3b28a54-3880-418a-bd5e-4f1f289fa8f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068894, "uuid": "e65f8194-e047-4b53-8ac5-e2e81ccc3cea", "value": "skid.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a562f4-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092572, "uuid": "6f66a553-c862-4713-b91b-6380fca7b595", "comment": "Malware payload (Mirai)", "value": "347166d5e1682a6a42b1b990328b2d64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092572, "uuid": "9e2e4352-a72d-41c4-a732-776a89b839a4", "comment": "Malware payload (Mirai)", "value": "07ae848cc5ba570446b2e3e1ec560c6bb7f05e810a84a77a71f19c3f43270d65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092572, "uuid": "cacc1ffe-6993-416f-ace0-d736c3bc7fb4", "comment": "Malware payload (Mirai)", "value": "42310457c84aee596d4e0bff75a6ba0d33f48b38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092572, "uuid": "99bd9ee2-9f99-4e6b-a34a-792de9abdabf", "comment": "Malware payload (Mirai)", "value": "940b0789454578d8b6bc9bebbd3e6df12dda2f5974fde2c5c0b2583d00a985f7771f066934e744b4a02302fc915e6284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092572, "uuid": "1927aab4-02af-429e-8c09-e5ef2000e4e3", "value": "T13EF2F2BADB299C90D7340EB78429C5C617E67FBC901AF142B4429B28DE434ABE1F5C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092572, "uuid": "c0d96b41-a60b-4b13-92a9-ace7744d8012", "value": "768:eKiQ47RQc9wzkUJ0POAsxQ7uQMbQO6SLfg6eHzF9q3UEL6a:Ax7j3UO9+QTMbF32HEL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092572, "uuid": "3d2b50f0-0337-4c0e-aab9-8768c3c5f169", "value": 37240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092572, "uuid": "268daa40-f893-4771-a8b4-075710a98e71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092572, "uuid": "7e19d53a-0edd-4970-85ba-f36fd8d732fe", "value": "xparm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b424b07f-dbef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766048301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048301, "uuid": "3a8644d2-de59-4f24-983a-4bb89247fdb4", "comment": "Malware payload", "value": "eae1ec3042ed5e4414b400f6b80fb41d", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048301, "uuid": "813a37a3-badb-47ce-9fcb-ebbb9564d814", "comment": "Malware payload", "value": "09d7ca45799cc253580ba40d320022f383fce8d96969b04010737d9d4c957063", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048301, "uuid": "9bd05816-f543-40e9-9ab3-0e48760b1054", "comment": "Malware payload", "value": "14ee89a38f62c819b1bc5f2d913eed6ad614e33d", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048301, "uuid": "59da863a-2c27-4984-84e4-5b885876a7a3", "comment": "Malware payload", "value": "ca561ad4f787690128fd981c42a94df5d09f1eae45c377df7f12d664f5ab61ad9b09a1652fb5b84a329883d90fb8f4c2", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048301, "uuid": "9767e89d-bde8-4f15-bab3-7573176f3a08", "value": "T13EF423899C4BD21393B3DFE448547D8C33DDE362FF66DC9A04A15DACAA94340494A2EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048301, "uuid": "a41dd3a3-d653-48bf-bdc1-32743c7696c7", "value": "12288:2+JuGx1+okIhlJkiQPZzRfanIpOPrUl8byS70TIKZd0:FJk0ldQPZzpanIpOIlsL0UKZd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766048301, "uuid": "5832f3ad-c7e4-48ea-8aea-3a7069c4959a", "value": 724403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766048301, "uuid": "501374e8-59cc-45b5-8a5d-2eace6e61a2e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048301, "uuid": "9f0273f2-d6ff-4d73-9b73-55a570f26e73", "value": "Nomina 16.12.25.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea1cfd5-dc05-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766057472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057472, "uuid": "f683ff0f-e8f5-489a-be1d-06c605f8f278", "comment": "Malware payload", "value": "b9496fc25dbb2b7c0ff02af7277c56be", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057472, "uuid": "661a54f7-587b-4434-b6d4-131c845712bc", "comment": "Malware payload", "value": "0aa2c5ada6c60c67d6c010d5417e7bed74e35c9c9c339f1898f3d07d52aeaae0", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057472, "uuid": "6bb21feb-936b-42de-a29b-f910e52e876d", "comment": "Malware payload", "value": "b5f8b4bc73dfad0bee81b91e810cd71feb3c65d2", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057472, "uuid": "843e935a-099a-4eb3-8a71-ce83b414d7da", "comment": "Malware payload", "value": "a49e6cb9dd884edfd594af2fe78cab855408d39906bc10fcaf2e77c6d33cc38dd2cd152d2fd0cfec0d22b7b6fb719758", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057472, "uuid": "5826e4be-afb9-4c1a-9d28-f907ad135894", "value": "T180F40FA5452EF55ACAE9A7BEEE8540CB2A8E349D34710C0F4083FD55B917827463FB38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057472, "uuid": "1dd51130-8f1b-46ca-875c-9214c5d57dec", "value": "96:5bbtOrThyDhIQccccccccccccccccccccccccccccccccccccccccccccccccccA:NYrlqOkZ7RRdsIcRkxNos5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766057472, "uuid": "0c64392d-da88-4ab2-865c-55009275aba0", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766057472, "uuid": "f35e2160-0644-4414-a245-71f35d982aaa", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057472, "uuid": "9dad43f1-a458-41cb-8604-d1822b582edf", "value": "nZAKUPU_2862467.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f460119a-dbf1-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766049268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049268, "uuid": "f1817c0e-ae1c-4909-8141-7b4eaa626a35", "comment": "Malware payload (CoinMiner)", "value": "e4e16af17e49e3c8e70fd9ee88165f25", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049268, "uuid": "6d65d04e-49b7-4572-a14d-7ae27e16c2cf", "comment": "Malware payload (CoinMiner)", "value": "0b8af99acc6ea0b0b25c7cec0e0403836975c93e2153213cb74b2e823d9aaaf8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049268, "uuid": "7c3f0f62-af69-4f94-be10-a14fb12f4f42", "comment": "Malware payload (CoinMiner)", "value": "bf9f73255bc647f694cb975aab50f49faaaa581c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049268, "uuid": "2d8a6213-a1fa-4aeb-875f-fead56944266", "comment": "Malware payload (CoinMiner)", "value": "0fb91ce16790c777ac16f1f87c2cf5ee16c53cae61b2b436e3ddbe4f000fec3902335c2924d6cd4516d0f023e341c26c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049268, "uuid": "8e07d88a-7a43-416f-8dce-d283097f33ed", "value": "T199F5DF15E3A801B9D82BD734CA658333D6B0B9925370E54F0A9DD6052F73AA29F3F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049268, "uuid": "b1f3e22e-05d0-4393-a838-c106eb70e692", "value": "e2aa63e3f0d9837d01e53951cc9f3e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049268, "uuid": "c2d938ba-ba33-49f8-9f3c-3ba4d7f28ca9", "value": "49152:cE4oLGU8GV4gBvu/AfGFu5izUZRORD4sfhWSF2UpQi:NCq0AwzgROtcti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766049268, "uuid": "a7d0defa-ca06-49b0-9623-b84cf94fd677", "value": 3511808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766049268, "uuid": "3a51af57-8111-4eb2-b66d-7fc9164aa702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049268, "uuid": "d13456e4-2983-4184-8bde-0f33610f2ba3", "value": "nw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1e10eb-dbfb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053470, "uuid": "adb18bae-041b-4fb7-acd5-b9e3f463da78", "comment": "Malware payload", "value": "1a287679e3b75b9da7720987b9c135c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053470, "uuid": "b389a829-d98c-4cd8-8d22-a9f98e6c2350", "comment": "Malware payload", "value": "0b8b877618eea2613fd3edff560cac1237ca6a832383f5c7f16a5dba2b332905", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053470, "uuid": "47b1db87-4996-4bf7-a59e-530a14a2f109", "comment": "Malware payload", "value": "0ede4140500db2e17dcc5ba4d0bf6573ba8c97c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053470, "uuid": "d9853913-9714-41ab-89d5-316b0eb34c06", "comment": "Malware payload", "value": "981bb39086f1648b65d02aef0c192ec9b426d2e5fa53c8b588cbeb8ff683dd97d595407513505af0d4696a2246db538d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053470, "uuid": "7e315169-4e44-40e7-9e5c-93cce2268e8a", "value": "T1EB4333C83FD2B8B0536270B76D2BA06AF57E5C84B64C40E4D3A694D4F92C318D6B1B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053470, "uuid": "f250dc38-ddda-413f-8730-a1a2e66f348a", "value": "1536:DMuobHtnjcW4WYnaj6RthgIofTF2SjEndm7305lpAI5Nz7:pg4WlZN7kxAI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053470, "uuid": "b7fc3c76-a1b2-446a-9315-060d032198b9", "value": 57774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053470, "uuid": "bfeed618-b573-41c9-84a6-55b335f7e2f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053470, "uuid": "9ef3ed87-c609-4513-bee0-b87cff9c1f31", "value": "booking - Geonic.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd87034-dbef-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766048213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048213, "uuid": "6f15dffe-01f8-42be-9000-39d19f4f3348", "comment": "Malware payload (Formbook)", "value": "82f08a330f0ed7e3178fbf81eeaa18b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048213, "uuid": "71b71ec3-34d6-40f0-acb2-ca4a09fa5be7", "comment": "Malware payload (Formbook)", "value": "0d2d887adcdf6309c4532e75ddb508db33402c7a488c3e2b8943c6721dab6708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048213, "uuid": "24233cc0-9d35-4100-9efb-edc4dca274d2", "comment": "Malware payload (Formbook)", "value": "abb66ca320e068183f80e19a3f814330441e5fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048213, "uuid": "7952fbd9-5d26-4916-879f-d2b3861b2084", "comment": "Malware payload (Formbook)", "value": "3644e292f72b0ec53f50cab18904cae493a2366ef83c5814e54bcd66868ba1a15acdf93652011543f111429f773dd445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048213, "uuid": "3e0068e8-e436-4649-95af-ef05371cee1a", "value": "T1CD65BE01A3A44668D677E234CAA74B32E771B8411770D6DF1A98DE1D2F33BD06B3A325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048213, "uuid": "d35cbf10-f01b-4a7f-a27b-9241cc874bcd", "value": "85e02b8dc3af1881758d87cbf27319e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048213, "uuid": "7d92190a-0cfc-4fda-ba56-94f598f740b0", "value": "24576:S4QvySMEBZP1F2ZM5lfl4epwuaeCSGPZ0Bb8FbwF0EG:S4QqS9JlfWepwTQQZNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766048213, "uuid": "e19d5eb0-1a56-4fae-82c8-3b2d09b6ef6c", "value": 1410560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766048213, "uuid": "48cccc32-0feb-40fe-95f8-a9b1bc7456bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048213, "uuid": "ae9bf36b-25e9-4f08-983e-4ca4b15a4aa9", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa90ab54-dbfc-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766054003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054003, "uuid": "8cce4ab2-efea-4633-b531-b3048e926adf", "comment": "Malware payload (PureLogsStealer)", "value": "d5f1add0c7f39829c63c8de6990cef48", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054003, "uuid": "caf10bb4-d39e-4d06-9d72-99fb0d54153d", "comment": "Malware payload (PureLogsStealer)", "value": "0de6ae05ec96f3389ff5b70f918979de19295d2fb945e75537e6593c3226526f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054003, "uuid": "cf061b85-9189-4d51-9687-e91c16b7e32a", "comment": "Malware payload (PureLogsStealer)", "value": "552044263a826210811eed35110e4ff0eea4ecef", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054003, "uuid": "2cc5b3bf-7e0e-468e-b227-cfca9ee430d4", "comment": "Malware payload (PureLogsStealer)", "value": "52bcabd2952f1e75a1039b0bac68be5c4e4d1e5ef3b3005926e5753e694927301ba2ab3ecf5f7194d53ef1865de2b395", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766054003, "uuid": "48dd30a1-6e81-4e11-ace0-2ec46a97df1a", "value": "T10025335ADC80083BF8EB06F23D88D64C99C7A650A1503D324EAFF355CA097FD19E699D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766054003, "uuid": "d88a29f2-3c73-469e-8905-244b27ebf21d", "value": "24576:Ci+Oxc0v9t4kBqQsmgRS+5MTSTrmx5yHpldEB7dRVBPEolm532tm:V+OaM4kBqn0+jTSx5yPd+7pBdlmpym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766054003, "uuid": "93049ca9-a95e-47c4-bdc2-c75dffea74e8", "value": 1012592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766054003, "uuid": "20083387-3535-43c3-a9a8-601bab253955", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766054003, "uuid": "a52ea0cd-e60e-459f-a66f-840a3be955b0", "value": "INQ-N046687-12-2025.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e1470a-dbe4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766043316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043316, "uuid": "b973fd83-44e4-4285-8e27-97df8651fc38", "comment": "Malware payload (Mirai)", "value": "7bc2b090839d853708c92c7e7db2aa6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043316, "uuid": "54f9f780-00a3-4800-a06b-9fc514393eac", "comment": "Malware payload (Mirai)", "value": "0e21765b4731eaed63530b4fcb41fc75bc433199971e208e6e3e8e570630968b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043316, "uuid": "2f262aa8-51f1-4a73-931c-3e0b4240bcad", "comment": "Malware payload (Mirai)", "value": "1c6b5063efe58d9e79429e0a840a84f90436ad61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043316, "uuid": "961f3b18-cb95-41c5-9de3-9a255835e9db", "comment": "Malware payload (Mirai)", "value": "1615235f4bea67d9efdabb41a1bbfd07ddcad1202bb568ae08c2a87461fc0a56da2e642cf16c49e2aaf969be3c7f7297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043316, "uuid": "a8172224-d7b1-4ee8-acc4-26e37343a5d2", "value": "T13BC34C21B8BE591BC9C4A57751F74722E1F2634A70BC4A0F3D231E8CBF6165022677AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043316, "uuid": "297bef6e-fb8f-46c4-8f59-9f8debfddb39", "value": "3072:WFDOHw8kuUrHCDZrW4ivPZKhix1X1P5ORJqjCgNtCa8Bm:WFDOZ7qn3Ca8Bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766043316, "uuid": "e53f9411-1c17-4ebe-b116-5694a909dce3", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766043316, "uuid": "988ed362-e58a-49bb-968c-8ae19a6fefeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043316, "uuid": "26f1f4d0-0ea4-47b5-9ecf-68efd78211a9", "value": "rondo.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c850694b-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766092573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092573, "uuid": "9dd3af6e-5041-42e1-8914-f7072347a794", "comment": "Malware payload", "value": "a79e5e642c04a8ad2f83a969c71857e4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092573, "uuid": "d9fe716a-5b81-42b8-adf8-0fbe0a6f3e7c", "comment": "Malware payload", "value": "0f4570f98ddcbaa032069fcb94608143078eab427008519169c32d8662563bc0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092573, "uuid": "c721cfdf-c4f0-42ec-becc-82dab34139d1", "comment": "Malware payload", "value": "33e6177536ae9ffd4b5a5c41248d6061da7dec0d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092573, "uuid": "d38d22c0-ce6d-4679-942e-f3932b8b9478", "comment": "Malware payload", "value": "18b75f342a8b3808766d3b54de9c0c2a412f7f28fa98a11e93f4678440aba7a28993bd57d17ae4e1795acc27b0a95716", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092573, "uuid": "9ff13423-34d0-4810-acfc-38da103af8be", "value": "T1E421DFC90011D7165E6B9F1863BBEA94D102F8D227C68E27ECC40D37CC8DA157D46EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092573, "uuid": "c1d8b21f-5a35-40b0-b56b-ce7b164f32fc", "value": "12:oXjBgIUGgsiGNI1dgiL6YgLDCrxDSi7g9Jbgyiwg7GihGgd1gLraLxra5655gBxc:oG1stNIIfL2dsEzCrxLgkUlCeT4haV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092573, "uuid": "aa2826f3-aada-482a-b52a-4b462cbb1922", "value": 1310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092573, "uuid": "4dbd12fd-ced5-4c17-b045-0f36cc80ff60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092573, "uuid": "4fd7dcf1-be45-49f6-a39e-1628168d03d3", "value": "b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd62e18f-dc07-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766058732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058732, "uuid": "f630e9ce-9e7d-4e7b-993a-f8f7703947ed", "comment": "Malware payload (Mirai)", "value": "d464791222b179c1a58029bcc0255ff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058732, "uuid": "a4b1f0a4-f877-430e-a424-bed313b19971", "comment": "Malware payload (Mirai)", "value": "100cd74d52c3ef2ceda2e7ee4062de83ec3eff27a41751170302141f438d52fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058732, "uuid": "896fec3b-d364-42d3-841c-57d92fcfedd1", "comment": "Malware payload (Mirai)", "value": "931fc5c539a3129eaa3d6ef4ed9ba2e0028caa50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058732, "uuid": "9e5297e9-e15a-4ec1-b079-96d72d66103f", "comment": "Malware payload (Mirai)", "value": "3b00630f36bade5c1dee8ec7583aa63d49d4bba20914a4a5bd9dd5e6b780092be1b5e6f6258fb6ac44036eec8b579b46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058732, "uuid": "df52e99d-0637-41be-bfaf-d638fde7a0f4", "value": "T165B32B14FA82C0F6DC1B08709156B73F8B30E9279122EE45EFA85F6ACA27D46571738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058732, "uuid": "0966452f-93f8-45a0-aca3-9b1e74b2f859", "value": "3072:JQznyLgp8gbBvnVFJ5q2OGstpLT9ItEJnkiuxFFVakp:JcyLg2gbPILtJCxzvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766058732, "uuid": "748bb266-4ef3-47e4-adce-64ee995ba6ce", "value": 116836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766058732, "uuid": "84c859ff-2bbd-4f43-8998-560d9b39c53f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058732, "uuid": "1aa157a6-da77-4ec2-aa51-e685c0c4730c", "value": "rondo.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00988a3a-dc2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766075488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075488, "uuid": "f0a29903-a68c-4c89-abdf-60533854a657", "comment": "Malware payload (Stealc)", "value": "a50dfdd0152877c28f16eceab84d0b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075488, "uuid": "db120d4d-9d93-43d2-a4c4-e2c97df0b9cd", "comment": "Malware payload (Stealc)", "value": "10183a5473a22d1ddd8fa4e3d196604534581d5bc0fe38349331fc44892b9497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075488, "uuid": "c414f61a-7813-408c-9f12-21627b52c75a", "comment": "Malware payload (Stealc)", "value": "aa01c012f7d65e0935f5d3a0e648a780a6798783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075488, "uuid": "661978fa-c077-4403-a227-de2160e1f543", "comment": "Malware payload (Stealc)", "value": "e02a245dd8f2cf261d117559451ab6ee17fb3fbc384630cd23d93239621e62f2f77a8787a989488e19ae67269fd07311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075488, "uuid": "7e1bcba3-4cdf-4297-b34c-fef906391bd9", "value": "T163858D4BBC9105B6C0BA933288A661917B32BC1A1F3223E72E60B37C2F777D15975764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075488, "uuid": "f56a0a04-5a32-4593-a8ee-0d8d3ecf0e79", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075488, "uuid": "140a9161-abd9-442e-8632-016f5fa22468", "value": "24576:MbeeudtBxB9t2nJJvRZCxTWKMF0nob4Q2GdQ2mcCo8xwU:MbeBBxBY7SobD5go8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766075488, "uuid": "dfd15299-33b2-425b-b708-bb219dbb8351", "value": 1866752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766075488, "uuid": "fa8658cc-7563-4ce6-9921-73defac92cd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075488, "uuid": "b98dc182-ee8b-4fb2-b307-ce26120c0393", "value": "pexels-vinixhc.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f857b45-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041690, "uuid": "22d3e52a-096b-413e-9b8a-5faf94d6d7de", "comment": "Malware payload (Mirai)", "value": "6ed85a5e95757da29d264796afe07b75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041690, "uuid": "588e4835-0151-4387-9455-7f116eda6d71", "comment": "Malware payload (Mirai)", "value": "10cd29f61c882759b25364369d260cf56ac94266d346a7971017b76dc15695ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041690, "uuid": "273a4451-cc16-4ae5-b18a-e43ab79ce4bb", "comment": "Malware payload (Mirai)", "value": "7eeae5d6ba3c2a8a0aabc8839fe6190ae325b2bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041690, "uuid": "8162cb99-0bdd-4481-ae3f-7b0e61a4e67b", "comment": "Malware payload (Mirai)", "value": "42f874da5e4030fe507e6d1fa7904c7f9ceb1dd5380f7104437e552b02eb8bc3902cd01c46850a5d502aa41b14c45d55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041690, "uuid": "af351f9e-8bc9-4c5c-b59e-31776a0d4035", "value": "T1F60308DAB801ED3CF81FE7BE45234909F661774541931B2723B7FDA39C321A48A26E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041690, "uuid": "371cf69f-0c09-4662-8586-c770ee6f9ec0", "value": "768:xPevWDdA0ziFnDiZ7nfoquiSmwm0v0h060A9tKht8vq9:Z/dA0ziFDiZLHu4h06f9Q78C9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041690, "uuid": "60988dc6-3c4b-4fbf-ad8b-522d1ccd08a9", "value": 37964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041690, "uuid": "0fed33a4-1a41-43cb-b478-900133799710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041690, "uuid": "0421a13d-88a4-4930-8936-97e46c12bcdc", "value": "kvariant.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b7e913-dbea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766046136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766046136, "uuid": "e9c1dcd9-6425-45ad-9517-b4fabe3fe773", "comment": "Malware payload", "value": "716c1da8c517654504cb974a6373da31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766046136, "uuid": "5fccb5f6-fcf2-4580-a555-a26f9d83d0e6", "comment": "Malware payload", "value": "10f65fdf519b5404d636b6ffa42e61d7658cc7ad78f23a5ecb6b0159b6c90712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766046136, "uuid": "1ec51b66-b1ca-45da-9710-919208027f4c", "comment": "Malware payload", "value": "6505f1f0629899e20e7c02ffa2560ed001173f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766046136, "uuid": "baaf5962-eff2-4d9a-b015-2b39ebf7f565", "comment": "Malware payload", "value": "9d1f4fb02c2a38e48d1005f2ae231f553ed3d9944c161cb77187826b72089ee2c84f6770a9c9a8db8c5370dccb1daf92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766046136, "uuid": "2f77f36e-4ecc-4f70-8c58-b84b717f12ac", "value": "T1B94723577DE9D2D8D3838E50F68B21D921D172AE8CEE091E26CB5C022531EA7CB49D73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766046136, "uuid": "64c3ab97-ca7a-499a-ac02-b83d8caabfd4", "value": "78d9ad37a3585490edd6d599a2e3d28a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766046136, "uuid": "d5811aca-8958-4857-bd59-db8acb7d1835", "value": "393216:MFSwKdLHANC9YT1x/qYaV75tzK6uIIpMmhBltX4mbul4n9NTs0Vh7:MFSwK5cFGYaVNZKVI9mJBNbul4n9G0VF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766046136, "uuid": "16d11533-9237-40bd-81c7-6601e4aaf6dc", "value": 24746016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766046136, "uuid": "4c76de41-158f-47ce-a154-0f04d7b5a794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766046136, "uuid": "fba66c64-8032-4e84-97a3-fd43c3b4194f", "value": "TempSpoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09e6cb9-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766052617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052617, "uuid": "4cb855c0-725a-46c1-8eb1-82a5c2b22aa1", "comment": "Malware payload (AgentTesla)", "value": "25e37dc60779c8765acecf3cdf3f88ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052617, "uuid": "1a3ff732-efa7-4b36-83e6-7c5687324a64", "comment": "Malware payload (AgentTesla)", "value": "1180ed9832f2127292c76ee0660864b6f539a38ed539e62c74fcfe96d044b105", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052617, "uuid": "5c415703-83f4-46f2-87f0-28685b9b1dbd", "comment": "Malware payload (AgentTesla)", "value": "2c9e46a8951305d96e797ea9b87a0550c0b3783b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052617, "uuid": "1727c28a-dcd4-4a4c-8a1d-abf155c158b4", "comment": "Malware payload (AgentTesla)", "value": "cf8297d057df2922043fef6eb9e24071b2934728acf9467deefadce54bb24d0c325c58132d2b6a3d523411802bc11061", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052617, "uuid": "9dbe4785-95f6-41ad-9c69-5559f965d7b5", "value": "T18262447BD55CEFF00B3E22F011877D1120A1A326B9368D6C98D684547F2AB428F978EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052617, "uuid": "d71c6696-37ff-40c0-b308-340b40989c79", "value": "384:JOVUFhE2VPm0vKk9yfmtWF5goUk1mhRAaUwca3FO+wwF:0VUvE+ZKkHIjFmjPvF6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052617, "uuid": "55cbc38f-89d8-422f-86f9-8a93a5b21754", "value": 15891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052617, "uuid": "7e432e7e-23ed-4feb-addd-53f3cab72122", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052617, "uuid": "ca13b9a0-2528-4b20-8dba-030acae47665", "value": "Holiday_Bookings_078.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3553028b-dc6a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766100916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100916, "uuid": "73cedef9-b04e-4528-85ba-45d10badf7aa", "comment": "Malware payload", "value": "fad54b4175b29ae17f4e19a23235e75a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100916, "uuid": "fb5c3b76-8429-433d-a552-c6fe3a1ffa05", "comment": "Malware payload", "value": "12158514cd85a93258eb979315961e2520d3d7ab41fb7732db10891943a30931", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100916, "uuid": "9adf124a-e6bb-4d89-9f29-a826c502e82f", "comment": "Malware payload", "value": "3a2c67f214621a162128ee3a7e444be0e67bb790", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100916, "uuid": "4a41a38c-eafc-4f56-95e7-5d61b1026098", "comment": "Malware payload", "value": "f2b788b52507c35a9e350d1ed4fac1be49b85c902cb95148b388eeaf02a37dafaaf8e8aaefe85bf887317be7a8ab060b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100916, "uuid": "d5c2205c-1ebb-49c2-842e-fa480c944fbc", "value": "T10F546C16FA5658FCF95BC03C874285626A36749A0B21E9FF02A401383FA77F16F38B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100916, "uuid": "766ec9cc-6730-432d-a657-2ec103351f19", "value": "9c06be8c772508390d4fe1920c6b26f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100916, "uuid": "a0493a1d-cfe7-4ad5-a4b8-ce0c619f56b0", "value": "6144:5Cl6zt6tZH0jofNq8lh38Gm/uG4WTXOB:E3tZHB1q8le/ZT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766100916, "uuid": "361e0dd9-b5b4-424d-8ea3-5b57746b1b27", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766100916, "uuid": "528dec2e-512a-4dfd-99b0-9a63db440357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100916, "uuid": "39f704e0-c675-4184-86b2-0d46dca02a27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6937cd1-dbf1-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1766049271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049271, "uuid": "3f3bef02-e3ca-4784-aeef-6ff45644e540", "comment": "Malware payload (CobaltStrike)", "value": "e2b3ec8e6062a59e24f7d907b3fbad76", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049271, "uuid": "4e734b5e-c1d3-432f-ac36-b309af867c2a", "comment": "Malware payload (CobaltStrike)", "value": "122789db14d04b78b14c224259ab48f0489e98aa5255fd5bd6dff5c0be241b2f", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049271, "uuid": "2b220a01-a619-45a9-9f82-2b9ac9b6eba0", "comment": "Malware payload (CobaltStrike)", "value": "e5315454f94d0866235c476f790280b8be7001f8", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049271, "uuid": "20f08289-bc5b-4b15-be65-d70c15d96f08", "comment": "Malware payload (CobaltStrike)", "value": "1889ee7304ad14fa792d029375fc82df99050ecb77724faf3e5d5929984f67474678f0694b09f524caf56556ca6f1d74", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049271, "uuid": "e3af3847-f297-47dc-9c92-d56f9091ec06", "value": "T1E4649C7498E1A81BEBCC60BB2644CD7E6DE2BB585AFE084515283F1C8E142EF6057F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049271, "uuid": "bb6d3064-897a-4523-95c8-682bdb00142c", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049271, "uuid": "bcedcde9-2f95-4a68-96a6-1be5f92f722d", "value": "6144:z0x28oet9d6xqGn++Fzm62zpg9o5GNNYgBhTJtTW6EY:z088oet9d6x5nXFzm6AnGNJBhT3VE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766049271, "uuid": "6704a597-f1e0-4d57-bb71-2b4b1b4fbe6f", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766049271, "uuid": "d8d09e4a-568e-4337-997a-6a7491f8478d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049271, "uuid": "d9b3e237-c4bd-431e-b448-2fd18e98535d", "value": "ken.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba84093-dc1a-11f0-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1766066782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066782, "uuid": "12990cdc-52f9-4133-b4bf-131feaadb8e1", "comment": "Malware payload (Expiro)", "value": "7f573d4fcfa5f5017701d3fb77dfa5b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066782, "uuid": "c39c9280-9077-47a0-875a-17627f630e38", "comment": "Malware payload (Expiro)", "value": "179bf1ea9f57a3a7c60cbba1eb40decf53239de71f475edc05d2354eb86689c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066782, "uuid": "43cc27e6-b625-4bff-aadd-39dc34e62edb", "comment": "Malware payload (Expiro)", "value": "8050a823a9496e16bfa830ab001d35bb1c9ea9cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066782, "uuid": "edf94e72-2ccf-4775-b146-e2690ee9cf42", "comment": "Malware payload (Expiro)", "value": "4b3717a9583421f4d4c6a276e484346d9881e80c03c2c28e76ded7d9d4c7b97d5ba491f4c7866ce79bf73e7ea6f7a960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066782, "uuid": "73f4a106-0d17-4eb4-8ce5-d8c0418b065f", "value": "T17F95BF16EA60F469E85B4570E83552F6292A3C75E900EC4BF780BF5A3474A9B78F430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066782, "uuid": "10271e06-95cb-410a-8646-6afd3ea80b71", "value": "ba29acb858c0eb015c79c455af546ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066782, "uuid": "c2c1ed34-577c-4db1-b27f-9559217fb997", "value": "12288:y5/wee6TT/4ntjO1itCsGacV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5c:ceQ4AlVg9N9JMlDlfjRiVuVsWt5MJMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766066782, "uuid": "71c99264-b11e-470b-94dd-4f47015c46ac", "value": 1982464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766066782, "uuid": "d0bb5057-fefc-419d-b4b8-1e765a3abfd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066782, "uuid": "e86afc53-a885-49bd-97f2-8fd8ee2fbf22", "value": "Factura vencida ___2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcdee5e-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766052991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052991, "uuid": "6faa6d8c-fc6d-4c21-bcbb-eed182ffd731", "comment": "Malware payload (AgentTesla)", "value": "58444d2e97904cc46e6bdbf9118e6799", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052991, "uuid": "bdabe7a1-0158-4f2a-b0dc-52ec1971d8de", "comment": "Malware payload (AgentTesla)", "value": "17db55601a986610ab40e69afe8f2ce8fffc2cee478e2a36c67a45f99936e913", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052991, "uuid": "4f21943b-a51f-4fcc-9df2-b23c06223668", "comment": "Malware payload (AgentTesla)", "value": "5f27ade138e1df3e731fd014e53e31a33cb4a032", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052991, "uuid": "e6fd2b64-01a0-4c0c-965f-f593b343c5b4", "comment": "Malware payload (AgentTesla)", "value": "450ba64c058e378550d0eac52a63af3fd1569fcb119dcd00d3ebeb9ed7ab8edf4dcd6440d415dae3ba19c724387fad5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052991, "uuid": "053161e3-0fcf-46b9-b4d9-d812ab04af27", "value": "T1DD4343C83FD2B8B0536270B76D2BA06AF57E5C84B64C40E4D3A694D4F92C318D6B1B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052991, "uuid": "c526c32f-05c3-4873-b700-23c49ab5f0de", "value": "1536:DTuobHtnjcW4WYnaj6RthgIofTF2SjEndm7305lpAI5Nz7:mg4WlZN7kxAI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052991, "uuid": "5c60daf5-4ad8-405f-9573-8c99714edd41", "value": 57774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052991, "uuid": "fb4740ea-1c69-4dd7-af75-5341c8a4131b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052991, "uuid": "91332876-daf0-4c82-93cc-c6f4fa38cafc", "value": "SAP ARIBA QUOTE ADNOC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae326818-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092529, "uuid": "298e0e90-1910-4593-84e8-7a84456e75d5", "comment": "Malware payload (Mirai)", "value": "5cf8500bc961b21c78e9c38da39aa191", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092529, "uuid": "bc235e4d-abd1-46c2-842d-496afb028af2", "comment": "Malware payload (Mirai)", "value": "1a24f0e8c34af93c865722fba814896619da06e3db3152f0bfa0e779b74fe566", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092529, "uuid": "48d1f65f-20f7-4c81-9d5b-4c2d0bb434a5", "comment": "Malware payload (Mirai)", "value": "9dbb649e7087f46d2d9772a8a8bd79f91867d217", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092529, "uuid": "5aedd9de-0bf9-4583-87bd-d73e037676be", "comment": "Malware payload (Mirai)", "value": "0fb30860fbe93c0f5ed13a5ee3096afefa97f711f91596527194e5a2418482904ad1aba36401591cc98815e3c4427294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092529, "uuid": "8038708f-efde-4e8d-a628-4a939e8a9593", "value": "T1B893B81E6E218FADF769C73047B78A21A75833C627E1D685E25CD6002F6034D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092529, "uuid": "53488052-49a1-44e6-a98b-c901fc375668", "value": "1536:KloXJI3TfgvWkPoqXXgLAHw3AGh6zeglH08kYf:KkJIDov5PxwLH3AGka89f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092529, "uuid": "21d6d98f-4b28-49c0-b36c-631e6d038d4f", "value": 93352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092529, "uuid": "3ac35453-93d9-4d15-8bab-52286483a583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092529, "uuid": "3ac3488a-4174-4270-bf05-8ea8631989b7", "value": "xpmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370d47ae-dc55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766091900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766091900, "uuid": "90d3e7c7-0c2e-44cc-bbfb-1532e690f2b2", "comment": "Malware payload", "value": "5781f3fc02b696380a12c5b7496eedb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766091900, "uuid": "d023d299-5c34-43fa-bf3f-40165e70059f", "comment": "Malware payload", "value": "1a30a31acb5237866f8e99f7742b8f8c83aca1a27f561f1a5fd2b4cc9e164c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766091900, "uuid": "182a84a1-e881-4c50-b973-e032b11b0b8d", "comment": "Malware payload", "value": "7255b4abe96822329aab488d0db8ba671719dbc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766091900, "uuid": "6dcc4423-ecad-4826-bfad-edf56fc65a10", "comment": "Malware payload", "value": "d9186307a5434f2b22ac4b9bd2ede13e8c08df67730a8c92b8b7a04d71633b2f3900a71d90714ff5d4cd23f3d0d9e481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766091900, "uuid": "7eb42094-761e-4ca2-8d51-9a003842bbcc", "value": "T16BA4E612E660F429E89B8574EC3956F6192A3C71E901ED4FF780BF5A3431A8779B021F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766091900, "uuid": "27480ef9-748d-468c-af44-608fbd318cda", "value": "3124b196abcde5b96514709b22c7a7cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766091900, "uuid": "944d9ec5-8328-425c-8543-c71fb458e76f", "value": "6144:CECtzBA3ziioQ2NRgE3GE3ueXkv4KrrL7tAGyUwjsXeJTk0/:MzBA3ei/2ngnt/PSGyUHXmk0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766091900, "uuid": "ed039fc3-2ec1-4220-b4d6-2cbf05a3b2a9", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766091900, "uuid": "8a4db9bb-cda9-4e41-b607-7605817e8db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766091900, "uuid": "635df7a1-9741-487f-a315-65576d57b9b5", "value": "bootjack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be4e9b5-dbc1-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1766028396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766028396, "uuid": "6f3aafdf-d811-4a4f-9a72-cce20e51d5c9", "comment": "Malware payload (Joker)", "value": "b77139e247b114ef009145a06550da9a", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766028396, "uuid": "22d26650-bbdb-4311-9850-9b9dc236164c", "comment": "Malware payload (Joker)", "value": "1d550c75442fb16775f062e703f09937e2ea03e28140f968f55fab198a1d2a89", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766028396, "uuid": "85d4f454-474b-495a-9abd-b8baa2451c26", "comment": "Malware payload (Joker)", "value": "e7494837241b780e27434f37da05cbc227d38b5d", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766028396, "uuid": "67658dae-1b9c-401b-9226-479eb7324456", "comment": "Malware payload (Joker)", "value": "c63d04af491dc0172233829e03e13fcc71fee3b9a7f55f61a3ec76d9dc386d5b4d7c0ccbfb82736ad0488d578cd99645", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766028396, "uuid": "ab87043c-1f07-41b2-b6cb-a139af7da8e1", "value": "T1F1960186FB0CD53FD877A037CEAA11237266AD0246569B737519F20C28B39898F49FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766028396, "uuid": "27055628-6ae5-4770-9dd3-d700525e3f5b", "value": "196608:BdY5gqIQ7MAIbhc/ZeIGc1AEMxD+ZDLH3bN4G9g761YzD21LbTU6:4NIQ7KhcBeIBzMYZDj399g21Yzyw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766028396, "uuid": "9c3ba3df-e05d-4696-888e-ef4206ed0afa", "value": 9031999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766028396, "uuid": "afc922f0-683b-4769-ab32-d3f19e90367f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766028396, "uuid": "6c15ed7e-2e70-4e3d-9290-e6a478b7c64a", "value": "Aim+Pure+Cleaner_1.3.23.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb148da-dbef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766048208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048208, "uuid": "aca1170b-a9b8-48f2-ac08-22d614fdbc36", "comment": "Malware payload", "value": "46dc8fab2d9fc772fd114a106c94e2b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048208, "uuid": "75411baa-a5b8-4c4a-8869-d67dca35be21", "comment": "Malware payload", "value": "1e02362da89ebf5d7e87ada2f31d218fcf724986ba90f74f996c2df047378a9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048208, "uuid": "d514c203-dbb4-481b-ad46-057b71afe475", "comment": "Malware payload", "value": "2eb2e1411792760a0bf6d602debb3b90bae9750e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048208, "uuid": "7e6f29b0-b494-4968-b807-4a0f1036bf30", "comment": "Malware payload", "value": "605328eff38517d0239ff809a3a3af8a282ace2b655ee287457944fc62676c54ce5e15bc1049ffafab4a80729011d163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048208, "uuid": "462b5cf6-d93c-419f-8719-855d0164cd50", "value": "T1CA247D21B4C1C431D577153309F8DFBA5B3DB9211B626ADB67980F7E8F201C2AB3196A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048208, "uuid": "7a83a6c6-8b0b-488c-a123-37b5f4a025c7", "value": "31ba2dcb49ab5d61acfa8dae6ea3c66d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048208, "uuid": "31329a51-c564-4efd-9ac9-449feb888397", "value": "3072:e9VXUi/M2MjjGnzOy8YU9PIQjGg+nHWulKJAvnZGnp0nGunADb8Hvgvp3mjxM87g:lqSYU9gQVK/GAvnYnOUooIjl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766048208, "uuid": "c1ba1ff0-c2c8-40c8-9a19-1e4a8cb207b9", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766048208, "uuid": "f6f7e1b4-c7d6-4726-ba1e-f7dec1707878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048208, "uuid": "67e60253-daeb-42c0-a3ac-8cc1a3275da6", "value": "46dc8fab2d9fc772fd114a106c94e2b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cd2061-dc0c-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1766060709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060709, "uuid": "2f5a04ab-620b-4097-ad77-f70749612818", "comment": "Malware payload (RedLineStealer)", "value": "a5eeaa806a6d39a1f43ae03d423a69ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060709, "uuid": "56f36a64-e4d0-48af-9b9b-a0e4e892164d", "comment": "Malware payload (RedLineStealer)", "value": "1e0df0b7ddd6821d54ecf37db6a67d267387bf56751a8dfc036896b266c2d1bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060709, "uuid": "f4b53715-c7cf-43bd-b7d0-decf4ea91c62", "comment": "Malware payload (RedLineStealer)", "value": "73bed0f676e135ddd5b3adaa8eebe441a5d02918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060709, "uuid": "daec40cf-e2e7-407a-8d3a-4a581cbd4f65", "comment": "Malware payload (RedLineStealer)", "value": "0c635e9c7add43213c214b5d3bfd9c0474d373f85056c203b504c1f00c852947bf7d2eded73e6ae32e74278c07be01f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060709, "uuid": "7c5c2aa0-4fe6-4ee9-bc6a-2eb188513a48", "value": "T149C401D01E69BB12CD751BB0A935DD7463B00E682104FED78CEEBFE772A93419608B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060709, "uuid": "8b7422dd-5572-41bb-be0f-a44da18ec60f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060709, "uuid": "aae52f39-f11c-4d9f-aad6-2e9ed0c0b387", "value": "12288:7a4w9K+bCtGqzBrgIr1srx7ZJPPP6VvfDzz1OryDLed+/L:7os0qzBUIr1srx7ZJSVT316daL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766060709, "uuid": "b0d68b1f-0a98-43fa-a286-d17910ec7d20", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766060709, "uuid": "6e39757d-d7c0-4ecc-aa34-3014da44f4a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060709, "uuid": "6223f1cd-2770-4e16-a23b-9f051ba65b5d", "value": "537910028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a75d8e5-dc08-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766058888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058888, "uuid": "4326c45b-3ec3-40c5-b53d-cc9909171afa", "comment": "Malware payload", "value": "e740a5c708f94ba4f4bfddbc62f710d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058888, "uuid": "80135e98-174e-4a95-80fa-2c9692ce1293", "comment": "Malware payload", "value": "1f4b06537adf990510345134e74f95c50adab6ec4f23c202bb062f48b5cea00c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058888, "uuid": "57c7eec2-34bf-4143-95a7-1f8b4fdb1001", "comment": "Malware payload", "value": "9790f93a6005b18ecb7a97eb3989cae1b8b0fca7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058888, "uuid": "fee989eb-a50c-456d-8151-0ff4ec129412", "comment": "Malware payload", "value": "f932571c5ab6d56b2c7462dcec8630e809caebd2ca9f4d3c7df8269e763f968caa3820c81c9e11172657e94de159a4f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058888, "uuid": "1b71a319-400d-4b15-9135-fdbd8c7069ba", "value": "T170A69D05B3C48AA9C056DA39AA2BD332D2B3BD534A36C24F15D6F30A5F73B515F2DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058888, "uuid": "a0e66cd5-5ff9-4ad0-b76b-3e53346d1b12", "value": "87b38c5075f16f721fb95a0a3bd73b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058888, "uuid": "ebb88c44-7175-4c3a-8287-20a809c646e6", "value": "196608:Zxe2C82X3BH38GXoblE0pIRghya9D0b79/d/dkiVwoZbo0UMPvvUx6bfK7fx9dDy:u2C/RX7FRghyyDI79dw0PXjfK7fPdDwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766058888, "uuid": "71a9d5a3-4484-4cb4-af04-7e18f83e4864", "value": 9871360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766058888, "uuid": "b977d9bc-40ef-403d-be2f-1b4131e62210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058888, "uuid": "538eb95b-2401-4709-ba7e-7bbc095c8e03", "value": "vsdbg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d92ada-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041692, "uuid": "66da19f8-e495-4b3b-a2b5-65c80270a881", "comment": "Malware payload (Mirai)", "value": "cba6702261cf6a9de1d79b074e46a7c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041692, "uuid": "afec180f-c388-4743-847b-c027287cf0d6", "comment": "Malware payload (Mirai)", "value": "1f8ec02067d58d56f723496c0c4f793f66900fc53fb3f8ee796449d29d9f486c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041692, "uuid": "e6151150-1555-4c8e-b2cb-7d56fe6147f5", "comment": "Malware payload (Mirai)", "value": "ae884a4ea0acc7ccc44313d561c2b4b18ddd16ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041692, "uuid": "aeda9bc0-ac64-46e8-b5b3-ace82913ee95", "comment": "Malware payload (Mirai)", "value": "0a57c9046c7703c443d7ed4ff2253f52aa3f1dbcc24806fe0d108a0eaf0df30c7ae30541a4133313d7f79cfdf83d3cbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041692, "uuid": "00471fea-9469-495d-8a3e-c7bdd9301a7b", "value": "T1E9B31956EB418F03C4D51775BAAF42453323EB55A3DB33064A28AFB43F867AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041692, "uuid": "08085cf7-0c09-426e-80e1-2f1db291eaca", "value": "3072:z302UcNY5uoewXtfc4J39/JYmh/HM/9lY2:Y2UNIJwXtfc4V9ymhPM/97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041692, "uuid": "a9231e84-f6c8-4134-ad4c-87f05ffb5e20", "value": 107658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041692, "uuid": "d9403acb-47dc-4fbe-bbe4-7b7a0c676227", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041692, "uuid": "19f46c94-580c-45a8-9758-566618290dc9", "value": "kvariant.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bef504-dbfb-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1766053565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053565, "uuid": "8127f7a6-0915-4bd7-809c-2a1eac714990", "comment": "Malware payload (a310Logger)", "value": "b3c2547d02fb49cb4d2b2a2ca101d938", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053565, "uuid": "5a68d6c9-eb75-4f53-bde6-96badefb01af", "comment": "Malware payload (a310Logger)", "value": "1ffdf7d60a9ea155e01520d12ebfadbdca8b62d99ff925245c184499b34a75f5", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053565, "uuid": "d0f1e4ee-2bc1-46b2-a18d-9d15f1841341", "comment": "Malware payload (a310Logger)", "value": "1772f06feb32bc73d1e98f15174b4d89ee3c6c1c", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053565, "uuid": "504646c0-f975-4a75-bd46-6268f7324ab8", "comment": "Malware payload (a310Logger)", "value": "124226737d6a1ee334135f013d19736c806566ad1916079c667413c87fca13014e551e83e68539d5d33992aa756b06b5", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053565, "uuid": "bd1248d4-8e9d-48f5-8c04-82899d54dd8e", "value": "T171459DB66A869F05CC3028B80B739BF99F6C0D17F510CA9359D6391BA9BC281345E377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053565, "uuid": "4f678436-d9f7-4dd9-a99e-46de5f5dcf4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053565, "uuid": "382b55af-f9df-4cad-afb3-ffc475566954", "value": "12288:NVFd/s2tpDPkER/caE25J+42dQizOUsyt8BYXx0tDUKGXnS6KMSfWIn6rn5R606q:1h7DPcr2i5XzOU56ECqXNInKbdyHNxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053565, "uuid": "80020c33-ca5c-4f62-8e07-09d147c4043d", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053565, "uuid": "854d5607-c819-4d4c-bda8-5d519fa86919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053565, "uuid": "5fa56cda-f7d6-4519-93ee-bb0cd395ba91", "value": "Halkbank,doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ebf708-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085340, "uuid": "9414aaf6-6ebb-4294-b605-d6da3f0cb5dd", "comment": "Malware payload (Mirai)", "value": "4f1907bcc71d2624d30d9c3dcba63b4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085340, "uuid": "50de013b-20a6-4a60-a18b-b2de424c8b15", "comment": "Malware payload (Mirai)", "value": "20222f3f916a1323ad7d329b377dd8e96c0cb2bbbfd60a44fa45e35656e1b530", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085340, "uuid": "eed82090-573a-4b22-89f7-58f2243ce757", "comment": "Malware payload (Mirai)", "value": "f39f2365a927ac93dd51deaad158dc3c58875b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085340, "uuid": "21f5177c-cb45-43fa-ba45-9c82c5eedfc8", "comment": "Malware payload (Mirai)", "value": "35e931e3b4a6b9de819b22f29f7e6a79a0f7c28b65f2587df23348e6af1567a4e0cba5aa843003c6f780051da5e681f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085340, "uuid": "b3286806-5634-400e-82bc-15cbcf3690ee", "value": "T1E2A37EC0F783D5F5E85601B52133EB338736F836602ADA87C39D6932AD92A11DA1739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085340, "uuid": "8317e680-8925-481a-938d-7785fa39b707", "value": "1536:ujhK1n8CYkOv3hFBAESoctRS+W78U1l2Ik3rnAoLFQQlUSYrlB9:uSn8HdRFBAESoct1BU1l/krnPL/BQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085340, "uuid": "41c538ef-6fe0-4496-b9b2-c22e773c27af", "value": 102732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085340, "uuid": "d88b4967-1a81-46f0-be5e-31083bbb835a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085340, "uuid": "38b29f72-e41c-4499-910c-4eb76be80de7", "value": "byte.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f543575-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766041716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041716, "uuid": "48fc96c6-e70d-4fa2-8ee5-2f4f1a23820a", "comment": "Malware payload (Formbook)", "value": "acc0d409afd87d81009113c99a197d25", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041716, "uuid": "892bffed-6b40-4245-a394-10bc8dc70044", "comment": "Malware payload (Formbook)", "value": "208a9785967bc5fea172b0239bce73c86c0f405362800b565c3afed2a4cd4c93", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041716, "uuid": "4137e4f2-61ef-4cb0-b2b8-7e801b97c10f", "comment": "Malware payload (Formbook)", "value": "cab6d86e04c66b3d4fc1f8513766fb3d38802ca4", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041716, "uuid": "36d9a526-e8ed-436f-beb5-bd6c5a0f19af", "comment": "Malware payload (Formbook)", "value": "b853f8d4577b9ce1e7caf864384a01315ff584647f7f97ee6f53585a768a1856cb899538ee69dd431eafec0f5eebdacd", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041716, "uuid": "3aa604f3-b369-4d11-9914-208e9a2b0023", "value": "T121F422B229CA3CBCC49C99E9952B317070EE0C799AA536355E1753DC9E809CD1A01EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041716, "uuid": "b9cc3abd-f418-46a1-8175-6cc25308268b", "value": "12288:YuHgnDhA4F9WKLo4+aMvMDXXxUXKBl9LOwIq82bVayReSr8/rvqnCTkwd+i+ac6X:Y2gdrFt1+aoMzxUXql96I82LRaynCTzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041716, "uuid": "6cfc7766-ccdc-4581-8b91-8d1d915face9", "value": 753027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041716, "uuid": "a5bd8791-8185-42c3-a4ce-a4adb8a21889", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041716, "uuid": "0813329f-6b22-4222-88d1-78f569e17656", "value": "Invoice 202532206.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a60bd48-dc0c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766060579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060579, "uuid": "8d6dabdd-b6bf-4f4d-b891-ce87975c05d8", "comment": "Malware payload", "value": "3d8f992fceaf5c262a656ec4e8cb7533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060579, "uuid": "9a33afcc-e22e-402e-8b0e-0b9558221973", "comment": "Malware payload", "value": "2184d03881845a644eeed46ee7e95cf05fd522fa28bd6a4682ddb35d953c8899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060579, "uuid": "b70a3e9d-c873-4ecf-afe1-3eb18f583e97", "comment": "Malware payload", "value": "dc08baaab5261b9843f86f02592c54e6f75e16c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060579, "uuid": "ce4939da-2a67-4243-a2a8-fca26b225e7b", "comment": "Malware payload", "value": "e553c14a8f40bf420c272ff5b700a93f8f5e6d1cc27eb1b2a6b7563007925a68c30622ec7ab7c5ecde775a22692c53d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060579, "uuid": "65925456-1363-427c-840a-978103082f58", "value": "T14D085A4267EA04C4F9FBEA3589E65117D673BC166F3085CF224C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060579, "uuid": "7544e377-bce4-467e-b8cf-b597ab900bae", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060579, "uuid": "69724e92-4269-4e34-9463-b008c0704c0d", "value": "393216:76l8yvpcavR2rcq2qwOF1jUY+UwFD/Vhu0usIyNOnS0B4AycWMCYWbUll7aWGTbM:7IpC/o0sJY1G0G+or5rs3wbS31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766060579, "uuid": "cfbf50d7-67e2-442f-bc98-5b1ef6d9aedf", "value": 77677161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766060579, "uuid": "74b4312a-2633-4d8f-b54a-d28d0d0447ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060579, "uuid": "539ba38d-8bf2-4ddb-a3e8-51749b29c6e3", "value": "n3k8r1p0zu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c431c9-dbb3-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766022312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766022312, "uuid": "51ee4912-a355-4998-80b3-5ac187ff9a2c", "comment": "Malware payload (PureLogsStealer)", "value": "42d4ba846ced59641f58e28bdce3f44b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766022312, "uuid": "a8961a86-c3c7-40da-9d61-580e1f01b153", "comment": "Malware payload (PureLogsStealer)", "value": "223c7cd13aea8fc9294d7c70ceab0b47e7943a539c0aa4d6b813fdc6204146ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766022312, "uuid": "e9bad021-37b1-4307-94c2-5f0356db9e19", "comment": "Malware payload (PureLogsStealer)", "value": "675b4ba0081814979442a7f872bd2426ef63e840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766022312, "uuid": "db687338-a9d1-47e4-aa2f-7e93dd6c2d2f", "comment": "Malware payload (PureLogsStealer)", "value": "df8e719a9831ebfb9bf2e5d0801a802aa0609c65ade5b2356628b37a3fcedd53bf60c7a2646869353f6cedb2b921bbbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766022312, "uuid": "05d44111-aec2-4b31-84c8-c0e344f31a28", "value": "T142C42389BF414464D8CFA3FAD44F89C8155DA26EAAE3AEBF9DDC4B52180030136567F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766022312, "uuid": "78e771ba-9969-431e-8f02-6baaa96f1017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766022312, "uuid": "ae29d9f8-ff08-4f89-9069-11f7294515e5", "value": "12288:W7hE2FJi3dI/Rl1PXPgzZnWOqUHwl+/EoPXuaYjtxRXexD:myuRXPgbHwU/ua8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766022312, "uuid": "41e16c4c-7f7d-4285-bdf3-7bd7c92a7809", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766022312, "uuid": "4fa860d8-32cf-4193-8d72-54c6b464a6d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766022312, "uuid": "42e1b691-e133-4c4f-a4a7-23896faafa8c", "value": "42D4BA846CED59641F58E28BDCE3F44B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7443037-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053031, "uuid": "51ac2824-c9c3-423c-a747-4d437b445414", "comment": "Malware payload", "value": "888106d4ee2eb76b468ca60d0d42b987", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053031, "uuid": "d0f13e5b-59bf-43f6-bd49-77a4d764f530", "comment": "Malware payload", "value": "22c82e599efee60dfcc61674e315922cafe2a44fce11f67bbc97754bcb664ee9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053031, "uuid": "c41f0b2b-5b2d-4240-a9cd-4c294db646c0", "comment": "Malware payload", "value": "cbd00c7288a403d9fbe91e1c6b389e62875be947", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053031, "uuid": "738ccae9-1753-4510-890f-c739bb6a958a", "comment": "Malware payload", "value": "3b9110ef239e73636bc5c2b82b3ba3d5ddd1b74b920bcf6bd1847c73d53ca18429d8b4ee5ab1d9afcf0287ae3f22d948", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053031, "uuid": "a1db8dbc-5c39-4b89-be26-93eb997113aa", "value": "T165D3734062C1B8A403971F76771FB8D5FD3F09D93498498BC161FD90B9B5B0AEAE0A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053031, "uuid": "f18b0c1e-e510-48c3-bc59-8dcb5812099b", "value": "3072:YbBpBN7kiBka+7xrl+NU8HJBeSZ9W2tmkZJCatDo+tvOmenvWMRaAS/UK:YbTBdkiWa+7xrl+NU8HJBeSZ9W2tJkaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053031, "uuid": "e8e9045d-661b-4cb5-ba86-158c58dc4c87", "value": 142113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053031, "uuid": "8450a2b7-1a0b-413a-81da-f01efadaa62f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053031, "uuid": "7ce6bc08-0202-411c-b377-63e755e6c624", "value": "Paymnet_slip.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5b4720-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085275, "uuid": "4d2d8877-dc60-43ce-8879-ce809ac45cc9", "comment": "Malware payload (Mirai)", "value": "243577c9d4aa675ad318ee7b77911cf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085275, "uuid": "d205ae23-f349-47fa-a0a2-1dcc74891730", "comment": "Malware payload (Mirai)", "value": "237dc577630f5709e84fafca5c6326e3b505bbed2eea56a4b5c0394635e4eaeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085275, "uuid": "c87a49c4-3e34-4714-92e6-2da95124ed5b", "comment": "Malware payload (Mirai)", "value": "b828243590238dedafca62d94f18638373eb99bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085275, "uuid": "5d91cf65-ca84-4303-a1b9-c2a5c50a93df", "comment": "Malware payload (Mirai)", "value": "7ede5f9cfab3b73c46c48e420fb4b78fa32c01c080247dc0decd9552f9aff23a01723dd814d35f49ac072ed7d334335e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085275, "uuid": "dfe4fc09-ace5-4ce2-b643-caa1f61b6dbd", "value": "T1E2235A726BB93E23D0F0A77941B7470232A47BD51960E78FBD520C0BAE1632069677ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085275, "uuid": "13b8bff4-0fef-4db2-9a1e-13859749d670", "value": "768:xow8o4ghH9reAI4R7u9aizFZdGRjq9EfKh+CVNUCdJ7:Cw8TgrreAI4R7uP9Efo9VNNdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085275, "uuid": "2c17bc76-6ba3-4211-a146-136c86905cdb", "value": 47840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085275, "uuid": "09628453-949a-4cb8-a03b-69990cdb6141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085275, "uuid": "1bab1d9a-b72c-4f33-bce6-65a8ae9bf44a", "value": "byte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa03ff60-dc2e-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766075476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075476, "uuid": "4af21b69-5f60-4ed4-8b09-ffe66206f8f9", "comment": "Malware payload (RemcosRAT)", "value": "1daa9186de3070fdf164b0521da88d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075476, "uuid": "759f90f5-b3ed-4106-bb78-84801aa2ff60", "comment": "Malware payload (RemcosRAT)", "value": "23d149cde5c26c3038ae300de14e7a3b14edadfa57df2b1027a415b82a19117f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075476, "uuid": "89c1039b-ea7b-439c-aae6-d9acf210db62", "comment": "Malware payload (RemcosRAT)", "value": "058817bb927b98e76c58cbab34705ff789ec19e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075476, "uuid": "95a8fce9-35d7-4ed6-874b-c2c55320500c", "comment": "Malware payload (RemcosRAT)", "value": "00087add16b52c49a43ecce06efd5a96ce6654782e4f56511f83f5277f2221bb73c91466c642d3075d07d87dbd49cf0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075476, "uuid": "9ac92d85-a034-4ff6-acc5-5d17f31fbef6", "value": "T1BF95D0836F60FC6EC1226C77680EF69D080E3D6E7DD4DA43729DAA09CB675412626DC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075476, "uuid": "d90acacb-49a6-4eb6-b369-f146f43b53a4", "value": "17040f86b1c73ad5fbc172c893eb18fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075476, "uuid": "5147f234-31fb-4f99-87a6-cfb60e05b247", "value": "24576:vh3eUt+ITfhbiTovSyzYfXnEJO80U9s2G7gwipKukn12pNKzq1hJYE1VZB:vR+DyzYfXnILqggnnpzqDbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766075476, "uuid": "40fbeb69-fdd7-426b-bd1d-fa06d2240745", "value": 1943040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766075476, "uuid": "a83ebcfa-4c40-417e-82bf-ed27e2945c63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075476, "uuid": "760c794c-d0bf-4d6a-943e-20b7cf268739", "value": "z28IMG3456789000987654345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348e623e-dc6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766101344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101344, "uuid": "93a04afa-886f-4059-84fc-a8139fc4d56b", "comment": "Malware payload", "value": "bdb7847e29bfe07fc044d5e708e4654f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101344, "uuid": "e489f49a-44ec-4fd4-8cfa-f987a0717c2b", "comment": "Malware payload", "value": "245dcccbf3747bdedaa69b67395a9978a25c1c3bee21324c64c08990c753a202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101344, "uuid": "c638760c-36ba-41bc-a546-80d5dc0670c8", "comment": "Malware payload", "value": "0830f6d63f8dcd4e4681a24e4f72848cd5d69edb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101344, "uuid": "55d6d131-a698-45b8-950e-9c1587f47e53", "comment": "Malware payload", "value": "85b544597837a57dee056205f4a711732bf8b2ec0ed6ae0ce5e8bfbee3686dcf7f424564540826ec5b1fe8d01f00bb91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101344, "uuid": "108abc3a-98ae-48e6-9e29-efe93f6eead9", "value": "T182C31A66EC929655C9D316BBFA1D958E332303BCD3EF32178E284F24279A42B0D7B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101344, "uuid": "37f42077-b345-4199-82cc-9c29a4fde670", "value": "3072:GaffeIHF/PsTSDFCpnXam1FFg7Vb76PusZ:GaffeIHF/SSDF+XagaVbePtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766101344, "uuid": "2025c9f2-1275-4bed-88a9-51e370101ef4", "value": 124940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766101344, "uuid": "f535a5e7-124c-4e0b-8643-89d39bd94043", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101344, "uuid": "35f9f917-e80e-477f-a213-3255725bdb2b", "value": "rondo.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8530db-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092471, "uuid": "1e70d3e4-5167-44c8-8d0b-85d63d8aaf31", "comment": "Malware payload (Mirai)", "value": "733ad6112fdda526dcb8d7094e2508c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092471, "uuid": "205fa39a-a65f-4321-9496-800cbe563f74", "comment": "Malware payload (Mirai)", "value": "249bc7c5f69ca45551a7b7c35076a8a63b9c6de3d5228ca3006bd92583351fcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092471, "uuid": "a73bf757-0318-4747-98f1-6550c82085df", "comment": "Malware payload (Mirai)", "value": "34678adea467c8bd5d4dd74be1fb48023111e9c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092471, "uuid": "84b2e643-7254-463a-874c-a250b8ea1cf2", "comment": "Malware payload (Mirai)", "value": "9c32a1f8b3d63fcb0a314bdf2c96d11911e43ad9d4f8a1ff227459afcfefd6396052274b23f7ae8bff11f7ed37362373", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092471, "uuid": "dac6e34a-a9e0-4d4a-b874-d77e70f78c18", "value": "T11682C02423E936B2F7F04839EE66C28653A517F8C0ED3775142125BCCE7215DA2E698B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092471, "uuid": "983a09e5-924a-463e-95b9-1e8c9c7c67e2", "value": "384:3czJ2ycgX2VF8l4sdV4dRE/Bxp9V9aMuNPxM+QvhymdGUop5h4k:Md2TgGVF8lEda9VUMuXMds3Uozr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092471, "uuid": "50a64093-115b-4a67-8798-7576cfd7291f", "value": 18032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092471, "uuid": "f1436996-55ab-47e0-9c59-800ca6d79ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092471, "uuid": "a9c0db39-40f9-4603-a969-298c2aed47b9", "value": "xparm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a2cc4e-dc3c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766081106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766081106, "uuid": "d2b709d5-66ea-4a1c-86bd-ffbb1ccb1b3f", "comment": "Malware payload", "value": "1863cafb18d5c310c720f62062e035b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766081106, "uuid": "dd3e53c5-b38e-49f5-b1ca-5de68488bfad", "comment": "Malware payload", "value": "25ecf6e2fc31b5ec7f258ae93298f12df01c7e3765166f908d9f91d7a6952f73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766081106, "uuid": "3263517d-438f-4b7c-96f3-bde4c16f10cc", "comment": "Malware payload", "value": "e35f128e635f7c4392cbdf11b5e2b9b72e59862f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766081106, "uuid": "a469c758-193d-40cb-9fde-7a3808d15021", "comment": "Malware payload", "value": "1988370015a089cc1ef68276e8661178e933d33c4762824d2c6a27a9f782350a174498b21ea4b30d5ac54d6bc63e3280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766081106, "uuid": "d51bbbc7-229f-4909-84f1-880f46f6dab4", "value": "T1F6086C4262EA04C4F9F7DA759AF65617C673BC122F3085CF221C172A1F736E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766081106, "uuid": "8eed54f8-02ab-4cc2-89f6-3ea8b63ed43c", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766081106, "uuid": "c5b322cf-b673-43bf-b6b3-77771a7289d1", "value": "393216:36l8yvpcavR2rcq2qwOF1jUY+UwFD/Vhu0usIyNOnS0B4AycWMCYWbUll7aWGTbT:3IpC/o0sJY1G0G+or5rs3wbS3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766081106, "uuid": "aa69e9b0-0797-4003-9dbe-3194acb16e67", "value": 81688118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766081106, "uuid": "aa6461b2-fe1e-4da7-8df7-b756d89ac5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766081106, "uuid": "9fa18aa3-87d1-4e93-9eaa-897713d674a3", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af897efa-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092531, "uuid": "38d3c7d5-9d20-4c8f-aa01-9850d3cb1285", "comment": "Malware payload (Mirai)", "value": "43f467fb1e63aaf087ea2b7d7431afc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092531, "uuid": "49d1ee36-3db7-4c9c-84ed-c6ce38a5c375", "comment": "Malware payload (Mirai)", "value": "26981000c9dcc72e03daee4831623582d9a983da900581759427cd2ae8d3609d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092531, "uuid": "5e51b9d6-d198-44c4-8740-35e47568a47b", "comment": "Malware payload (Mirai)", "value": "1c9e24aafbabe01a94fb53de48d8e4ecfabcd8f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092531, "uuid": "d4efee02-5c92-478a-8025-41e1d9ec4390", "comment": "Malware payload (Mirai)", "value": "9891812b4e77b8513630f5806ca38de327a294c7cad2b7e49b46f3cd5d05ae04d8362f3c68d123b5633f998cee40ed22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092531, "uuid": "f54cda4a-479c-4985-89a1-b61f9c7e0e17", "value": "T18E93D506BB650FFBD86FCD3746A9071239CC550A22E93B3A3634C91CB51B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092531, "uuid": "be92c6dd-5bec-467b-836d-531701c46354", "value": "1536:lX1tMe0R/thi+vZEvPgaLiVw0FmWnM9kyXZLHLQq7V861yMRVz8Z:lltMe0R//lEp5Wn2XvJVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092531, "uuid": "87e7c5f5-5d7e-49a2-b6e7-d0f53e99021d", "value": 93464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092531, "uuid": "1d11e8ce-0f8e-4c2a-b454-e38073e36080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092531, "uuid": "ad2ed555-7dfb-4f68-b941-139f3ecca8a3", "value": "xpmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb747b9c-dbfb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053494, "uuid": "875b863a-c079-442c-9a85-ec947bcd8852", "comment": "Malware payload", "value": "d49ce2133b21de7d31293b9d107f9608", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053494, "uuid": "bc8c7a24-4575-4a81-b8b5-2e73e011308a", "comment": "Malware payload", "value": "272913137f54882124b19e557d1103b3f570a284dd1e493b66af37cbe7946b0f", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053494, "uuid": "04d87ec9-d2c6-460a-98fe-15e6e4d4084e", "comment": "Malware payload", "value": "aead9ace0db5816f55195c5bc03ad83df6064450", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053494, "uuid": "5231f74f-037d-4a74-b735-fed45f176a1d", "comment": "Malware payload", "value": "db9c717b4ca853d39de34a2ad1cae0c3fec4cbbc5c2fa842fabccc0cb0b27687c65610dd67b87db5aa881cb0e853e69a", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053494, "uuid": "5c1a08df-72d3-4872-9ded-db5ec1a2b77f", "value": "T1B94333C83FD2B8B0536270B76D2BA06AF57E5C84B64C40E4D3A694D4F92C318D6B1B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053494, "uuid": "245a4074-78d4-49a1-86f1-353af81aa017", "value": "1536:D5uobHtnjcW4WYnaj6RthgIofTF2SjEndm7305lpAI5Nz7:Ig4WlZN7kxAI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053494, "uuid": "efccc92e-9108-4676-a686-c3176847a5ef", "value": 57774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053494, "uuid": "430f06ae-b87b-4497-9bf0-52c98c160d8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053494, "uuid": "06a44c2d-39f6-4ed9-b460-a196446c37e7", "value": "dekont4387289933.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb36aa1-dc08-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766059132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059132, "uuid": "4bbd8a02-9447-4714-9f54-aa04e6827d0a", "comment": "Malware payload (Vidar)", "value": "d16f127f8280482a53e804e2998bebda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059132, "uuid": "69bf39cb-d3f7-4cad-8fa6-fb3917488cc2", "comment": "Malware payload (Vidar)", "value": "282fb87286a7333532d6d35c5b09cd12e92fb975cc5993818e6e1a7e5c074a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059132, "uuid": "c8fbdf9e-584c-439e-b4e4-4b069adbbef0", "comment": "Malware payload (Vidar)", "value": "e2e2d86031fc93406d08b5d4941c251312ff3bdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059132, "uuid": "55c52976-c089-4d25-b453-db9cc2970bf5", "comment": "Malware payload (Vidar)", "value": "41d68beb100cda57d21e929a39acef06e06d77b60a7659be07584fc0d20ab50fabf80cb7f6897121d3058f36f6c93e66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059132, "uuid": "e93930d9-9651-43a6-bca7-d8c56d4525c6", "value": "T133B65C93AEA04A65D5AFF23AECA2514533307844433125D77AD127A84DBBBD4133BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059132, "uuid": "de4eca45-3029-44e9-93f7-bf8be93f23bf", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059132, "uuid": "f7a6976d-ec7c-4384-9c39-1952bd539d29", "value": "49152:jR4F1g+oxlnJmB4ZXs4lKQgrYww8ObA3O/JmfKlURKlzPn7Al2lQ9ykVnf0JNMIr:jK6fLIQjUEEnLJr04ybxxx82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766059132, "uuid": "339bc558-c557-435d-b6eb-48edbe33685d", "value": 10930064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766059132, "uuid": "ed197ee5-5aa7-456b-a02b-1a7ee1550a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059132, "uuid": "d83528d7-edec-41a9-8b04-9b5a3f3155d1", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4456b9-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092472, "uuid": "aec20f65-5d81-4481-9cd3-4282907461c8", "comment": "Malware payload (Mirai)", "value": "2cc0ea76c3abb06da561ee3f9f9cdd6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092472, "uuid": "5820a34b-a875-4750-9d68-1d9789c83f79", "comment": "Malware payload (Mirai)", "value": "2b63ef456fbcfaa61cac464fd974a01fc3e8c77f378ae83bcaa52b66e5f3db0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092472, "uuid": "0b5de1c4-18bd-4af2-b07c-ce2ac50f581a", "comment": "Malware payload (Mirai)", "value": "143d957481280a8bcfd7c704a208ee438cf61c6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092472, "uuid": "0e7720a4-2550-4946-b1d9-1d96b6509416", "comment": "Malware payload (Mirai)", "value": "c34a9e6e54cc3d2d9a5b01cb2ffd542bbaf950d756c3d154a1cb2c0009cebf8e59868e835adf3b3ef06a66c4264c89ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092472, "uuid": "0403c074-bcb6-447c-a313-c8a1beeb2080", "value": "T12AF2E1786E2701DDEB249DFA4E8D03D13582CF726882A8C56E50E69A496277C74C37F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092472, "uuid": "ebd87c71-ba49-4d34-b53b-04b69ed23446", "value": "768:tlWqYyhCzylm9aXm1ounixnWjTHwYuW+6QIykXhxJgGlzDpbuR1JQZ:2q+mlUJ/nixnWnQrKQIyWtVJueZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092472, "uuid": "d317cb3c-aabd-48f9-b199-f84d31e44d7c", "value": 36120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092472, "uuid": "1ed6463b-f738-4da1-a5bb-46e33c36f03c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092472, "uuid": "8720ff7b-649a-4519-a368-9dbb8179a746", "value": "xpmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d402bc07-dc44-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1766084862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766084862, "uuid": "15dd92d3-69a3-409e-b6ca-b603f729f46a", "comment": "Malware payload (njrat)", "value": "a6fd318006dc828ff5d76a647f385d68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766084862, "uuid": "c2e4b8d4-74b3-4356-b999-2d07bc3c99f7", "comment": "Malware payload (njrat)", "value": "2c6592950b4b786a7a13f1457f5f5fbeaf096906dc106503a8286c1c03b62a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766084862, "uuid": "dff1ea56-acce-4695-aab3-832398b95e86", "comment": "Malware payload (njrat)", "value": "4d63e01958e754cf059fdc09e9b39aa12bd6c69e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766084862, "uuid": "92e233c6-99b6-4545-8cb1-39af851b2c76", "comment": "Malware payload (njrat)", "value": "c86413172f147a815d73e144c73439cf64368226e9e9217faa57aa31364a0e17910a6a540b07f557fbe9ebed8736faf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766084862, "uuid": "477133d7-d870-40d6-aab9-15816d862252", "value": "T19E25D09177F4851BE2FF2B75E4B148094BB7F9429936DB4F089890AD1EB37808E107A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766084862, "uuid": "9953e59c-2436-46e2-b8b8-f2ae514cc16d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766084862, "uuid": "3405e95f-8953-45a3-8beb-87005401f8b9", "value": "24576:kF/ppxJzck+uGW/yFoBkkAQil2Jk0kN/AS91V:kF/ppTYjqqanTFsAW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766084862, "uuid": "9906206c-e30e-4969-9cbe-e17e9847c8ce", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766084862, "uuid": "1e541645-7b6b-421e-b61e-3ccea5aae9d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766084862, "uuid": "29f1a90a-38c5-4321-a3be-4ea9090bab38", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b7e188-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1766052625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052625, "uuid": "3ee7e672-7cab-4240-9f52-94beccd905ef", "comment": "Malware payload (GuLoader)", "value": "a9aa33846ab9249e4a23cfd6a50a5dab", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052625, "uuid": "6890b56a-6618-46bd-ad5a-d8182a45d477", "comment": "Malware payload (GuLoader)", "value": "2c7448c547782e1ddf8773c9f213403fda5f0f3a589d68b51e5e06e3ac08ad7d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052625, "uuid": "96b35249-49c1-454e-8903-943c6a182ec4", "comment": "Malware payload (GuLoader)", "value": "1a62248c100c7a9804f4b279860248a888fd8ffb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052625, "uuid": "f3b44d05-1967-4354-9334-fa65f137c549", "comment": "Malware payload (GuLoader)", "value": "66948c7985ecf5ffe6881096c5fcc164eef24f76c5f383079203006d7f5e1589ba4fcce384caba4d35c790c3d18b5c7d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052625, "uuid": "4ab23fab-9fa1-4408-87f6-baaf8ad9bc5f", "value": "T12CA42870DA2401774F83AB9CBCA50661C66DD329862705F0F6D98B0D900E9ECF7BD66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052625, "uuid": "08f6f0ac-31d1-4e2b-b092-e958d3e88ad4", "value": "12288:nPui0IjS/WfIOkJZ81BQdroD5K6Ad3Rj4d1x+os8WP7HXWcUA:nPui0n/WfIOkJkBSoD5K6AtRj4Txvs13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052625, "uuid": "03b4e058-54cf-42f4-9dde-38c3f59ea46b", "value": 456359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052625, "uuid": "891dc10b-c9b4-4783-8a00-0e4d90019ad4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052625, "uuid": "c183d6dd-0157-4334-a3ef-24cb622a22f7", "value": "EO-PI894092-07738.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd52104c-dc67-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766099963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766099963, "uuid": "2ab1bba6-c64e-4e52-8dd6-0e57b64b1488", "comment": "Malware payload (Mirai)", "value": "7f44b65e56c0c9b61118c6fb97686ec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766099963, "uuid": "1a328539-151d-4447-8399-5a56aa0cc289", "comment": "Malware payload (Mirai)", "value": "2cb770285b6dc0a027c5b8fcf8a46a7fb2428a11d7d21236d186acc497d93848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766099963, "uuid": "4001f5cb-4a47-4bdb-9eb5-f4b212fda16f", "comment": "Malware payload (Mirai)", "value": "f84a2c2d7868c8c50bb3c9beb4a878e339ff79a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766099963, "uuid": "439e9136-e430-46f3-9604-540b088f85a9", "comment": "Malware payload (Mirai)", "value": "0196973acee4f2c1ce67bfc331faf5424a6caf01875bb2f9e7a388389cd87df8dd5d56785e86c1585d99647d47816c04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766099963, "uuid": "70f96e0f-763b-4145-846d-d7024fa13891", "value": "T15DC4E088F3062D42C0EBD835188BD6518A66E49773F3D3453A52A7BB382D3725F3974A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766099963, "uuid": "149bea1a-1905-42af-90b2-12a7e2056054", "value": "12288:PEYu/06BXi3I+kBJpgEsp5+oyYntzmnVXvL7gpJbtVh:PIm6/gEyAoLdmVE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766099963, "uuid": "c94a7a4b-4fed-4e0a-89ea-57dd005e672a", "value": 591788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766099963, "uuid": "fb894526-5c60-481f-b08c-0381808ec622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766099963, "uuid": "b8ab805f-94c4-4901-bbb0-4303135ee235", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ce7cce-dc6c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766101848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101848, "uuid": "50bcb539-6db8-4fcd-982f-82975e35b267", "comment": "Malware payload", "value": "00b5ef8fec4793d13a0f32d993c22c5e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101848, "uuid": "3683dd48-b94c-4ed1-bd52-832ac4bc6926", "comment": "Malware payload", "value": "2e2535caf6e0158b160eb23d74ee67d827fb8764c1bf2c6d299e08cb67750f59", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101848, "uuid": "1ff6fa09-32d7-43d1-ba73-8e96d3aa4f79", "comment": "Malware payload", "value": "390e3bff719003884c6eb7fba0d7a31293318cb3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101848, "uuid": "0bb51572-5553-4938-b413-818bc73db4e6", "comment": "Malware payload", "value": "7219cb48c015143c4ecf53354116ddd3fe891183dc41851dfa94b0300985ade7ecf3f3542f0bbeb13a65236870bea656", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101848, "uuid": "1d3ecfe1-e6b6-4c72-b1d9-ba8e1865da0b", "value": "T118664A07ECA155E8C1A9E23185639263BA71BC485B3123D72FA0F7382F76BD06E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101848, "uuid": "4cf0ecd6-8b9c-4069-8406-73c3b8bfbc6d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101848, "uuid": "3c5584bf-2f88-4f8d-bbe9-88599d0927e5", "value": "49152:X9gtG+WaiEHje/k+S109V6ZEaltzpG2sWZ2oQhuwS9pejBN9OUd8fKiK9KveUXia:XyUDizo2sS2LTQzbY4Ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766101848, "uuid": "d0d37d4c-781d-43b6-bcdb-775a63f93c45", "value": 6639056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766101848, "uuid": "04461e12-d46f-415d-911d-1da677ca472c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101848, "uuid": "d4496f71-b25e-488e-b446-140a94cb8547", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9a4808-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085332, "uuid": "d73b05bd-d330-4b54-893c-7cf58c9ab67d", "comment": "Malware payload (Mirai)", "value": "15ef4c859008c4246c3f8f189a6429c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085332, "uuid": "64df2fea-6e46-456e-b940-e710ddab5f07", "comment": "Malware payload (Mirai)", "value": "2e3680db574b146fa9907a6cc9be870bd8c72022303f63cab838b08c48a8f82a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085332, "uuid": "9e1d633b-1e7a-4928-a225-eb8a07a37a8a", "comment": "Malware payload (Mirai)", "value": "bbd32dccbec1ac7a157ef9cd7466b0303d525f2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085332, "uuid": "d2e1ac61-1867-4a08-a927-509b76614e38", "comment": "Malware payload (Mirai)", "value": "37cc5233cef48b1554c5dbc79b74c6513aa3559ee56afa1eb45374c4f50d13e21d9996b32579e9df57d88d9e502d39e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085332, "uuid": "587b15d4-19b6-4d28-90bf-d562374116fa", "value": "T19814B71A6E228F7DF768C73547F78A24975C23D627E1D694D1ACC2001F6029E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085332, "uuid": "c82f6451-f058-49a9-895a-95ae5231adc0", "value": "3072:ef5/NG0QaUdbqGetrSaaotUKVVsM83rRpouHv4f6:ef5NG0f4bq4E78lpoY66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085332, "uuid": "ed209268-93d9-4d18-a525-2659498a5d83", "value": 192296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085332, "uuid": "82a19957-4136-4271-be9d-2f671d9639b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085332, "uuid": "c3ddba67-3123-4b61-91e6-6359e26efff6", "value": "byte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8e7aa0-dbfb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053496, "uuid": "67e54a8b-90ba-4712-bcbd-f5552ff84c5f", "comment": "Malware payload", "value": "833f37586007cd883bffdb3b12bc0ff6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053496, "uuid": "dd4f9799-fa02-46e4-9e33-e5429c614d97", "comment": "Malware payload", "value": "30e1ad5d88358c1e3e3e0104aa4134fad619712666c336b6db630f353c0ab899", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053496, "uuid": "80d04078-8d8d-4b07-b386-1fbb27a18f0e", "comment": "Malware payload", "value": "c28c0be735095791b3470158af78db5d4c92b0f9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053496, "uuid": "0701e23e-eedc-4967-bad9-43d2038d1f6c", "comment": "Malware payload", "value": "6dd4ad593036a6e01535dd1831403009784208eedf764f1c5c23079dfe3fa80bc161c833b7066748613c59c64adc2b60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053496, "uuid": "1842c27e-5de1-4d9c-8ffe-70875092af06", "value": "T1752323C83BD2B8B0136270A72D1BB05FF6BF1C44750C50E5D36698C5BA6C358D6B6A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053496, "uuid": "fe69fa0b-573a-4ea1-88ad-a87366a49ee8", "value": "768:J9Pi+LO4qfnOQTUeFBgaVbY+teF/9m7sLtMfQq8e9t07MS8yt+r8Ub:J9PiQDqf2ibonp596r88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053496, "uuid": "5e819a49-1210-4c38-abe0-1ab0ab04639b", "value": 50110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053496, "uuid": "f69f8d6b-b7b3-44df-94a4-596e3c66ea60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053496, "uuid": "3899d485-7cf8-46ae-97b6-02ca8b9761cc", "value": "Electroglass Ltd PO-7211-A25 Dec 2025 pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdffc193-dc24-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766071188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766071188, "uuid": "bcf2ccc3-f852-4927-9981-f1b2566ec285", "comment": "Malware payload", "value": "e0bb654cadfc1e372326faf7d7aec08a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766071188, "uuid": "ec2bd0d8-0db6-4b17-853d-808e8a2725cf", "comment": "Malware payload", "value": "3102223607ff33eafa0ad3c714ae0d0e3c3f4670659864dfbf8d2d0d4fb8cdd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766071188, "uuid": "7b61f437-5bf1-40cf-b01a-a9d4f7008780", "comment": "Malware payload", "value": "dcb16706a5e7b500a8820c89dc06ac882b5aa9af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766071188, "uuid": "e7fd3353-2f8a-4e63-bc2c-9c5f68337b38", "comment": "Malware payload", "value": "d461ff96fc8d45cff6e88589664aec2f398590881a12feba53b0bdc287b393227872fadedffa258abb51b724b1d65c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766071188, "uuid": "de96972b-5bcc-4227-8617-cad593763ed9", "value": "T1F445E129E7A404F9D1B7D17CCE438A06E776784947A1AB8F13A4ADA73F236504E3DB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766071188, "uuid": "2206997b-76f9-4206-ac01-2510701ec200", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766071188, "uuid": "b575f6a5-22c4-4871-b282-4cf213bac9af", "value": "24576:jb2+CvRSEHiRkT1s3D1Q3VYFbDbP2YF53dLYqDhEsBQIxWmeeZ:X2hvRhHukh01Q3a1H2YFvsqtEqv37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766071188, "uuid": "5368e1d6-117b-4f2d-8b92-ccd22a02f5b9", "value": 1234470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766071188, "uuid": "0797b9b5-7815-46d4-a777-b064c4783ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766071188, "uuid": "065703ed-6e03-47d3-9e30-4f54be54c190", "value": "inst.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33e6fde-dc4e-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766089209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766089209, "uuid": "061a7029-667d-4aea-9220-994060a742df", "comment": "Malware payload (ValleyRAT)", "value": "0ba338462106d5b37ab31cfd1a988017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766089209, "uuid": "7346732a-8acb-4349-95e5-c8e7ef2e3882", "comment": "Malware payload (ValleyRAT)", "value": "31cb03542a162f39f7bf1854bd38089cc7cab44f6114b472eeaa9b424bc99c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766089209, "uuid": "1bed440c-7ce6-4e4a-9064-278e36ad886d", "comment": "Malware payload (ValleyRAT)", "value": "4797cfb3bca1f04b4c3650c3ce90f7f97c428727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766089209, "uuid": "fdc039b2-11c0-4205-82ea-f23ce1198e4d", "comment": "Malware payload (ValleyRAT)", "value": "6c96b91f59e38991c78d866bce257870bfbef638dd843431f1ea6bc38d4d086ee9bbdc7b004a2aa2f1fd234b269c33a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766089209, "uuid": "b549f6f5-865d-4ef2-a53e-b0a93b459e5b", "value": "T125B37B2172A0C072C097253199F9EBB24E7EF93113B845CBB7E416BA5F603C16A7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766089209, "uuid": "d196daf6-b269-4861-9fba-91253d685da4", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766089209, "uuid": "cc78cd19-54f5-4ccb-b171-9e2d2851e530", "value": "3072:qbWjdIPbcia0NFtwwnILn3py6D268XEPKR2:qbWjMbcCtwwnchx1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766089209, "uuid": "e901fb7d-84c2-4e24-996d-f0c5e2223f01", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766089209, "uuid": "5f111add-2b80-4e2f-afac-3fc6f306eaf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766089209, "uuid": "2a6fe800-7bb5-41a7-ac30-61dfc896ee3a", "value": "0ba338462106d5b37ab31cfd1a988017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a4eb31-dc1f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766068892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068892, "uuid": "e802be86-7e39-4c33-ada5-9fce576d655e", "comment": "Malware payload (Mirai)", "value": "fdce9e25bf2dd79e760e10368902e7b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068892, "uuid": "c765343a-1382-4094-a786-32a844b36f02", "comment": "Malware payload (Mirai)", "value": "31e5f4b80df5bf9be8581aa36ab0739df06eba180c6e59b882638d3bcbf71a82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068892, "uuid": "4e738f1e-7b2b-487c-aa61-7d9733fde967", "comment": "Malware payload (Mirai)", "value": "8875d3b17e7c87cd4f03bd26a66470c70d4f5600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068892, "uuid": "acfbe725-e217-4fc9-a263-60ce3e7f256d", "comment": "Malware payload (Mirai)", "value": "069950d844e8e366052977ef2d7ebc91121c8837f8bdbb297cc1d2285dddb0882bdb10109e4909f681f4e81652024892", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068892, "uuid": "86e37be7-350d-428b-9b70-10c2a218f320", "value": "T1B383B40A7E218FADF79D823547F74E21B75833C527E1D285E1ACE9015EA024E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068892, "uuid": "e3e25eb7-c71c-447b-aee5-2deea5abfab3", "value": "1536:WxX58hHjc2OGaLCGUbqnJhfvRzeHU5twbZnror:WxX58hDc2OGapUbqnJhfvRH5twbZnr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766068892, "uuid": "adca67e7-99fb-4a10-9149-3f3f4c4f2907", "value": 85692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766068892, "uuid": "9876e11a-946f-4cf5-9c2c-5b5682a2f006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068892, "uuid": "df7803bf-4235-4a15-ac15-d6a28640ca80", "value": "skid.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46a3ab3-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766052570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052570, "uuid": "82c2bcb6-eff2-4272-b827-61fb0e0dfc59", "comment": "Malware payload (AgentTesla)", "value": "83250edd638aa12f94fc1a405f1442ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052570, "uuid": "fe4f009f-5291-42d0-a448-4558dd349033", "comment": "Malware payload (AgentTesla)", "value": "31f1da01a4339df756a8ebdcd2e933f4d3967d2beadc76098a36e4e60d4c7a31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052570, "uuid": "8495b53a-796c-4647-95ec-2f0a45f51ffd", "comment": "Malware payload (AgentTesla)", "value": "172591c5beb53772050ff3fb3f37a52b3dfce7fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052570, "uuid": "d450076d-805b-42d4-be6c-7b2d39caa1b1", "comment": "Malware payload (AgentTesla)", "value": "8aeff6dc04e1e7ae86c08cae3696493ab627b1f500521433a2efae9395c4f8426a618e01ef1dbe1f55032e42fd8ac63d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052570, "uuid": "ce8b1a0e-b665-4d5a-bb5c-7d0afdf82061", "value": "T10362013B955CEFF00B3E21F4118B7D0120649726A93B8D6D98D68154BF2BB518FA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052570, "uuid": "db92e8dd-7375-4727-9066-1e15adccde36", "value": "384:k7HLGcEMU2W7BkNMo4Iedvwuh5OQ2MvcZQIwB2+g+wQD:WHLZExgMhlR2M0Kr4+Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052570, "uuid": "cdd80337-d077-4acb-a5ec-92ad488b8907", "value": 15822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052570, "uuid": "e798b9d6-a965-49dd-8347-a0561011c818", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052570, "uuid": "32bc07ee-f7b1-4dfa-b0b4-ecfda1d049b1", "value": "Holiday_Bookings_031.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd843f1b-dc0c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766060772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060772, "uuid": "939faa3a-fa7a-4ad2-8b59-d592ed43deb7", "comment": "Malware payload (Mirai)", "value": "62228685ffe24de92f645c20ed797724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060772, "uuid": "a581d4f3-1465-46b7-b315-2ea1b6c61f30", "comment": "Malware payload (Mirai)", "value": "31fccf28792b9b8172af31b06386fc8f7a5cc7d73f218e48de1efac83964549f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060772, "uuid": "282599e5-9f98-4fa1-b42f-324f5a66e580", "comment": "Malware payload (Mirai)", "value": "819a67713a8e5b15a4055699bb30b04f08f550be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060772, "uuid": "ab39c3c1-ee21-4d75-8bd6-803090cf2183", "comment": "Malware payload (Mirai)", "value": "f7898ffbdfa02a352ea3497b4af68380f195c43256ffced7c1df11813caaf4c75d139fec373fb62fda08f0b2e301f8a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060772, "uuid": "b5f31492-1eab-4881-94dc-0fde7aefdff2", "value": "T1FC736BA7DA16AF46C04751F061F28E340B13BC1989A71EF5D5A5EEE61003EE8F9193F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060772, "uuid": "a5e84875-8da8-437d-a63d-67ed8ea94a1b", "value": "1536:Ua5SIbjF3r/Xml/qSy5K36ZjPMGQCssCPxj/M5l61d6t:UsvbFTmTx3Y4GQwejc4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766060772, "uuid": "e223aced-0f0e-49b9-a16d-cbe172aef359", "value": 76040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766060772, "uuid": "0f6055e2-39c1-4239-b63d-4eee666416ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060772, "uuid": "d3c0104f-b5fc-43fb-a358-d6c5f63244e8", "value": "nova.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606d93e6-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766052885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052885, "uuid": "c5cc7ff6-6463-44bf-a6cc-494bbea0e846", "comment": "Malware payload (PureLogsStealer)", "value": "cbd2226abfce1ba0a65e1c3c92d04e04", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052885, "uuid": "71baa556-ab46-4b69-9eae-79d9796f50a0", "comment": "Malware payload (PureLogsStealer)", "value": "3312046853616821d8aad2a3bb0b42bfb10171cf866d58b026fea0a673da4992", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052885, "uuid": "d4cdf17d-7707-4299-ada2-081f0ef0fe1b", "comment": "Malware payload (PureLogsStealer)", "value": "f29a6ee589f93813de45b56006181dad152b9c34", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052885, "uuid": "a263c897-d732-4210-b9f0-d02c95dbae54", "comment": "Malware payload (PureLogsStealer)", "value": "acb4bbf8326a5b49b693a2c3981bccc0770359351e0291c2799e7197336203d67c4a18f23bf14cb157496ca0be0a6d7f", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052885, "uuid": "7479ac31-1b84-478b-9e92-9a4f4217e281", "value": "T1B8D4869738B8C7A584BFA733818069A3EE7C06D6915235CD083C6D411997FAAFCB509F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052885, "uuid": "12f7a52f-2380-4767-8673-eceb57d3cf66", "value": "768:g44444444444444444444444444444444444444444444444444444444444444J:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052885, "uuid": "577335ee-1176-449e-8f0b-b2d976b740ff", "value": 638070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052885, "uuid": "06852c85-7f56-40b7-8f97-ff2c087558c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052885, "uuid": "9cbfc260-68ea-41fa-9058-6f9e32edbe48", "value": "ordinazione d'acquisto_pdf .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4a7028-dc1d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766068154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068154, "uuid": "95b7daf5-cb21-4f09-b065-5fc11bc24ab2", "comment": "Malware payload (AsyncRAT)", "value": "567a87fbefde837e22ea571f862dea70", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068154, "uuid": "616e704b-de2a-4413-8825-666fed1478da", "comment": "Malware payload (AsyncRAT)", "value": "351e74317d920db0ce7cfd60c5977f8bb7b96dc7ff3c7956965472db50774243", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068154, "uuid": "35495bad-95af-42a8-a37a-084d16062b15", "comment": "Malware payload (AsyncRAT)", "value": "bd2d65ca0d92866ad014698b14543f8ac3cfb071", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068154, "uuid": "9e4ee43a-80b2-42b2-8abf-bf19284b5269", "comment": "Malware payload (AsyncRAT)", "value": "e33c5019e2dabe463c362d14f55e40d860d4f950ec9f810f9140aa586c2599017e1cf6828219ee60507796f65dc5d629", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068154, "uuid": "c4eb62be-b6ec-4658-9936-35b8574ab151", "value": "T1C4538C187BF24125E0FE9FF149E23543C636E7235803E66F24DD428A1A279C9CD916FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068154, "uuid": "6b7b6863-c1e9-414c-9031-ac0904ee8219", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068154, "uuid": "a758ca00-3505-4b81-96a1-51d4fa57ff9c", "value": "768:+Q6S1a+Ou7J63KVteye5nlEUlcY9JgvgDwHuIY1kbg6xrc2/3KmXArrO5O4hntf:+Q6r+O8L6raYOubkbg6Rsry5O4nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766068154, "uuid": "4be200fb-31ef-4ad5-80d2-65f34c353978", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766068154, "uuid": "9ea762cf-55a0-4555-af37-823ffc2230f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068154, "uuid": "4bad9459-5e85-4d94-9de6-725a301528ef", "value": "something.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43812f7d-dc61-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766097075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097075, "uuid": "350a7c6e-23ef-4b21-8a82-54bfe8681b75", "comment": "Malware payload (Mirai)", "value": "326925c5a03afdf45b6305c0a7fead9a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097075, "uuid": "0dea5671-39c2-43f0-ba1e-d36706d86123", "comment": "Malware payload (Mirai)", "value": "3665849f5c88ebf9dacd6a1bac51b3e80438a0f9b98d6ef917186f5da321f68a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097075, "uuid": "218b0099-8d8f-4651-a5b7-f2b1509095d7", "comment": "Malware payload (Mirai)", "value": "35e8e69284434f19c9322260b368580396b68c12", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097075, "uuid": "4c72993a-f81a-4400-b223-cfc562c49b38", "comment": "Malware payload (Mirai)", "value": "117bc4095d1cd431231a3a537ad62d9c17b93a6d154d209044577190b5bd269f4a05dd822a57e461f7e3e993773b6c18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766097075, "uuid": "d1adfcff-2f92-4c6f-a2dc-7c183d563c23", "value": "T1EF11CAF7AD246272B64C046DF33F3032F953843E1DF6ED056C9AB464997C9582505AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766097075, "uuid": "876b51bc-2cb2-48d1-95ba-4a18754e6363", "value": "12:MCdgDODIzISkIcyI7MYDaZ7MtKSMsfhfEF1fhotDycClC96/QqUT/m/:H6maZwMSfhE9hEZwC9EQqUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766097075, "uuid": "21989741-5282-4647-8f6b-d8693899ac0a", "value": 901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766097075, "uuid": "8da94fe6-fd1c-4036-b3d4-7fa077be4c10", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766097075, "uuid": "ed3117ef-f571-4db9-87ed-993af1d676ea", "value": "nova.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aaef0d1-dc04-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766057278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057278, "uuid": "72a233e0-7324-421f-9f30-65d257fd7da3", "comment": "Malware payload (Formbook)", "value": "589389ec29fe4cdf38d79df2d1337e14", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057278, "uuid": "b9fe76a7-f3ab-4e72-88be-4e704b05217b", "comment": "Malware payload (Formbook)", "value": "3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057278, "uuid": "b45370ea-b1db-4810-8bce-a09085375e63", "comment": "Malware payload (Formbook)", "value": "3827eb4e93d658ecda8fbd805cbb0bfb29fd6c86", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057278, "uuid": "a0a66404-a097-490e-aa6b-4b56206f8410", "comment": "Malware payload (Formbook)", "value": "49860e7ada45e97409f131183678cbd4519b636a59d6870017aaf9e17d263f1e58f9fed00ce67e9bea05896bec2ad825", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057278, "uuid": "21eb5450-b6df-4d99-be8b-f17732b36ff3", "value": "T11C7533BB3E6C648C1A436610E0AA16C9C41D1185D5EA13BCF9C2B356F5B08FFF1586FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057278, "uuid": "b421b173-7482-4d91-b70b-b9b9a4c2b6fa", "value": "24576:RiiDK2NEG/WoHYuqvT24glrRpfmsIMMtBFrBqvpZ5AtSaoAjqgmKeZA/B89hm5+y:RiinNgoMK9HmVNfXqn+S8pYZjz9VG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766057278, "uuid": "1644bb09-535e-442b-af17-bd2cab7770c1", "value": 1564045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766057278, "uuid": "6ceabc9d-b906-4efe-b67d-a592bb9838df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057278, "uuid": "062b605e-5086-473a-96ab-16af6f54f84f", "value": "VESSEL Q88 INFORMATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7afffc2-dbf1-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1766049273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049273, "uuid": "8f5c8e57-a7d0-46fc-ac01-8bc124f05a36", "comment": "Malware payload (CobaltStrike)", "value": "3781b0db1f22d55f368c0a075387c021", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049273, "uuid": "17102196-e4ac-45af-8d6d-3b836a0e8d4e", "comment": "Malware payload (CobaltStrike)", "value": "378afc8d85ca9a0e482c422fc63c11bbdf07f20a8f0d2a93bcf13baabb021d48", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049273, "uuid": "c2fbb557-f227-4e72-ad9a-6452008ff0fb", "comment": "Malware payload (CobaltStrike)", "value": "8872c7978ee8b962a1d67d38afa040c911e68616", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049273, "uuid": "3dd3f182-b1bb-4386-9279-0ba6abb2724b", "comment": "Malware payload (CobaltStrike)", "value": "062cedefc4a6cf3735b238e16d90d88b218ab64c91b0c9702cee0eb499abd27261cd622f1988fdce594f808b6e6ec711", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049273, "uuid": "6bccd381-7338-4a6b-bbd8-29026cfd3c13", "value": "T15F64E0B9971B10AFFC5C2130DD72FB792C1FEC9480924BBB3840E076E656954E44A9EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049273, "uuid": "9ce5e588-2b8f-46b8-b47f-e87d8d617660", "value": "f6243a15fa8eee8ee96b5e1144d461f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049273, "uuid": "97e41247-d1fb-456d-85b4-ef9b611389da", "value": "6144:RSRA2axygcpJGTlYEcRuRK3DSdU5qJaY:ERA2axlcpJGTld0SdWUaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766049273, "uuid": "3174d2f0-aee1-4553-a316-992e75ff91c4", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766049273, "uuid": "04e2c812-fb08-4c0d-ac6c-fe509bb48c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049273, "uuid": "6f7a48e1-e9fb-4124-b961-a5df0bbc0bbe", "value": "32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c1c8d0-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085269, "uuid": "07e3777e-27cf-4b6b-a4a8-bc20923753df", "comment": "Malware payload (Mirai)", "value": "b447d7aae52839905c5d59c0770894b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085269, "uuid": "f9986a41-b660-4cc6-854e-3e6f5a89195a", "comment": "Malware payload (Mirai)", "value": "38c3ed1d30363ab66342685cd4e1afdf6af70e7994a5693632a32799c55f5c2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085269, "uuid": "59adbc08-0bd4-456c-ba78-5e81df55f224", "comment": "Malware payload (Mirai)", "value": "40cd2554436cc9c1e56fdf4d7d376f0088bec635", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085269, "uuid": "be0c4263-6a51-4d52-9533-aefd19602671", "comment": "Malware payload (Mirai)", "value": "7f26c0d1ec1dddbb1e72b64ec70437aebe6c82844a4570c602cfcf985abad909a9cf9c8a6e037d175de67294186a335a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085269, "uuid": "41c69ae5-75c1-46a2-a943-0cc442dfc7cd", "value": "T1AE43F143B1AF3E34E46A61B54DA442007EB86313D3864B7619FAC097CDCBF295D29EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085269, "uuid": "e7b29c00-9ded-4a86-9168-85066a554b90", "value": "1536:xApRyeGCPU2Z2yBlnE0XzrwWRN2t2Y9J5dNh9DKueaB4AhA:4EeGCMglnEl802Y9JbN3+ufBnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085269, "uuid": "c3aa4f02-2714-4cf5-ae4a-62e8b499ee86", "value": 59148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085269, "uuid": "f01abfbf-28fe-453a-be21-83ca838c0b7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085269, "uuid": "5dc75aa8-adf6-4d5f-a840-6cd68969407b", "value": "byte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6015199f-dc01-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1766055891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766055891, "uuid": "e73ed780-edad-4a07-9125-b29861f010c9", "comment": "Malware payload (ConnectWise)", "value": "87f077e3576eec868000135e37530d54", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766055891, "uuid": "d2a79a62-c016-4318-868c-eeeb4d88ffba", "comment": "Malware payload (ConnectWise)", "value": "39dcbe21144465ee50585b5da92d4a1a1c6b743d4e91183ea3b082177c92c6ec", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766055891, "uuid": "3b4e153b-338d-4238-b15e-64e96e384a5e", "comment": "Malware payload (ConnectWise)", "value": "2c2a53424418c2d4f79a4b6e98e225f634a8bc1e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766055891, "uuid": "255087ac-308d-4432-8116-f5ec2e728eb3", "comment": "Malware payload (ConnectWise)", "value": "bcc01e73fcb7e13f1f50f9aa8c676c8ef21a7b227cfc23ab9b7f12621ef7dfe4f179cbb5e0d6ae4684855349410d36d6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766055891, "uuid": "bf1a932f-ac70-4b45-a4f0-779f404d8678", "value": "T190C6233662E4C426D2BB1E39E9784AE25D39BC468913C15F533C785E68B1E81E973333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766055891, "uuid": "e1b725ef-d5a7-4d1d-9d50-a4f4636d7768", "value": "196608:Y+kLGB1i+Z3/T+kLGB1X+kLGB1i+kLGB1K+kLGB1:tkqBonkqBokqBRkqBRkqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766055891, "uuid": "524b1c19-61f3-4142-8ac8-d69d26718afb", "value": 12177408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766055891, "uuid": "78540838-70e7-4c14-a622-140bf87a526e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766055891, "uuid": "e86797ba-a673-41bd-ae44-e5dffd7fcc67", "value": "TRX2025Client122.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518a4951-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041693, "uuid": "1e7ca04d-cb80-48ee-ae31-05b42f21b05c", "comment": "Malware payload (Mirai)", "value": "474ed123b69e2527642f2143cc2999be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041693, "uuid": "bcd8c13d-f5ac-4ece-86c9-50df6dae1f9c", "comment": "Malware payload (Mirai)", "value": "3a2b5473e6cc35b100797a81a19dab942cbb2064f7e851428bd7684b94c723fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041693, "uuid": "b1172822-844d-43e5-b1fe-d11954f41f6f", "comment": "Malware payload (Mirai)", "value": "aee89d00d77c691880920fcee2709edc2f8191f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041693, "uuid": "1684c1f1-2aa1-4f44-8991-dd5dec95ec45", "comment": "Malware payload (Mirai)", "value": "93b99b30807ba74009916ace651f9643ae8a2b2c30ed37b3350038ab0d5d3664059798c3cef8c92137a48423b30d7329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041693, "uuid": "9790c032-93a5-4ebe-af99-b0c23d5a6d98", "value": "T1BD23A7592E369FECFFDC863443B34E21964833A627E1D684E19CDA011E7020D746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041693, "uuid": "f5be1eb5-4c78-4a1e-9bf7-3b6a841ad59f", "value": "768:cIBApopgnSpz5ipz94ab2Y3RR2/HA7dmzvRlZhV+BsIgemcY+TflGzy+2fIb1vJ5:vApEgnka4a20dmzplZh4sjd+d+2fIxJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041693, "uuid": "87283020-6a46-41ea-af7f-d640701b85de", "value": 47644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041693, "uuid": "2874d245-b406-4e08-ba40-01c673c43138", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041693, "uuid": "bde204c0-b24a-493d-9579-e0708b4b1826", "value": "kvariant.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e248727-dbd7-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766037822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766037822, "uuid": "8aa35d61-09d7-4fc2-afd4-22f782f540ea", "comment": "Malware payload (ValleyRAT)", "value": "ede3e31819fde45b923e40aa1a700a89", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766037822, "uuid": "4afb16c4-09f2-4264-9a53-48c99b55ec5a", "comment": "Malware payload (ValleyRAT)", "value": "3a412141a55489955282902b03d4be2d707088ef5f83e86777111d6a0fe12b2c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766037822, "uuid": "a6219269-0467-4f43-930d-69e740b3677c", "comment": "Malware payload (ValleyRAT)", "value": "d30e02fde798f4cef8df5030c38c2ccd139e91fb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766037822, "uuid": "038b57f7-3141-4177-ac49-f143c026c144", "comment": "Malware payload (ValleyRAT)", "value": "0a1a730baec917b5a8061023a8c97b37876c3b996767cd930d5f3f724144c195f35cb26aa060f75590e991ebe91f5fab", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766037822, "uuid": "d73be39d-214a-4abc-a0c2-bd98d319c63e", "value": "T123E5F13FF268A53EC46A1B3145B392605977BA64B81A8C1F07FC780DCF765601E3BA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766037822, "uuid": "7643f56c-6ae4-4ee8-a14f-25ee5a4399ba", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766037822, "uuid": "69d5037d-64ed-4c20-9675-2d810b31657a", "value": "49152:tqe3f6eSWTTyXdabodSCkkZP4mtKmr3XY85p5leDlMlsRmpgtfrh:8SieS4ymipZBXYe5WlKp21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766037822, "uuid": "b5f0b778-1c9f-4d44-a0dd-dc05941bad8b", "value": 3320339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766037822, "uuid": "16888aa3-fcbf-46c0-a94f-20145c8c3499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766037822, "uuid": "2bc86db0-1c8a-4968-a7e2-fc6b2bcaf7b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa35844-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766052374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052374, "uuid": "525856d1-48fa-405f-ad36-1aac953b0717", "comment": "Malware payload (AgentTesla)", "value": "7506b422106cfd65508aaf38a7edf7f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052374, "uuid": "161d5657-9880-4218-9d08-56a8eb8eff14", "comment": "Malware payload (AgentTesla)", "value": "3a8c422330f7d9e88e5ee90685bb52c0bd6c2cf39cc3531894c66f8bf1d22cb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052374, "uuid": "46e67873-49b3-4ca3-949d-d41f4afdb7ee", "comment": "Malware payload (AgentTesla)", "value": "940c1b694e0a211b11a9e4a71e03a713550da5a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052374, "uuid": "a1921be1-6d84-4033-b01a-28027e882ec2", "comment": "Malware payload (AgentTesla)", "value": "2b279d6fe0320feee11f8ca465856b9cd3d23959c6e6887c18e95c55216ec5cfc962e9bd7e8e460874d10d70ae2e82d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052374, "uuid": "04c5928b-9d70-4429-ab3e-60a67a87d40e", "value": "T17445F1118DC46FB5CFA88A1890BF161DD7E04A8E941A744EFB27BE4BAFF7604420F195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052374, "uuid": "869a8932-8161-43e4-b9cf-3f65397560ce", "value": "24576:Kp/yQiAqwSFdN6QPRk8XHhZxGX1bV1Kmm:1AexSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052374, "uuid": "a3971ec6-45c2-48a9-a227-d9f222a28329", "value": 1273312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052374, "uuid": "5f68951f-0aca-4e19-a4e0-395b613b81f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052374, "uuid": "8240b07e-56b4-4517-bc8a-31cc5f153511", "value": "cotizacion pdf.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab5d284-dc11-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766062995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062995, "uuid": "69d684a0-87a2-4747-9eab-45c4bb50e3bf", "comment": "Malware payload", "value": "3af0d58374e0af8174030f30f6c37628", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062995, "uuid": "d9a6d28c-e291-450e-b113-daa131e384a5", "comment": "Malware payload", "value": "3c3a5629067382ab8c5b6a2235443282ff904643663a3cddc02c53836826645c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062995, "uuid": "ab453a74-4ac7-40de-8fd0-d47e15ae2a89", "comment": "Malware payload", "value": "7cb755ffe518696563ce31a0779d6ab795f6d75a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062995, "uuid": "8427fc47-4a4d-48fd-8ce8-615f7cbf72c9", "comment": "Malware payload", "value": "9740f6dc741836b0d42415db98b0df0adba8c6dab16ca549b01222bcc1fc60f70d0b276cfa3c8bae95606d43f726b3b4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062995, "uuid": "f4983598-26de-4c78-b418-f49b28506488", "value": "T1B077334AF455E52BEC2FC532C2F58A2A46256D4BAC25C51B6A72314D71F3AB333FB408", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062995, "uuid": "46cb0853-5ceb-4c0e-aca3-bbbec2da3ed7", "value": "786432:WqrDYl17tZeiPjxoqmFOaa3sHpFzbL0yF4ZeZ3dgHmpX+y:WqfY+iFsOaRnz/9mZHHmpXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766062995, "uuid": "fb322c09-5760-453e-88c9-a6b67eab601d", "value": 35434496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766062995, "uuid": "a2e07c21-41a9-4d08-9951-651b89c96a11", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062995, "uuid": "6e7ff69e-aee5-45e7-aa6f-457c1511fad3", "value": "Updater.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a88f270-dbe4-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766043319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043319, "uuid": "577a3674-f548-4123-b795-dd6ab29d2f9d", "comment": "Malware payload (Gafgyt)", "value": "cdac837422ebb245d63bb1d33e42a526", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043319, "uuid": "9fc6b4f8-f31f-4a67-bdbc-b4467e2eb30a", "comment": "Malware payload (Gafgyt)", "value": "3e0d08d6710ca0296e0bec1385dc76dba9de819e65e17dde7ebeb8eb15fd08da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043319, "uuid": "9c784d19-f7f6-402f-af66-f4776a899dde", "comment": "Malware payload (Gafgyt)", "value": "dd9dd2a4bd7fae4892a70deac07f6951b220d686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043319, "uuid": "ae3c5c15-6c20-4e50-b464-d2c524b89aaf", "comment": "Malware payload (Gafgyt)", "value": "1bbef66f6a46c71cacb3092b6143576b5a6802887eb21453522de30d5c876f20af8eb17106795f390d1051f4e0b409e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043319, "uuid": "229b7b01-4b40-4ee5-ad33-9dee397aa7da", "value": "T1D8F3B509EB315FF7E8EFDD3757EC0A02218C501222A93B797A78D628F60A94749D3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043319, "uuid": "9e7b755e-cc62-444d-be74-3f5a028b70b9", "value": "3072:90OEWDrA+y0Ao0nUBwgxwjaSTRbSojeIkuhr:9drA+y0Ao0nUBwgxwjTt2o2uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766043319, "uuid": "45d418e8-ac95-4660-8fc6-86ef84922003", "value": 158924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766043319, "uuid": "e72078b0-5d43-43ff-a43b-3811f185c2ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043319, "uuid": "cd8a9974-bc2c-400b-8801-260e5e9fd5a5", "value": "rondo.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecf2390-dbe6-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766044346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044346, "uuid": "cd1f5316-3024-49cc-99c9-0df56f7b52c2", "comment": "Malware payload (SalatStealer)", "value": "03b39db4929b2a890627cb8ef89a1fec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044346, "uuid": "6752248a-5fd6-4305-b9ea-0b88980885d6", "comment": "Malware payload (SalatStealer)", "value": "3f26de6672de82c0019f6c081cca770d9ab7d04b6588ad2d922593daaee49049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044346, "uuid": "b163e7c1-4b5e-41bc-b86e-d3be32f8ef24", "comment": "Malware payload (SalatStealer)", "value": "df4d5be2d44d0f0b9bb45593fef605e6bf2def59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044346, "uuid": "e0d2ffa3-082c-4db6-b207-e762c0953076", "comment": "Malware payload (SalatStealer)", "value": "ca446ec88ff1c8c46bed7147d5d3afad8bbcba4fdffc26b6d50ff9c10a96d59aacf9f47a27f805815cbbb93c9418c61c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044346, "uuid": "0256d59b-b3df-4073-bae9-bd82420af8d3", "value": "T140C6CF45FE5740F4E5070DB9606FB23F96B2120A8B38DEDBDB705E12E92B6A11D3B109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044346, "uuid": "0a54adeb-50d1-4296-9089-a196823f3804", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044346, "uuid": "0157d95b-7eb8-4ca4-97a1-16870914cee4", "value": "98304:YzQHtvKE1dZjICQgYlyBTXg9W6b5wBGDApveBL2:RPJclKgoAlspve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766044346, "uuid": "5256fb5d-9c85-4b03-ac31-e324a89777c7", "value": 12107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766044346, "uuid": "810e9eed-81c1-4371-bc7f-a1185b1b6f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044346, "uuid": "950e22b3-8fc2-4f09-a908-56cd4b3cc775", "value": "03b39db4929b2a890627cb8ef89a1fec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548988de-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041698, "uuid": "d8c2f4ae-dac4-4cca-9195-56d9cefdf186", "comment": "Malware payload (Mirai)", "value": "a0748161acf217fe6f77de8303e59901", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041698, "uuid": "ea3ed20f-7444-4133-82c0-b0880483c979", "comment": "Malware payload (Mirai)", "value": "3f539977bcda7b6526df400bf7c4c3548e6fb0219baf00659e1ab8e6d6539840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041698, "uuid": "5623df38-4ceb-4aa2-ac6a-8b73bc1c902c", "comment": "Malware payload (Mirai)", "value": "77e8822df776f7ff50836a4454ba9d041e71fcab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041698, "uuid": "baf90584-8818-47c2-86f7-41a57914c63a", "comment": "Malware payload (Mirai)", "value": "d111866acc529aacaf188058fbbbead352d7964ffe5348b0ae04b54a78caea02724548631deee8b8ba83c11820f1ea45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041698, "uuid": "5a38da4c-33af-4155-a6b5-a77e26ea9416", "value": "T18BF22A92721C0D47C26A6EB0393E17D083EFEE9110E4F585265FAF4AC576E76008AF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041698, "uuid": "c767445f-4ca6-4239-b1fa-9b5df80340e5", "value": "768:je4CNKKNIdz+uSrNvkYv2TWvOLSnumjV3b1vT:7C3NIRUuY+dLSnhxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041698, "uuid": "b92b404a-9ff6-413f-bc14-d132501edf87", "value": 35084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041698, "uuid": "105019db-039e-416e-8c91-48516fd1a283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041698, "uuid": "7d6495a9-b39a-4360-a3dc-9d040acd1d10", "value": "kvariant.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3674de7-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1766052622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052622, "uuid": "c8982185-95e9-4eda-b5f6-a7abdb268ce4", "comment": "Malware payload (PhantomStealer)", "value": "65762c25b16a92cccdb8209fd758fbb4", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052622, "uuid": "55ea2575-2b10-49b4-8b2e-afa4742ae472", "comment": "Malware payload (PhantomStealer)", "value": "3f7b2cb716cf7f7f4a7eccff6dd9dd0a0a67145848c931cabf7db0b06bdd53e7", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052622, "uuid": "41c1deae-c483-4f57-b565-d6dc5cdb3f50", "comment": "Malware payload (PhantomStealer)", "value": "8f9f15f454a4f4a73f4773e0cdff615b63b67f03", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052622, "uuid": "e2be9a3d-477e-4a6a-850b-583f42f65a50", "comment": "Malware payload (PhantomStealer)", "value": "a0483a448e35546149bb578cdf94ec3bec50e0b9b2bbfb4d1149637d1f84d512837ea6ca2d3b5e2aa89d1b782af02005", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052622, "uuid": "ff4a8cfb-ba3b-4c44-8dc9-8554b28e541f", "value": "T1BDE414BEC7519E0DEE48C50319C8AF8158234F8B8DDBA573B5300D6B9AFB5E791E8064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052622, "uuid": "ced99b04-eaad-49f3-b128-5b628ae13b94", "value": "192:cp+1Xp+10JU9XmVyp+1hDmWmMi7e40deXwgW62WG0esSkisS9h4NxlWc7hFEQm7I:OO8KWvT6MV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052622, "uuid": "75f3480b-8a4b-4ebd-b0cb-feb579c5bb91", "value": 668671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052622, "uuid": "10396198-9c0f-4c37-b350-b79f57a3499d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052622, "uuid": "ac902bd6-8dbc-4df5-aec7-29e71291e352", "value": "Contract.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36411050-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052814, "uuid": "12f65e21-1867-4da5-bcd4-f76bffe4f253", "comment": "Malware payload", "value": "4cc3252a8b086a06cda6731c4c107731", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052814, "uuid": "b4080a12-80e6-4f0a-b41f-f0baa80794e9", "comment": "Malware payload", "value": "401e135552abf098107095a73019f6242463503f96ca983b36ebe47f4f5d721f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052814, "uuid": "a32f4f87-4ef6-4245-843f-133f9a543cd5", "comment": "Malware payload", "value": "6bf6141fd272b1d618f19eade6d3244754beb96b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052814, "uuid": "99b820e3-5c97-4e6e-af60-61f174da5e70", "comment": "Malware payload", "value": "bee2b1ed10090887e28d058e62c138ae4b17cf7388f2648bcd3a96de48bb02f6f39c7738f9ada33e40ffd99a7dabcff2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052814, "uuid": "11ec1ed1-1add-45a3-b42b-d6b556ed06b5", "value": "T17B31E60880C441ABC3B92EF7BF1BB360F236129849856286C904B84E64D4122D45DB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052814, "uuid": "a7a77f02-5948-4b14-a8ff-11d35be21a96", "value": "48:8H9wrmAfLF3MrFBSNCZXEM/rPf/L+lp2DMAdRXSR+2:8CrmZ0CZX/DXj+D2j2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052814, "uuid": "ad2f87bd-ae39-4df7-a12f-737e462ca793", "value": 1818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052814, "uuid": "e8a12a3d-0f1d-48e3-b05f-414c85462348", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052814, "uuid": "82c3da5b-0635-41e1-97a2-4c7659013524", "value": "95233798.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce86c72e-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085282, "uuid": "a345c7c4-94b5-44da-8219-ecfb6b116699", "comment": "Malware payload (Mirai)", "value": "0a365351bb86ff0ed36a71644d455960", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085282, "uuid": "936b28c0-d2b6-4143-b53f-25978ef2b896", "comment": "Malware payload (Mirai)", "value": "402958e63af015799858559e480ed2c6513e79b02ab84ca47829a67953b79c84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085282, "uuid": "67630462-e111-446b-a343-52c469257285", "comment": "Malware payload (Mirai)", "value": "e27810806e28cae7b10dddf1968acb4b2ee87c17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085282, "uuid": "1230926b-8c33-40aa-8934-1b0a4e4c81dc", "comment": "Malware payload (Mirai)", "value": "7ce4721c33a324c9c5f778019ad3c5efa6a47bd21d512aa8f6a7cf369f36397ef9f0cbb562c49de3ec2c3a42b691ae9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085282, "uuid": "29abcb32-f562-4ad9-946c-2b6845a9d1f0", "value": "T1F853013839863DDFD3DCA83D479C8289692C738431B7DA1D12570D8B6E6D00BAEE445B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085282, "uuid": "65ae68da-4a73-4caa-8d90-410765bea976", "value": "1536:8B3Wr6lOBvdsXnatPIM0i0zMjKZactzj11gHrC:8B3WrEOB1WaOgKZaKzj1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085282, "uuid": "87c9e000-9f85-46e2-9e79-2767ddece513", "value": 62516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085282, "uuid": "fdb6c0fd-d9f6-4f84-8e57-aaf38c49cec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085282, "uuid": "5029d0f2-2b46-489a-b474-325e40ef463a", "value": "byte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6a5a2a-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085278, "uuid": "8d43c820-9f06-438b-9618-ee122cc81e70", "comment": "Malware payload (Mirai)", "value": "1db5e2e44f32ab40cce59789781dfb14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085278, "uuid": "49889a6b-4156-46fe-8258-c4ad30f4094b", "comment": "Malware payload (Mirai)", "value": "40e142137a185f6dca00f0de2309c9756082bbee217e6ebce0fb103dddd35566", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085278, "uuid": "85441960-a08e-4767-9886-8638bdefc0ff", "comment": "Malware payload (Mirai)", "value": "2f56b68476253f9e5fe2a12d3778e03b7dde59f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085278, "uuid": "691154aa-da73-42a2-a3ae-c692228ba746", "comment": "Malware payload (Mirai)", "value": "b853093d41cad4256aa36b767f95d36aa70cfcc2f1aefd3206fb6b068a404280d6dbcb28fab912324597161622868baf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085278, "uuid": "b33891d5-cf25-4910-8fd5-58a78b5bc0c3", "value": "T11843027604969F21E4619835F17C4FF1C12BD6A4B3EE7BFF41B80264316A446D06DF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085278, "uuid": "021d128f-c682-424c-bc01-3a3ddc0525a3", "value": "1536:w+V5X6RYEqoo4k+kTC/Qa6oAjUorSI22HzT:PzX6RTsLCohoAjHK2HP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085278, "uuid": "356d91d2-aa4d-4ba1-85a2-3712e71838ec", "value": 57112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085278, "uuid": "084c0dc4-18e0-45f5-b5be-fbbf2ac5151a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085278, "uuid": "16fca9ba-ccdb-47f3-bb3f-a7433b0f5db7", "value": "byte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5398d4aa-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041697, "uuid": "679fe319-25db-4b1f-ba10-bb35044c335f", "comment": "Malware payload (Mirai)", "value": "79bc31020a8e106a4cfb327fcbe49581", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041697, "uuid": "d5869d6b-c693-4c9f-ab4a-87e0e9627f70", "comment": "Malware payload (Mirai)", "value": "435de40b71c5472be7417f24075d044614d19df013a29002219c3ed11cafdcb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041697, "uuid": "c1acb62a-530c-470f-92f6-38e6e9bc742a", "comment": "Malware payload (Mirai)", "value": "7adc18ee07a3bc0ac7ed2d672635f5a1698d9bac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041697, "uuid": "019496e6-5be3-4f63-a090-f144670ccc2e", "comment": "Malware payload (Mirai)", "value": "e60ce2213803e69e9d3e7a07b5017a4d541ad28a01c06e0c63c34f1079ba2e7de0083a921b941225c8c82fe0af181072", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041697, "uuid": "890b8d46-bc28-4964-8dd2-c23b79e4f3f1", "value": "T1BF230A56B881DF11D4D4137AFE2E118D33236768E3DF73129E106F146B8AA6B0E7B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041697, "uuid": "6ec7c46f-5f0d-493d-92c2-a8c8bda0519b", "value": "768:nFn0Vqg/9sXDYpQLtP0Mp4n2LPtCiC5NjYBUufum79FCI0+KiwImVSwstm1gVP1s:nFnAh/OkyLBpZJCiujYBHPiIGiwImww7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041697, "uuid": "b41282d8-bcfe-46c7-b0d8-777f80226554", "value": 47100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041697, "uuid": "95438752-6250-4d4b-8eac-731664d4c527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041697, "uuid": "2f9dd64a-18c1-4c07-86c4-e49403adddd8", "value": "kvariant.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc4c4e6-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085277, "uuid": "6639e30e-d186-4bdc-aaa4-d029dc204b78", "comment": "Malware payload (Mirai)", "value": "1464e28137a68af33d27585bb932bde8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085277, "uuid": "201c2fa3-cc23-4618-8970-892beada110e", "comment": "Malware payload (Mirai)", "value": "43e7a95805baab1210b4addb96ff6c1033a350b1ee760f12b1d3330fc97b518b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085277, "uuid": "6de5ed07-4af3-4e0a-ba67-aebd892e986a", "comment": "Malware payload (Mirai)", "value": "b1721f63b817e502c01d0e89360daf72b70874ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085277, "uuid": "325ef431-8eb8-42a6-b04e-7264662540ea", "comment": "Malware payload (Mirai)", "value": "717ad24007f419e07bacd71a8e9b0e11a9c45c308f1a52a5d1e4616054735e701fa6848bb5b03b037c112c8e9b76a3dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085277, "uuid": "63edb5be-9c04-4591-8e68-9da06f7dcdb5", "value": "T13AF33AC7F900DDBDF80AF73648130925B230BBA155520B377257796FED3A0990967E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085277, "uuid": "f060c1d3-d5c1-4ee9-83f5-1016aa2a6011", "value": "3072:6QP35Ye1eRzzGsUn8wcsS9a79fe2UpVWjbi4Lmh1tyrKpr/E7:7YK/n8bsD1e2bLmtyr6/E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085277, "uuid": "e253f833-f44c-48c7-9e4c-889238247c6b", "value": 167468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085277, "uuid": "b1563a0f-8643-408e-872c-a2bcd28698dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085277, "uuid": "17a68d9c-b619-4a20-9bd8-162023cc91c0", "value": "byte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb563457-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085330, "uuid": "ded5f439-b87a-4ca6-b1cd-2d03af63138b", "comment": "Malware payload (Mirai)", "value": "96747794b00ed4bd00725fcc43c8c999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085330, "uuid": "5687ed4c-014e-4623-88dd-8219017be2c2", "comment": "Malware payload (Mirai)", "value": "4437dea237e27f9312d912818c6e38c0572894c8b7edc77902e3aea2583001e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085330, "uuid": "0013e2c7-9124-49cc-a46a-59e70c44ffd5", "comment": "Malware payload (Mirai)", "value": "e6bef973fbc461c6b43cc5232c65e3e7bd33b8b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085330, "uuid": "06674898-6333-4fc1-bb97-f05ee64dbfd5", "comment": "Malware payload (Mirai)", "value": "a191a09b97f7dbc86e7cafc53402a7d3f40991a9a418e272b0fd12b2497f8583c27190c38485796413cdff45f579ccac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085330, "uuid": "77aeeb2c-0d61-46c4-8862-6bc691540da8", "value": "T104F30856B8819B15D5D312BAFE1E028E33131B78E3DE72129D246F247B8B87B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085330, "uuid": "459c51b7-3c9b-4e6c-bd3c-4ea20bfda58a", "value": "3072:7MZeHl2CtIzBkxFYXX0wZa5abNkx785Iz6cwn/iuw4DR4:MeHl2IMkYXEwY5aZkR9z6j/iuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085330, "uuid": "a97802ad-1809-4a8e-9a45-ea3451a1812b", "value": 160560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085330, "uuid": "fc6f1766-8ec0-4f5d-9041-46e7bcf94005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085330, "uuid": "05b430e5-a9a9-4c06-8a85-f048a86190f1", "value": "byte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d752dd60-dc31-11f0-a129-42010a9c0007", "comment": "Malware payload (BazaLoader)", "timestamp": 1766076707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076707, "uuid": "fe72dbe4-c9c1-4f12-938f-d59f9ba7d08a", "comment": "Malware payload (BazaLoader)", "value": "ef54a7f0a584841da925b16f03417489", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076707, "uuid": "cf0004c3-ebb4-497e-9c91-93f762b8a778", "comment": "Malware payload (BazaLoader)", "value": "443c84ae78710635e67314f056d4b9d03feb7ba9299f607501ee4e6afeabf902", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076707, "uuid": "1760cc68-6d3a-4d81-8b6d-feb25cd424a8", "comment": "Malware payload (BazaLoader)", "value": "21a2a58af8f39a52a3ed6ba25373761e55915ab4", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076707, "uuid": "900004cc-d70b-4461-a9ec-fcccb2b7eb3e", "comment": "Malware payload (BazaLoader)", "value": "a8215b76cfb01c8cd177422ecc13c3f159a9bd7b34ae972188655d9de05d9ec8b1448b070501e470390c50501602f469", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076707, "uuid": "ad31d7b9-8169-4d37-b9b2-f1f6bf80af4b", "value": "T1EBC64BD3DAA14779D6AFF239E59252866230BC05033124D7AB9067A52D37BC4133BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076707, "uuid": "fd90e7d4-5c77-456a-9a1d-547f6fec104a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076707, "uuid": "c1134047-67fe-4b50-8b53-00fc2b5c8eb8", "value": "49152:ZmHPCJeEF0V4I4IuqCzsSED79w+Ud9b0wZHuPa3KOEEiFdxGlAPLG0Vts5ZkuT5o:ZRs9H9AK112PTdWUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766076707, "uuid": "8232aa44-809c-4db8-b3ff-5c2433cd0d97", "value": 12341464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766076707, "uuid": "28deb065-afec-4227-adc4-71e0772c89a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076707, "uuid": "70aff031-a4fa-4e81-9f2d-07f1e8cbf090", "value": "Setup2501-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa251c2-dc1d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766067916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766067916, "uuid": "5b20247b-0f00-45db-b745-6da5f6fd875f", "comment": "Malware payload", "value": "3f24d8717664231442431fff5f728f87", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766067916, "uuid": "c44f7ba6-c522-4e04-a6b4-4d9149aae309", "comment": "Malware payload", "value": "4508a26a0a42966606cd59c558284e28e9e06b4db89fe0f8b50fd9599f4f73f1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766067916, "uuid": "a0a331cb-68e2-423f-8417-93de560b6b88", "comment": "Malware payload", "value": "ae9b049b09fc4f4037db42237d2b360aadeea4f6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766067916, "uuid": "3e8e8692-5125-4fe7-bc10-cad70b7dd262", "comment": "Malware payload", "value": "74af667646e4e277a2a455eb8882c2c8e0209015acba77b00a8915917ade4e265014caa22ad7ab6d8cb851b1a4b65b1a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766067916, "uuid": "a508c91e-20f1-491e-b314-584bf92cf29a", "value": "T1DC63E046F1065136C4071B328B9BFBE54FA4EC4AAF532046361B731CAD336E47AB69E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766067916, "uuid": "28e38263-9b95-4867-915c-3cdb1dd8db4f", "value": "768:h9VDin3yTRriTqJAEeUpX7RLp1xTA26mJPE3N3dcsWZ2rY4wTYzfzkXA3mjDjZeh:g3KJLTpx1TN6R3NLW24YzfdkDFob9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766067916, "uuid": "4396cdb9-30cb-42ca-906a-1fd5e4dd75e6", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766067916, "uuid": "47671284-d8ad-4e6e-9f33-1e426caf2f9d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766067916, "uuid": "86f57cc5-ddc0-4240-933a-6f8894de8c0a", "value": "fdsgsdf_gfsadfasdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4167b608-dc18-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766065718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065718, "uuid": "825423b6-7993-4551-8e6e-728793996e92", "comment": "Malware payload (Mirai)", "value": "aec0f7f3fd1f2a4e4abb77be4c575e33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065718, "uuid": "60c5904c-de91-429c-9837-a585fb1e8be1", "comment": "Malware payload (Mirai)", "value": "456b8a88df4ea7058ed270053bfae0db80f36f39119a07f061d74fd3faff412d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065718, "uuid": "ed3c21ee-30ee-440c-ac94-cdb5d2ba9317", "comment": "Malware payload (Mirai)", "value": "30cec408b630a51b6ebd751d866443130a9ef9b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065718, "uuid": "629f99a4-9b3c-4f7f-bbc6-92db5f97ce5d", "comment": "Malware payload (Mirai)", "value": "7030082e8ac8ae49173cebe7314ef6945c8ea39ebdb91eac26a63d9c73024917c837dd80c5c7d1f90be576d4e60f71e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766065718, "uuid": "73842082-c229-4b77-afc9-e7a24e4a52fb", "value": "T10D933B227E325F27C0D2B4BA12F34A31F1B57B5B28B88A5ABC712EC9AF155D03107675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766065718, "uuid": "971d68cb-2d67-4f8d-a6b8-993210838302", "value": "1536:9lmC3P3wXTarYhIwXSshSIEtVUYM5UtkZI3tTfo9VNNSY:n5P6e0lY1TUY8M3uiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766065718, "uuid": "637dded3-c2f8-4c00-a6e2-63bb00bb6ad0", "value": 89944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766065718, "uuid": "c4145d81-ea74-4387-b7f6-3477313ce570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766065718, "uuid": "de1355f9-e889-478f-ac9b-722669ced0ed", "value": "nova.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af6d8df-dbbe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766027213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766027213, "uuid": "5869b3f6-0d0a-4167-9b99-c9070a68141d", "comment": "Malware payload (Mirai)", "value": "6d018b29126d3853a7ff454b65ea5dbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766027213, "uuid": "f75fde40-5e38-4268-918f-9e3cb9606d0f", "comment": "Malware payload (Mirai)", "value": "4589612e0bcf2e254096bf56850fc6668220a885c3e84ccf4dcae13c63309952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766027213, "uuid": "6643661f-f414-46ed-85eb-c80e4bb9bee3", "comment": "Malware payload (Mirai)", "value": "dcd8ae685222b830d7f9a3e86713cd8a9208d720", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766027213, "uuid": "72f5e3ac-8b6f-4e45-b37f-00608fb8154e", "comment": "Malware payload (Mirai)", "value": "8a1020709d918bb64807dbd6ceff9f504de83fb393d428e273c96c491c81c4f6535887e980f3a8164e87b80faaa732cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766027213, "uuid": "02bfb81c-fa7b-4b17-8b97-7aad1f656dcc", "value": "T1B893B61E3E258FBCF79D863547B78E229648338A26E1C545E15CEA011EB034E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766027213, "uuid": "580a079c-03ab-4d44-9c31-831b23c43111", "value": "1536:bK/QR35eT0Ata6s8QpTy4OVDZZUHWm5XSWYkhoh94:ke3sTPutO4OVNZXm5XSWXhaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766027213, "uuid": "55a70c4a-c0ee-4f47-954e-de52a1b2477a", "value": 89628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766027213, "uuid": "73f8fb23-08de-4720-a5e3-6e9a5fa365c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766027213, "uuid": "600f000c-a3d2-4034-947e-5de16d6427f8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c0fe06-dc60-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1766096708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096708, "uuid": "12f28e72-e158-43b5-a7cc-9a92d3638534", "comment": "Malware payload (njrat)", "value": "11c3196429a302348c62e6da8cfb886a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096708, "uuid": "ac4b2ae5-7ce9-479b-a609-a6d711089c91", "comment": "Malware payload (njrat)", "value": "46a9fd7c1f057ddb96e35ae32b81273b7ef1c2abd0fd0b41a414cf6e657a77c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096708, "uuid": "fa229960-153d-40e1-9bc2-62e53d40a070", "comment": "Malware payload (njrat)", "value": "57e8df5da599483555e30633e3d403ddfc9f0089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096708, "uuid": "2aeef5cc-071f-4866-a160-0cdf3ff461ff", "comment": "Malware payload (njrat)", "value": "e36712555562e2172e7c8d74495e470eb530f486aa646fc87ad02f24d7c844933add70db37628ef0f0b95a16aea9e8f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096708, "uuid": "1a50949c-49c4-442f-8161-a4a7810475e9", "value": "T152033A4D7BE18168C5FD057B05B2D01207BBE04F2E23D90E8EE564AA37636C58B54EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096708, "uuid": "1404ec2b-ba11-4e38-9d12-4f7ebd851bba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096708, "uuid": "515cdc1f-0305-4467-b05f-03d75119fc8a", "value": "384:SspMiL3BndznNCyMGmjuu3HJcWYbAUrAF+rMRTyN/0L+EcoinblneHQM3epzXnNZ:VpRNRMGmjbZdYPrM+rMRa8Nuxtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766096708, "uuid": "63aff367-f097-48f8-a431-34fd65af738d", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766096708, "uuid": "e48a6cff-5d8f-42ca-a73d-e3bce2fbc960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096708, "uuid": "13bd5a07-ae38-4c18-820c-f8205c1c7409", "value": "11c3196429a302348c62e6da8cfb886a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cd7e00-dc35-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766078130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078130, "uuid": "d23f499b-a441-4c38-b945-2489d1b31aa3", "comment": "Malware payload", "value": "a2adae3cc07fe630add9a31de35dfb28", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078130, "uuid": "8eb91d05-201e-40e2-9996-e3009afdfc01", "comment": "Malware payload", "value": "4712baad4e6783a34202e3ad58ed43106829f88656287dbfba4a688100ff615e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078130, "uuid": "6c1ee3af-f0bb-4f43-aeaa-56a774968319", "comment": "Malware payload", "value": "564d7d4b703101b82f51cef7d79bdfee8f757757", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078130, "uuid": "66093097-1f8d-47a0-a34f-60627518be1f", "comment": "Malware payload", "value": "e962a03bb588fc4cccd470e6039a36a3911388907bc1e0582b977db2a7a712dd281495dc4d83e3d181faeb4e46692faa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078130, "uuid": "1850b923-cfa9-4cb5-b9ba-b0be7d174ed6", "value": "T19BB5CF1037457503490A1B33FF1972EADCAEB909D6489ECEB982BC68D2DCD3135B6A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078130, "uuid": "a1ed9da4-0978-4142-b025-37947a4d61db", "value": "49152:qWF/Sz2hDI9Pg0vBsmeIz7TI22jIR+7gCDB2nyU7DcYSncpsEZpF1Qxo7O1u9saX:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766078130, "uuid": "31a76378-d5aa-4833-920e-470fff908f54", "value": 2386055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766078130, "uuid": "8213df04-2bb8-47b2-b166-64aedb8fe3d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078130, "uuid": "0d3fceb3-1970-4d5b-aa2d-5009d478e2fc", "value": "inj.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acace8ab-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092527, "uuid": "f3f64f34-0717-4003-924c-cc3a667f9c3c", "comment": "Malware payload (Mirai)", "value": "7f78540aa3da9162872ce1189a2d81e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092527, "uuid": "769ab9b6-8d2b-489d-b249-f1a8e1a94365", "comment": "Malware payload (Mirai)", "value": "494365c37a927255487e5665a40b5bb29190e6793fbe7511d810d7c6d238c4a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092527, "uuid": "785e8993-3c92-4605-b98b-26e388659796", "comment": "Malware payload (Mirai)", "value": "8b7c094990fd895d327c0762c4574b7fabb9712c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092527, "uuid": "0ed47abc-c568-4faa-bb5d-a8117cd68afd", "comment": "Malware payload (Mirai)", "value": "2f545dfe04cd1cacca050d561d68b209629ec792167e9e5f45416f1e79970fbf94160786ef5829c6cab8026c222788e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092527, "uuid": "dc74a524-0787-423b-8144-a0c5490e3234", "value": "T1FFF2F8D1B8825A2BC2E423BAAA6F518E336173ACD2CF7717D8111F507B8991F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092527, "uuid": "78cd148f-b709-45a1-a0d5-ca7353c8ce85", "value": "768:CzQJzX74uXq3GpKWKKZSo2Tjupjq3e+aErJp6MjG:RXJXmGH2T+8SErJpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092527, "uuid": "f0bcce94-dd16-4465-9e12-6d6528756703", "value": 37120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092527, "uuid": "e871153e-bf2f-4fdb-aa85-1f169b041aff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092527, "uuid": "c1f8762a-feb6-4fad-91c6-77152a6d9f69", "value": "xparm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b7c69f-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085344, "uuid": "7d57fb53-07f2-479d-8ceb-562ec8642c20", "comment": "Malware payload (Mirai)", "value": "c1d481b3c0a785d47b5ac80fa5fb4eb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085344, "uuid": "b14fb6f8-e29a-4fcc-80c1-8befa9f91549", "comment": "Malware payload (Mirai)", "value": "49c900093503fc0969d99a4e57b8815e55fc370aca22f32af38b533378f6521d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085344, "uuid": "8cfe4a20-d489-4ed2-8f44-f81debb9d92f", "comment": "Malware payload (Mirai)", "value": "6f83fd20e52272f13480b42658507207c2845179", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085344, "uuid": "e928d7e2-e744-405d-baa7-1af12232dd2f", "comment": "Malware payload (Mirai)", "value": "8cc9d7f695bd210276dbd8375b8055b0dda1936a6e3cf6fd0caf9effc10e54d16fc398c7f38f27cf9a3f8a1105594b46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085344, "uuid": "9cd4a62d-079c-4174-be5c-dc5c276b8337", "value": "T1C114D71AAF610FFBD8AFDD3702E90B0129CC655722A53B353674D528F54A60F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085344, "uuid": "f24639d3-4406-4647-a6ff-3d3dce5fba93", "value": "3072:uQ3EkK/CtKd2BFd6tbSLAT7ZjSdtR4UcdKp:uQ3baCtP3sYkYdlcdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085344, "uuid": "f125d996-0f50-449a-a2a3-fb64f342ed95", "value": 194824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085344, "uuid": "6b8cfdf7-55b2-4a71-9afd-fd79ade97b74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085344, "uuid": "2032edb9-5ef8-44b7-8ff6-4c534e191fd6", "value": "byte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f26aa6b-dc34-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766077847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077847, "uuid": "0caefc4f-d0bf-44f9-9a58-dff426f96451", "comment": "Malware payload", "value": "b0de12d65f79e0475bf8b487148b567c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077847, "uuid": "b971945b-a7f7-416f-a1a7-c9b8ad3742f9", "comment": "Malware payload", "value": "49ffba0ad4f05e42eb0671bc2eecd7fa73fa85ea573765fb5814f6eea3401085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077847, "uuid": "225a486e-a4c1-43c8-af08-0048b3cbedb8", "comment": "Malware payload", "value": "4a4934067df381910be0fde39c4c19cada557b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077847, "uuid": "b87f897e-12b2-4175-a6c9-1dcb4b6c38e4", "comment": "Malware payload", "value": "501f240c376187039260f6304c8ddbb6a43c66ef0708f6011ef7fa32a16f3d8147e51ba402e73b51bb3cc5051b3827e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077847, "uuid": "6f952be5-78c8-414f-8a63-24cde8fe485d", "value": "T1B6086C4262EA04C4F9F7DA759AF65617C673BC122F3085CF221C172A1F736E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077847, "uuid": "8e5145c5-3c1e-41ce-85bc-54d3e7288b5a", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077847, "uuid": "963fb285-0df4-4c14-bb0f-103d6668985d", "value": "393216:W6l8yvpcavR2rcq2qwOF1jUY+UwFD/Vhu0usIyNOnS0B4AycWMCYWbUll7aWGTbY:WIpC/o0sJY1G0G+or5rs3wbS31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766077847, "uuid": "d21a3ba7-0707-4f62-8585-6c9b9ba1bf7c", "value": 81806131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766077847, "uuid": "d98ab416-0432-47d3-9e97-b05fec134946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077847, "uuid": "3b12afd7-2144-48d5-9abc-67267e49d011", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9964238d-dc64-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1766098507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098507, "uuid": "9cc4b85d-f5a3-4031-9fc1-7386d77614d7", "comment": "Malware payload (njrat)", "value": "15e12235e0ff99601bcf926331d50610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098507, "uuid": "b8ebc843-373c-4037-9c30-6d4ac62a5c14", "comment": "Malware payload (njrat)", "value": "4a65c27c890a97e68fbc5dd25b4d8828f834f60f307acb2a4979df3223dcba4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098507, "uuid": "aec1060f-3fa4-44b9-9e9c-d5e9253aa1c2", "comment": "Malware payload (njrat)", "value": "ea585a502ef2a89adf507d7e8a26129c3faaff63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098507, "uuid": "e383e98f-51a0-44e1-844f-6332791bd2f4", "comment": "Malware payload (njrat)", "value": "2b74e3b8bb08088d7f18ece79d5704439e051b55cdb9097e85ddda30455e4145b7cc9b775d60369c84240273c72157e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766098507, "uuid": "dd0e6224-924a-4f9d-ae68-e09ba6cb7c0b", "value": "T1FC92BECB6A5653B6D4A018F04122450927FA572B56CCBC27EA98C68138FA567E0F0EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766098507, "uuid": "1e2d1b20-1c5a-42b5-81cc-efda0dac13d1", "value": "d4ff4e9520d2b9d618be12fecec0c0ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766098507, "uuid": "d757aeb0-6bd1-4dc8-aa05-02f4b5aa95e3", "value": "384:wviYpwZswO9N7wpj6gPR9h/jH+GE8MKckqEAiu/U6YMuCIOvYS8:BYpwZsTHwZ6WR3T+Gh4M+uMYS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766098507, "uuid": "b81e55fd-aca0-4ce4-ad16-57c4a373bb81", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766098507, "uuid": "88af1a5a-ab10-49a4-a16b-9f31779f3276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766098507, "uuid": "f63ef53b-72a3-4b9b-8802-feca19f8c334", "value": "15e12235e0ff99601bcf926331d50610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdea9f8-dc33-11f0-a129-42010a9c0007", "comment": "Malware payload (BazaLoader)", "timestamp": 1766077307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077307, "uuid": "04923261-aaba-4669-a034-58f9d1453a71", "comment": "Malware payload (BazaLoader)", "value": "9748def1acb43dfab58075fafcd19fc2", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077307, "uuid": "a2ce7c45-12e4-44bd-8a67-f899dbd48e8c", "comment": "Malware payload (BazaLoader)", "value": "4a88da26e5a11f1d90e7061472daf5bfe8ebcc2322416633200ec5b5007095bc", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077307, "uuid": "28c8dc22-ef95-4063-b66f-7488bfd52d79", "comment": "Malware payload (BazaLoader)", "value": "aa7c9d0b2d42025ebc534db1cb7694df73362a57", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077307, "uuid": "aea2e411-d06a-4ec1-872a-c410b087d7b1", "comment": "Malware payload (BazaLoader)", "value": "1415a1315c54f3e30c793720dffa955b8ecb4330991a71086b454f5c154bc6390be06b2fcbaf8ac33ad2c2bd8726edb4", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077307, "uuid": "8c82b61a-3d1c-4e12-aece-d5e979080729", "value": "T18F363A8359A0C96AD0AFF138ACB2A18677707C08477137E72E923A751EB77C41277729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077307, "uuid": "aeadfb24-53df-460d-8748-82f1f0b3ba62", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077307, "uuid": "74746730-1148-45cc-81af-955918530ebe", "value": "49152:LoCRj7450nmQkW/rrqpzANqxkkJ/jKh30bciW/ToG7QfZHD6ELMNBWOERNQ3VZ1M:L85XN2ToGRhuw5ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766077307, "uuid": "85b548a6-f1c0-4c23-a9ff-d78a17427ed8", "value": 4990512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766077307, "uuid": "5d23e75f-0cce-479f-b31d-8cc8bd0660a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077307, "uuid": "c0e616c3-f097-419e-aa53-101f13da5132", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a46f88-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092590, "uuid": "30769ea7-7efc-49b8-b3ca-d11afb640fbe", "comment": "Malware payload (Mirai)", "value": "d93ca359be56201ebfa4646048844cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092590, "uuid": "b27311f0-57df-4cce-88f0-73f27e16c1a9", "comment": "Malware payload (Mirai)", "value": "500f21ebc73806a169a516cad11ea8f344319829ddcff29e464cc8ae38decd7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092590, "uuid": "1f72ed08-4cde-49f1-a602-acc93476cdee", "comment": "Malware payload (Mirai)", "value": "bcea8484444a727c94600d0664c06386f0de7328", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092590, "uuid": "49486c73-20d7-454e-887a-3a1c3fbbb62a", "comment": "Malware payload (Mirai)", "value": "86e0eaa5d8ae79cdc9fdd6a6b23ec5d52fd8263d78bb78602155db9d281c49918f48681af9020c0a9ae42edd3b908cf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092590, "uuid": "57fc842b-1e0a-43f7-9f04-516e013bafb3", "value": "T112730995B8818B22C9D512BEFA1E118D3323177CE3DE73129D206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092590, "uuid": "2049a70e-a14f-4c66-976a-ed41b3e8ec68", "value": "1536:TAnYSDACyTQEbE80RbavEwpDQQMgiR33ATHa387oL5oYMd:mMCHAp0Rbavg3ATHa38kLyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092590, "uuid": "74eb82fb-37fa-4fcf-b7cf-29a31b927bf6", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092590, "uuid": "35d54bf0-f2fb-4745-9514-21bcd8e072be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092590, "uuid": "ca0d3be0-4031-42ea-8aef-0319797dd0fa", "value": "xparm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2a8a29-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052987, "uuid": "f0fbdfa4-5b6f-43fe-96f7-726ebdd2413c", "comment": "Malware payload", "value": "e276b3b65a5cd1ba28b5f3a6d1c12621", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052987, "uuid": "79dc7483-7d2f-4641-975d-adcdd9f63865", "comment": "Malware payload", "value": "50244f37c8c13c87fa7be7b4efa8922f206e9e179058e2c3e86666e664e4fadf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052987, "uuid": "44510b25-8e91-4771-9f2f-b63eb0c4439b", "comment": "Malware payload", "value": "afbb9f1edade9b0dfc645203813b8067e413794d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052987, "uuid": "7e589ec0-3e15-4362-b767-7e70642df961", "comment": "Malware payload", "value": "454c1f9244276cbfa2f237fa934793701d582fc7ef2bae05b13cc4cfdc70d370b40f23c0b9a8064f9f9c1e2a736597df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052987, "uuid": "7c5abfc6-1cd5-45ea-bc2f-369de05e9ee3", "value": "T116161249DE35E388C4FBC6811C50AE4BA964437F3AF29B1A711F3584BF9157342396AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052987, "uuid": "7bbfc5b4-6cc7-4bee-b5c2-cb8fbdb9f551", "value": "48:3444444444444444444444444444444444444444444444444444444444444448:DpfY1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052987, "uuid": "74ed975a-dbd7-448b-8a28-2b12b73fa11e", "value": 4334876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052987, "uuid": "64fa9a46-43b3-4bc8-b2f0-168e19630115", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052987, "uuid": "2a1651e6-d7ae-4d99-b621-8f2c59329a46", "value": "SC_MT103_6_1216.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15a99fd-dc06-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766058202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058202, "uuid": "386780d5-ecf8-487b-9ee6-e22dbdabcbd8", "comment": "Malware payload", "value": "f3006c5f8f452ea99aee4d0dd7dce962", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058202, "uuid": "a007e4f9-451d-4545-b6f6-604ab75aa6f0", "comment": "Malware payload", "value": "50598efe9fbf334f59b2a95356a254b6f3011c5e7a1df946a1bd50378c41733a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058202, "uuid": "0d1baa32-b8d7-4b2e-8e2b-a56fe37a207e", "comment": "Malware payload", "value": "94afec913dccb6dc2ff60606a5198d603a6ec7e8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058202, "uuid": "ef658702-9c3d-4d32-b88d-7ac34e5f624a", "comment": "Malware payload", "value": "b71b57e7dc13f16242d0ecc16e73fa58fe6bbba14f19c335c596edac4fd4079b45203618cf4ae11a3e5ee1df0c9d57c0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058202, "uuid": "dbeab6b2-c392-4b71-af87-270be74e5122", "value": "T1E34733237DBAD565E1CB67FD810C308F87C49F890A9087EC9601937B4F69B143EA46E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058202, "uuid": "e2705cef-83ab-4de1-a78b-d201caf07118", "value": "393216:gz+xvku4ym0y3guLxHj1r4tleOJLD3RtlocLxYwBEGYi8nsMBYIxZzQQ2Q4:gixvr4N07m1ctpD3RXYe3qBnxWQ2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766058202, "uuid": "949c03af-51cf-42c0-a08c-1ecbf4e3c077", "value": 26690036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766058202, "uuid": "4262c4a3-3cfd-4105-9dc4-57da4acec3f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058202, "uuid": "706fd085-4f56-455b-8d73-cf252eb76422", "value": "\u0130nat TV V13.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcf3682-dc04-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766057363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057363, "uuid": "a95caf2c-0249-41d3-9943-6c8c3bccce5d", "comment": "Malware payload (Mirai)", "value": "ab7848a1fb2e3791b0b3a53adee2dc44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057363, "uuid": "32dbafb5-3ab6-45b7-83ec-8bfef9e46e2b", "comment": "Malware payload (Mirai)", "value": "51a2f08b70695f7a42a58a0ec1596cb3647d2a5640627b8831c06c467e0f2e9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057363, "uuid": "5e2b3e6f-d29e-45ea-942a-44471b8262b8", "comment": "Malware payload (Mirai)", "value": "8f1e1e95db2e48d9dec7cbacb8f8d7ac7344cb12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057363, "uuid": "03c0dc8a-d625-478b-927b-6939cfd1f891", "comment": "Malware payload (Mirai)", "value": "26125f77ede7a07addca28f79acede1faba1f452b8b2ed7651c47a41ae7bc92c1126aefaa0db056ce0e49d444e4d48f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057363, "uuid": "fe3fee76-b8e7-4e8b-894a-ffddd0f98d57", "value": "T17BA3EA1A7F12CFAEF769827007F74E31965837962AF1C585E19CE9401F602CE681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057363, "uuid": "c3b08c50-57ad-4090-9e0c-e8618b496ca7", "value": "1536:/i3vQOiy5Qc8o5dRqYGjPisIwB/TfjoiseFpWPWIl61d6a7Pvy:/i3vh6cR5dRyesIwB/TsiSWI4H7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766057363, "uuid": "ece55ad2-b335-4530-90ec-c6613ed8f5a1", "value": 105060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766057363, "uuid": "5eb9e21e-f637-447f-bff1-356191f3058c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057363, "uuid": "23efbef3-89c6-45b5-bebe-cc58d029011e", "value": "nova.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6640ed-dc30-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766076074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076074, "uuid": "23e6f713-787e-4b52-ba7b-2eb3f9dfe265", "comment": "Malware payload (AgentTesla)", "value": "ef1a1cc31755a71cc58a4273ec5cf708", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076074, "uuid": "93963553-8f22-4e81-9c53-4e4e421dfc9c", "comment": "Malware payload (AgentTesla)", "value": "51eb3631da5705e9f250bf1b57177963ffeedf2e2d56a99ddafe7181ad28a4df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076074, "uuid": "a27f36ce-5645-44b9-be3a-7f732fe0e3df", "comment": "Malware payload (AgentTesla)", "value": "fda0c3604b72987c7d4d74fb31e17f783fcceee0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076074, "uuid": "99f74064-3751-4a86-924a-5eb07ee6bc9a", "comment": "Malware payload (AgentTesla)", "value": "85302727347cd7d270bc341bb9fb7bec785a16d4d364d70a11dcf03b9b22f43125c20a111e835d327342d388800ab5eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076074, "uuid": "a95ef7e1-efbe-4c78-a93f-c5afd64771a2", "value": "T1AE9633B11AC3CB02C5F7467C19AD7BCE8994B1DBEB91F31A1F94AA00B94F05C3759261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076074, "uuid": "7b70bc2e-fc72-46d8-8d80-92415491cd38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076074, "uuid": "62226331-149e-4c9a-b606-39ed34d1d9b4", "value": "196608:07CCn8w470gjzUooasFRXRhqBNQQX+9iWt1NpLnyRn3/YWz7fiNt/iVn:PV4Z/RhVMxWtlL+/vzLiDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766076074, "uuid": "c37b6365-ea95-489b-b389-22211e0c66fa", "value": 8800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766076074, "uuid": "1721de0f-0954-4073-b5df-7da308a58eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076074, "uuid": "9308e1e3-e38c-4c0c-a77b-c7d226aecb94", "value": "dotadlc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2488ab-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052988, "uuid": "6f44f4fa-d87a-489e-afcc-74fade4efc70", "comment": "Malware payload", "value": "783f92019da6cf9139384d023521ac06", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052988, "uuid": "c2cb7d4c-4eb6-44c2-84ce-19816679887f", "comment": "Malware payload", "value": "52613809d414fc8423591b4960b0572464cf8abf0b8eb019be371a6b324c0e1d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052988, "uuid": "10fcc6d8-5ef7-4cd7-b7e7-0b6bca088cf9", "comment": "Malware payload", "value": "f28c161c6f87b33f9e5ec28e60080d329e4a7a38", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052988, "uuid": "f28f3aa1-a43a-4e39-a696-9a63e6687cec", "comment": "Malware payload", "value": "f1ea004f1ae599b2ff899e7e56f96835f64a2b0bdec0d20279145824ce8b0974ff86c10e1d8be036b469807a0de31362", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052988, "uuid": "3616ddea-68b2-4612-95c4-771852b51300", "value": "T15E4333C83FD2B8B0536270B76D2BA06AF57E5C84B64C40E4D3A694D4F92C318D6B1B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052988, "uuid": "d09ccd02-b0a2-44fb-8016-19a98a6958b1", "value": "1536:DTuobHtnjcW4WYnaj6RthgIofTF2SjEndm7305lpAI5Nz7:eg4WlZN7kxAI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052988, "uuid": "66cfe2f5-3bde-49e6-bdc6-059ff2ca698d", "value": 57777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052988, "uuid": "1c3a3eae-fdf3-4cd9-a359-6ee6c696161f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052988, "uuid": "340a6c0c-f7ef-422f-9753-ec4fe42208e8", "value": "SAPorderNo4500207784.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4cc13d1-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053027, "uuid": "1c22d9f8-fb9b-4242-bce2-e28002d520ca", "comment": "Malware payload", "value": "dbb1e8349a842488de1cc9d70b8b1a1f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053027, "uuid": "61e77c96-8c8d-4c80-94ce-3a64f3448e1f", "comment": "Malware payload", "value": "53323980c6c3966c8179da22048a94a438d5f8b04a4c3cbca9af7bfdb4fbee04", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053027, "uuid": "8a7d605c-51ab-41a4-8412-ac7b021d28b2", "comment": "Malware payload", "value": "2a3d93c024b3a744222073e73b0fd6b298fd1680", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053027, "uuid": "5f1de641-53e8-467e-b7ee-da089b6839e7", "comment": "Malware payload", "value": "9265c028bf3da70b2a2bdd0d422131814816b7e3e9c35e92b236dfcbbb243d818eb944200462ecea5b2c4bf3f3843672", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053027, "uuid": "781e3b92-d7e9-41f2-9b09-2aaf72c3e4c8", "value": "T1D6532E7093C16C5021576F76B71BBAE5EB395D993294098BE404BFB8FEB9608E790C30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053027, "uuid": "6dbd4b78-1ada-4c1a-8808-ee6eaf569e7d", "value": "1536:ppHD+n8eOCj0GjnjkT6QZITyX91IfarVX:/jQfL7TjkT6cX9gaJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053027, "uuid": "c240ebda-3520-4d07-bd0b-6aa642b97298", "value": 66023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053027, "uuid": "198b3f65-9202-42db-93d9-b1f399766eea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053027, "uuid": "b9aa6e7a-9b99-489a-a1da-3c29d6e0c2c5", "value": "PDF_Factura.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305c9978-dc35-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766078145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078145, "uuid": "761a623b-836b-49cd-a400-00ab75a1c540", "comment": "Malware payload", "value": "3e5065088c8e3746528b32b551f707f8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078145, "uuid": "216e5312-967c-41d5-b91a-fb782bda2093", "comment": "Malware payload", "value": "5379f70b6cba563396465178716b85c7105b15d816102fb862f0c6b183335fae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078145, "uuid": "e6056f43-c704-4770-912d-6ec5ea42bb0a", "comment": "Malware payload", "value": "9a1db5d8f2a14c83d4d03faec9c3731c00ee5369", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078145, "uuid": "32a57e90-bb91-4a1d-99fe-58d020fc7603", "comment": "Malware payload", "value": "b1687e8851950ce1d3a1fc3e3c4e70b498a1d3aa23883968bd1e5866bab906253f1d7207d1e5946a2fb041a31835da83", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078145, "uuid": "6f5eebec-9f27-45dc-b107-cb47a9c5cc0d", "value": "T13546DB803741B98310D74BE3B303ABF452B5F58ED4C846CAF684BD85D09E9B929D63B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078145, "uuid": "498c2159-f405-4dfc-ac17-1954aa3b3580", "value": "49152:MIKCtoQBo27MyrkyAJ0cyHRUDWghkYUXp48uV38y1w5VmhUQ24t1pCwUgqlaH/NZ:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766078145, "uuid": "03d7141e-338f-4146-9f66-bdba9873d555", "value": 5373408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766078145, "uuid": "3a58f403-73e0-4d82-9f79-47642ca4306e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078145, "uuid": "f51d37bc-0776-410d-879b-d4026ba48950", "value": "output.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fee3b0-dc2c-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1766074215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766074215, "uuid": "0ba6d21f-3418-40b0-bdfe-0e7f95480e70", "comment": "Malware payload (SVCStealer)", "value": "052dbda17531816420557bd899d0f74f", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766074215, "uuid": "f14ec95f-e44e-40ea-882a-82f0727342ec", "comment": "Malware payload (SVCStealer)", "value": "54923ea8ca61cd3ed1c8debdf9254799d93603fc23c34553d893812897d22340", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766074215, "uuid": "dcd16ad7-3e71-42ae-afab-b92495081c7f", "comment": "Malware payload (SVCStealer)", "value": "44dd07147fc6da05796073ac7851148ccb2393e1", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766074215, "uuid": "1f787d47-464e-4588-8100-4974eb859b03", "comment": "Malware payload (SVCStealer)", "value": "d5b6a0d11f30a00bddf916028642df8f327745a36d6640d0adbcc22322fa846a4f8925f6f5f7af9b5d8caa534a8a8371", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766074215, "uuid": "69fcada3-86e5-4599-8041-82a986a40c27", "value": "T19C558E4AA2B500FCC0A7C274C9565A0BE7B27806137497DF5690CA6A6F63FE11E7E334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766074215, "uuid": "0c6d5931-6949-4a5f-9630-632bb854a915", "value": "bcb378f9cb883de991e0cf9ddcebf5c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766074215, "uuid": "11b1c161-49b1-4020-b332-65a626d088df", "value": "24576:m6g+B6Jrs+rtdM11GQApYB2WE+auit6nkH0:ay11GJY4tZtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766074215, "uuid": "10b63308-0227-4b38-922d-b182fc0a4c70", "value": 1392128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766074215, "uuid": "96085de6-64e6-4af2-bc3f-9b354bd64bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766074215, "uuid": "180e2d46-1ae2-4eec-9a32-3755ff8c114f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0352ac-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085328, "uuid": "21383188-9be0-42d8-b670-fa7bd767f7fa", "comment": "Malware payload (Mirai)", "value": "cf57929e3ae6cd6798f187a050da19e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085328, "uuid": "954e48cc-8ef8-453e-b596-02de49832cd0", "comment": "Malware payload (Mirai)", "value": "54b6452d212226860d40ea7ed4bf5df3549ae7aa04b129f7b629570f630bc7b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085328, "uuid": "4bca99e5-4a95-45b5-87ed-a71354cfd826", "comment": "Malware payload (Mirai)", "value": "f681f49107ed78a0a5311cbef7b8a3341ea16a73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085328, "uuid": "843eade3-a034-4dff-b804-dbf7abf92393", "comment": "Malware payload (Mirai)", "value": "64efed439f4eadb2c92e57813bf08c303c392a6e805f9320234559df1bd6121d6483f61b414f3a2802445f7de7e2bf6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085328, "uuid": "7bd71428-e516-411a-a099-0f4f3c6f5008", "value": "T1A6232992B8D15E2AC1D0627BF67E508C3356A3E4C1DF36578C642F427A8A52F0EA7F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085328, "uuid": "a19f4ad8-4641-4812-9652-f082b3e21734", "value": "768:+ZaOzajwV054nrmjVHJPLvuRYL4111Jt5uJa1+vYPpR/h+O3GGCUXlq71dUxnt:M1LVPrmjVVO1JbuJW+IpR5lCWl61d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085328, "uuid": "6ee070c1-e337-4fdc-8c79-1767b52c473b", "value": 48736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085328, "uuid": "dba42910-95cc-4a08-b2f8-443a0377ae2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085328, "uuid": "6440cb5a-67f8-4097-bf09-62aab6effddc", "value": "byte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad142c3c-dc10-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1766062462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062462, "uuid": "dadac55a-6b79-4d49-89d7-e07647768ed7", "comment": "Malware payload (GuLoader)", "value": "eeb0884fd4ad33f809c64b3678c5be3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062462, "uuid": "77095fec-6c05-4c50-958d-4636c82016c7", "comment": "Malware payload (GuLoader)", "value": "55806bdc01f9673da247b2f4f7a9841d2aad466ab6060107a63b73a68a999de2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062462, "uuid": "74b11fb2-0d7e-4f51-a115-6c72a90654c4", "comment": "Malware payload (GuLoader)", "value": "590f5bafa2daf56b03d9e1c2a768ceca1fd9bc86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062462, "uuid": "db3836f6-98ac-4ecc-b532-ffefcba55077", "comment": "Malware payload (GuLoader)", "value": "213ba8bb923c98e51c7955c3af6d35121cf6c56b3114724bb3312b2cbdcea8ea267282983a12c3d4696df2cfe1018724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062462, "uuid": "594b4f83-0cbd-403a-8b2d-9785ea14455f", "value": "T17A9412016190D187DA7E5770883BE6B9D6BDAC402428235727E07F67BFB1863F88EE41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062462, "uuid": "c562786c-0de6-4d85-aa96-4de7f9ebdb06", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062462, "uuid": "702bc0ec-e450-4db9-8978-cd2b421c504e", "value": "12288:Ur8qUqT4oJrVFsh5De7ndedXFCF3yct7R:88qrE0VFsh59dXF+ikR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766062462, "uuid": "b1ea71e6-e762-494b-bf50-2dac9a3299ca", "value": 435784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766062462, "uuid": "2b652ba7-b22c-43a7-baaf-645e8ef9e50f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062462, "uuid": "dd20ce12-7550-46ce-80a1-21e95c689fe8", "value": "Parcel zto-395241214095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5f0be1-dc15-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766064605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766064605, "uuid": "9ab6424a-1443-4aee-9ca1-3a1747019de8", "comment": "Malware payload", "value": "2eb929817b98a1f977e41e590ce80b90", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766064605, "uuid": "eef55c39-6cc5-435a-b8c9-b4cee523fe1d", "comment": "Malware payload", "value": "56eb9e641859e891c390a825f3093a6ef63b7ff9a767224c4cf0d0eec4931c5d", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766064605, "uuid": "e6208ea7-ec10-4bff-9898-5809f789f595", "comment": "Malware payload", "value": "525aa18e713651095555b68fb9a1e18ed52b945c", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766064605, "uuid": "efcf6f7b-50f3-42b0-9ec7-3faa0a994c13", "comment": "Malware payload", "value": "6a0991d641f733122c0740baf1476635171ca648cb1cf2336442e35595fd8d2d69cfe1092f6dd4f9ff9e981cc2dd4c32", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766064605, "uuid": "0e935877-12c2-4ba4-9a4b-b042c297954e", "value": "T1E8E49293A6284755D8DF3D3A6DC31881294BADBF430717B80C2819F45EB1261A73FDBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766064605, "uuid": "62237069-33a7-4f8d-acd5-2f6b55561f1e", "value": "192:FfB6fymv9NXvFMpu4y1xX8Fy+WNP3wCrSuVVSfQ6S9K9/bo//QbIMLQOJHPP2sB4:pwUqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766064605, "uuid": "09dd7ba8-856e-4c1e-b7ea-93bd034feaac", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766064605, "uuid": "9ac58f1b-563b-4e5d-8114-228571f6fc18", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766064605, "uuid": "0cb61080-1650-47e8-8b90-e93df4075941", "value": "nFaktura_sprzed.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8d1b7c-dbe7-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1766044637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044637, "uuid": "750e65f6-3283-4966-8e92-52d9777838d9", "comment": "Malware payload (GuLoader)", "value": "4523eff67adee63cfef9bde436ce8a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044637, "uuid": "3751edc3-5c28-4c8f-a547-98abf1510ab3", "comment": "Malware payload (GuLoader)", "value": "572604c4c9fa2bd8b7ba646845d8f18fd6d0644a278390bb764079182a4b23b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044637, "uuid": "b83f50f3-dcf1-4553-ae75-3d23ba91a6e8", "comment": "Malware payload (GuLoader)", "value": "8b3dc635efca25ff9a125e76d5bbfd56441aff7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766044637, "uuid": "91990546-e98e-4d4f-adba-5b17dc04c4af", "comment": "Malware payload (GuLoader)", "value": "a99b1c5baed5e6aba6ce9850e1bc0775938b584b826806a0c938b591fdf550f07fd74214d7938beabafb45386e881d9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044637, "uuid": "0519088f-359f-4c85-8fc9-ed54be7216ed", "value": "T18DC4F1213B19D907E29111B45861D7BD8BB4AE9C3D6ECB03B6F03EAF79787925D0A240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044637, "uuid": "7be52f36-18cd-449b-9564-6723070e1296", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044637, "uuid": "643d3a0b-d01e-4094-8f61-8ecddb3c14b6", "value": "12288:DbjSjfsuPH4XKAb7VHT5QOaO80PMaYQ9WN09w:DbOjfJPHdaR1QITmQ9yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766044637, "uuid": "263a5440-627a-4cd6-84f6-35ab93078e9f", "value": 586528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766044637, "uuid": "18d516bb-a7fe-4a9e-980d-c22fb20048f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766044637, "uuid": "bed702d8-0a39-459f-b9ad-7387596aded4", "value": "MT. Sinar Mataram_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba602b50-dc0d-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1766061196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766061196, "uuid": "d9830d4f-3083-4a61-b596-bff46e15342c", "comment": "Malware payload (DonutLoader)", "value": "b906c5eb758c80b7a9519ee1670c0252", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766061196, "uuid": "092053ae-51c5-418c-a31e-987feb9f473c", "comment": "Malware payload (DonutLoader)", "value": "5731d0fec3b864f35d7711803d93db4b80cde7a52bc81d89053ad11c0ac9f10c", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766061196, "uuid": "fa00b4bf-77bc-4c0e-9eb2-6d3060bd2b6c", "comment": "Malware payload (DonutLoader)", "value": "5f3ffd893eab616fe7396e5bd73de27284781e16", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766061196, "uuid": "05013f0f-eb89-4154-923e-423cb06092ed", "comment": "Malware payload (DonutLoader)", "value": "2feee8c0a71c19e38ee70121282ed64faf503fdcc146020884b26db2231ebc607bb4d374317574618dcebfe022accd05", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766061196, "uuid": "25a97bda-c814-4abd-a0b4-ff1aff00b430", "value": "T18A24F12E5E7AEA8EF1EDACB5D4001F01A850B68C8D55C3E7CEB9D57067778400F29AD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766061196, "uuid": "369c7bb1-f43b-47d1-ad9b-3914d929abba", "value": "889d7d9bd78af47c7881d69d79690e91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766061196, "uuid": "e450c24c-e22e-437f-8e1b-fdd0fad6ad93", "value": "6144:k2Nwu23v7eDkEZICLtPjYOdCVtXQ0jvIQhgHK0Jb7j3S2a:k2NwuYRL6xjYO87xvIioN3La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766061196, "uuid": "aee97f4e-51fa-4f85-b348-f138e85b2879", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766061196, "uuid": "95a3f186-a766-4b7b-bce2-26b5622ba0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766061196, "uuid": "f10f3c51-c645-4a5a-af48-e909909608fe", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87e63f8-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766052576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052576, "uuid": "e77a099d-2f17-4ed9-b066-9f986b2c60b9", "comment": "Malware payload (XWorm)", "value": "a1fc3a226af2a644610bea1602b84db5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052576, "uuid": "214d1494-1a3c-4c81-a880-d9b392b5b32b", "comment": "Malware payload (XWorm)", "value": "581a433981d464845834eb17631355b5efefe97ebd132ff2dcd3ad925e98c80a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052576, "uuid": "82ac3ec4-d4ae-49d7-aca0-2572fd873c2e", "comment": "Malware payload (XWorm)", "value": "929148f6f03ece28deb661e0a3be86427554bd82", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052576, "uuid": "3f222d81-cc32-423d-9c05-621316638996", "comment": "Malware payload (XWorm)", "value": "d94ea33c4a994bbc5ea395c2f5fd242adc03699270d111e8482fddd0823d5dbcd36bbbf0011b2e8aa6b4733637223bc3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052576, "uuid": "d9535d03-c755-469a-a535-0230edc7131c", "value": "T1FBE4FE29B099253F7CE5AF341DB7AB4946E1CD9F426E54CEB310A9C01D70EB98EC9321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052576, "uuid": "b27ad2fa-11f2-40a6-818b-67a24f09cd50", "value": "384:Tw3KP7h02sAguy66S6PikP1GJHAPnnaUXbnACe3aLed/O6wsAu+7fW2gHCVVic+3:z79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052576, "uuid": "38450fd5-60f7-4c0c-8999-dac9ba1fa12e", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052576, "uuid": "2b9a7c15-12a4-4282-af7b-a27aa716b899", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052576, "uuid": "3a5820ae-e18c-492d-aa30-01fdf483e3ac", "value": "263350411NZ.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3531f77e-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766052383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052383, "uuid": "1d811aed-64f2-4bc6-b1fc-f0078c8c3da6", "comment": "Malware payload (AgentTesla)", "value": "47e27ca90d6c95cbbc59766392614adb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052383, "uuid": "311638b6-3eab-4b21-b7e6-aa1ec42311e3", "comment": "Malware payload (AgentTesla)", "value": "590bd2abfd260783e797c1d2afe52b6655c5d9d4e3ff9429e0574ec5e507c776", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052383, "uuid": "9b1eb174-bcd1-4c12-9597-05491d5a55d0", "comment": "Malware payload (AgentTesla)", "value": "07fca5a45ad0dfa42a0d662b76b8af9a1156abf3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052383, "uuid": "23808a21-c902-439d-88e1-1732b0165c85", "comment": "Malware payload (AgentTesla)", "value": "50a19153e96ab18af8d568baf23ad36cb42f796221fdaf5f5bc0726fcbdb78fa52aaeb973af418c957b05ff88dcc22dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052383, "uuid": "bc72e224-1015-408e-ac07-2d2966d07864", "value": "T1B962117BD55CEFF00B3E21F411877D1120619326A93A8D6D98D6C058BF2A7518FA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052383, "uuid": "d76ba667-9759-446c-937b-0a03671d230c", "value": "384:3QuDuz+EhvcthgNlFmWtGDMu+Qcdw+lP3WhAOn2xYJFTwtoPZr+wvVT:dCz+qkMMMlR5702iJFTwgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052383, "uuid": "fc842941-6d0b-49f9-bf83-e3c394727c08", "value": 15830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052383, "uuid": "89b276e0-cd46-4320-a77d-71105fd2be39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052383, "uuid": "661d1f3e-1c65-4ed4-856d-1b2224a73945", "value": "Holiday_Bookings.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2781ff-dc61-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1766097040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097040, "uuid": "df240a98-defe-4909-ab11-18c8cb51bf18", "comment": "Malware payload (ConnectWise)", "value": "2ae966939e4d59457213be7adea78753", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097040, "uuid": "62c9beb2-954c-4503-87d0-e7c461415f5e", "comment": "Malware payload (ConnectWise)", "value": "5bef26a1c44b66822f117dbb04039b34a89ff42deb36ef635fff0125040fdfdc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097040, "uuid": "e67a291e-00bf-47ab-a2af-c98c589d2ca7", "comment": "Malware payload (ConnectWise)", "value": "b07727253581a391a5a6ac0dd239af31c197c7d2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097040, "uuid": "c031da70-dcb6-4969-b456-00807df5710c", "comment": "Malware payload (ConnectWise)", "value": "80080b8af886bfc4305d70cd51f591d75f713886643b6b7b1bd83f738d932662ea4b263272982afa58347c1ce1555269", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766097040, "uuid": "0e86f728-e7a3-407b-83da-4e9489cdbf6e", "value": "T1E2A623626AF8C225E2F70B39F93558B064363D25EE22C15FA369791D2971F80D672333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766097040, "uuid": "b4d68f0e-b448-4be2-b9ed-ee616b3da972", "value": "196608:J1+sPlEFFUKq4ypy1+sPlEFFU11+sPlEFFU/1+sPlEFFU:XPNSFDqtpePNSFAPNSFsPNSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766097040, "uuid": "598b201b-4a1f-4acb-be93-63975d86d8d2", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766097040, "uuid": "ab5c2341-7b08-4614-9d95-feb57d87521a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766097040, "uuid": "c5316c8d-bdd4-4f2b-bd01-9bb250ab338e", "value": "SSA_Yearly_Templater.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b113ca57-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053020, "uuid": "7bf81866-2a59-40d6-aa9f-35334be81b72", "comment": "Malware payload", "value": "aae94f24e6d2f88392d91acc58b5bde0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053020, "uuid": "536de7fd-d87e-44db-a4fd-2a6d1a4e5264", "comment": "Malware payload", "value": "5d3f502b1804aebad84bc6199b1c32a6de15a9078a09608a37602b1e70a60349", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053020, "uuid": "6894782c-e717-4388-a470-34aeccdafbf3", "comment": "Malware payload", "value": "140be376888124d00960f31bccc0fbdbd0a7c608", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053020, "uuid": "80dbde5a-afed-41a2-947c-aba3bfaa153d", "comment": "Malware payload", "value": "022eaf6ab2e9d2c8efc50b5b1a2e7bc41fdf5d25c19946cf2849fd5bb2be6b650a2e7e88e13c187c872041aa9f69709f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053020, "uuid": "0ab5cb5d-7b06-480c-b84c-329d75578d47", "value": "T1472600DF1A34BD0BC0375747BF986239E7ACC3091585E33E39018EE86EE599991B8835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053020, "uuid": "4b48d52c-1970-44a7-8636-d7c0e8a8b712", "value": "384:aQ9t6AZEUHb1TRuBquOLsLnJIW6hSyqSYulNf6hj/462Y4MBMZDGQSSs5eZAIkGU:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053020, "uuid": "9896d654-5843-495c-b96e-a7fd821c3de3", "value": 4478366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053020, "uuid": "86b29e7d-9647-4539-a30f-5fdb555fe86b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053020, "uuid": "8aeafac4-348f-4cac-939d-390cd68580e9", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01f71f2-dc69-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766100746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100746, "uuid": "4566d78f-ff15-4f11-b7cd-f17af7cddbb6", "comment": "Malware payload", "value": "3c43534228b73697fe111a21e17ff0a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100746, "uuid": "ad55ba4b-ea1c-43b7-b199-1ac8f78ea735", "comment": "Malware payload", "value": "5e3f7ec55b3f15b049e594a50bc20e8b655d1b33fe74f120cff586f24e1970a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100746, "uuid": "c49f9311-cd3f-4568-91bb-cf8c1db82c32", "comment": "Malware payload", "value": "ceaa16f9073823811db0f4b27cbe3e15beed3d87", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100746, "uuid": "de88e718-ec8d-4404-a1c9-38f2ec6662e5", "comment": "Malware payload", "value": "f91131a868b19c56f2d84b89fc68513cd4e79b900cdfeec412a1603430e40d796a3e79cf77c91a083280527ed4fe7faf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100746, "uuid": "8586d401-81dc-496e-9587-92a88b5e3705", "value": "T1E5A119D9787117B7CDE2AD28F615493F3046C2C49C76DFB4E45DB0BDB8ABD88A200945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100746, "uuid": "4d616f8c-7e30-475e-bc4f-f90bf41d423c", "value": "96:1xAPxH2lFcbpXH2dYHeE/ljaxBgHdXHGtCoXHssHK7H3THM:YR/XWdY+E/ljax2HdXmtXXMsq7XTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766100746, "uuid": "9804bb41-5cbc-4022-8eb3-830a09dff26c", "value": 4856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766100746, "uuid": "c7aa2064-9aeb-4ca8-acc5-8c311a9ff541", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100746, "uuid": "2d8b55c6-3339-4f5d-8824-8aa00d88e2f5", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940686b8-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052972, "uuid": "8915e7fb-00c9-4485-b12f-9713ea1fd78e", "comment": "Malware payload", "value": "abee01ada08597b71d468f129126f137", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052972, "uuid": "99a91f6b-ecde-478f-a037-a57e8949bd8e", "comment": "Malware payload", "value": "5ee6a5ff2e3c39cd88e9ccdc6a50b7ad3f9c7488bfc49a6c511379aceb91725c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052972, "uuid": "3faba94b-1f17-4618-88c9-8cc4b6fae537", "comment": "Malware payload", "value": "058025e693958cd1250e042e297b1c07f20e5a8a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052972, "uuid": "6dde7faf-74a5-4ce3-ba43-caab0e109a66", "comment": "Malware payload", "value": "a6c700a9b233847718cd5b3d1f5eaf1bcc43e2815e88f12a2085eda11b704f81604969503137a635602461507ffee458", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052972, "uuid": "f5534cab-e6b8-4d01-adb8-a3e5a0549442", "value": "T1ACA533E2AD61801FDF728FCB647C7596915D7DF58A842EEA6A02C22475C0A009CFDFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052972, "uuid": "8996b262-3bda-44d8-b093-8549a190cc32", "value": "49152:5DZo4bfJmm5d6u1dUTIWf1gaSOiRj4tblSZ1J2DeF1QWz9wx4CR:5DHfsod6qUTIZar0j4LSZ1J2DYCWz9wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052972, "uuid": "cd39ac69-8deb-4e6e-993e-3c9763311dbc", "value": 2211875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052972, "uuid": "d935a073-9d57-44b8-aa8e-dd2e58f17dc1", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052972, "uuid": "3ad506c6-12d6-4f82-8c06-ffddaa56049f", "value": "Tunnelling Certification Course.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4f1042-dbee-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766047667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047667, "uuid": "b5a4f9d6-6eff-4738-bd02-db2112eb4a62", "comment": "Malware payload (RemcosRAT)", "value": "e22ee74e83c968922df722bc1ec2aae9", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047667, "uuid": "fe196786-2d92-4ff0-9324-44e14829ac2a", "comment": "Malware payload (RemcosRAT)", "value": "604b38d6af73a28526b9f49026739ede9ec6d989dc7ac16f0f75a0ab74afdd12", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047667, "uuid": "790cc920-87df-4fb8-a9a0-ec24b41498a9", "comment": "Malware payload (RemcosRAT)", "value": "69867dc6415baffa15572a04b38b21c17a3862b4", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047667, "uuid": "71a179fe-7c5e-4589-805b-54e8682731af", "comment": "Malware payload (RemcosRAT)", "value": "c1edb0657b16a6835f0c08fb382a0e238a7314db0364105b2c3b3905d1f63a2e5f617aed55862e30e9bf2bcbe9642145", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047667, "uuid": "bd7043f9-877d-44f1-b115-4692b5403bdd", "value": "T1BC95CF836E90BC6FC1222877680FFA8D1C1E3D6EBDD4964776DD2A08CB665412726DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047667, "uuid": "b915b7d2-422f-4e4c-9489-cacdf5be67cc", "value": "24576:2hmEG/c7p/UTZowcONXPm3/gEhOH+r7VmU/BhpHuuKNuYOG+vNqIQWfZR8ufZZZB:86DVPm3/gr+r7T3IudGCBXBRlhfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766047667, "uuid": "808c1909-07a2-4cde-859e-fd19756d3a0d", "value": 2025595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766047667, "uuid": "12ba5086-6b01-4fe0-8f0a-082f48dac28e", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047667, "uuid": "037ac1ce-4052-4c35-9bc6-10e67fff1e69", "value": "RFQ P02-06-5119 ( BCD 06-DEC-2025 ).cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646450e0-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766052892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052892, "uuid": "ae5568f7-e6e3-4611-a9a2-ee794dac0090", "comment": "Malware payload (PureLogsStealer)", "value": "faefae9527bdc3d43ea55f738a4ded9c", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052892, "uuid": "81d70c75-4ee9-43b5-8bb2-4b3f8b255d44", "comment": "Malware payload (PureLogsStealer)", "value": "6226a37bc377a43e1f98253a6cac5813634784dd7e0b17185131e5c97b340934", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052892, "uuid": "96d93922-b98b-415e-9533-c3012cc1af3a", "comment": "Malware payload (PureLogsStealer)", "value": "e2e4162d401bce716fdd16279a686f830121b9ba", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052892, "uuid": "1e2d1f4f-f3c2-49b4-86dc-6dca8caf0b98", "comment": "Malware payload (PureLogsStealer)", "value": "a1c094729b32049aa30496a062eaa5d3d4fffbaac28ef5864fbd1470c22deeb6104b0f0520e139f9579127ea61308360", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052892, "uuid": "dacd8f38-8abc-4baf-b30c-255d37b297f9", "value": "T170E4769738B8C7A5C4BFA733818069A3EE7C06D6916235CD083C6D411957FAAF8B509F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052892, "uuid": "88922ba8-ff9b-4023-b56b-86d61e6bcd52", "value": "768:eC4444444444444444444444444444444444444444444444444444444444444p:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052892, "uuid": "b15a11c0-0812-40db-9646-34ac480cbab9", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052892, "uuid": "a8309388-1584-4d2e-860f-93d92f36aa94", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052892, "uuid": "ad31a3b8-f277-41a7-8417-9f43f408b5bb", "value": "ordinazione d'acquisto_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12a8237-dbcf-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1766034525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766034525, "uuid": "20d6ed88-7f43-439a-b1f4-2c7cc94248f5", "comment": "Malware payload (SantaStealer)", "value": "95143cac1bf31faa2847ce36c39e8359", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766034525, "uuid": "8c0e4716-563d-4d67-a554-b11478b92770", "comment": "Malware payload (SantaStealer)", "value": "62997f61fca883fa2cfde6dad151414f4d88b9a0b873f89530130a408432907b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766034525, "uuid": "fc428a42-bbd7-4946-9b83-88792acb3c02", "comment": "Malware payload (SantaStealer)", "value": "79804fd37ac1f941336b8cdeeee01ec2e52385f5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766034525, "uuid": "7c56bde7-e02b-4256-91f1-d0c4f274cac0", "comment": "Malware payload (SantaStealer)", "value": "32473ef57324ed4e055786336f3893838eaacc2f595536bbf3b5b5218587f3d66884e4f325b4d4df631d2c6eec07b2cb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766034525, "uuid": "71961af8-07ce-4e20-8b23-f45ec75b84ef", "value": "T12F46331A445161F4D4826D31721CF9D5D94A38B30E4A3A710C0BC7E98A7ABD7EBEA34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766034525, "uuid": "954b003e-9a4a-416a-baae-71ee7112020d", "value": "f9db5504500e175c232f6b93625ce8e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766034525, "uuid": "ac074e7c-4c8e-437a-92e7-091b8b644eed", "value": "98304:v/5vOjkGBonqBV8mgTF/bjr+siIWWRGX1Nngut0Oz3/oFOL46joHJD/7HhHf7LS3:vlOgwoD07GRG3tJoW+hHfH6w5Wmyw3ZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766034525, "uuid": "ed0dfb47-75bd-47d0-8498-acf9ed3fe01a", "value": 5551104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766034525, "uuid": "4cb74401-0fb6-4b6d-a0ec-8892fa3ba529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766034525, "uuid": "4725b471-e923-46f3-9a70-0faec2383c92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d2115d-dc34-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766077892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077892, "uuid": "0cd348da-9919-4aa8-971a-e9ae5ea2297d", "comment": "Malware payload (Formbook)", "value": "6869fcd799d243f74710b53ae3defb9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077892, "uuid": "3999a5e5-d157-45f3-a56e-c09cee2b121b", "comment": "Malware payload (Formbook)", "value": "6325a13a3b911eab20e247ff0741dea0196593a4892680ea3d494ec81942dc34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077892, "uuid": "6b04a5d6-c6af-41d3-9194-89282e78e614", "comment": "Malware payload (Formbook)", "value": "f48a4ce366f6ae1143c4173ad3a3bcfd04c29967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077892, "uuid": "b0bb8010-9b33-43ba-bbc0-f1d0ca7e5cd7", "comment": "Malware payload (Formbook)", "value": "4f29bbe6ea6748e8ece4e35c7f116a4fe92c01fdb814718843a70547fad994856585f5e0ff00b39c3866dce016403d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077892, "uuid": "c8101ac4-cfe3-4793-9bd4-057355f474c3", "value": "T1BD45CF0273D1C062FFAB91334B5AF6115BBC79660123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077892, "uuid": "382b959e-8f54-48ec-bfe9-2d08d78abc69", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077892, "uuid": "06efa882-1b8b-46c1-8867-f21330a2797e", "value": "24576:Z5EmXFtKaL4/oFe5T9yyXYfP1ijXdaf7PENyIL8fth:ZPVt/LZeJbInQRafDILA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766077892, "uuid": "eb42ca87-7b29-4c33-9d2c-50772006a609", "value": 1264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766077892, "uuid": "5156167e-989b-4dc2-96af-1cbbe361c630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077892, "uuid": "f7ebd85b-41fc-4985-8e3a-f9d2da6eac0b", "value": "QUOTE FOR CISCOD-LINK-N0125111007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2c61bb-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041686, "uuid": "5bd812b2-aca6-488e-97ee-6216ab118cbd", "comment": "Malware payload (Mirai)", "value": "60b84b3f06fb5b994e4c3f7bdfd868b8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041686, "uuid": "415fc217-5ede-4f10-a6a0-7011d8897d95", "comment": "Malware payload (Mirai)", "value": "633c48ec794472eb428b2e0f3f5efd04cf6b1d961ffbcc3a0df5110b5fba6075", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041686, "uuid": "5c915d5d-dcf2-4fe3-b29e-a3ca5a3fce82", "comment": "Malware payload (Mirai)", "value": "58a82da7781d213b4c474b779ca7f672ce495105", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041686, "uuid": "d8b24051-5543-4e52-97e7-f51a64e8a136", "comment": "Malware payload (Mirai)", "value": "aa6fe188d394177d10b838f023ccc460053586fa2c9f725a3c3647323abd6d1943ee07d75d764f8ef639f9debfaceda6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041686, "uuid": "8d23cba2-4d28-48e6-9a5e-384147126374", "value": "T16451EBFD3A6167374545CF47B1B25AFD702BE8C854908F58A69E34E8F678904B02163B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041686, "uuid": "b705d715-5d74-49fe-b87a-71d2f59f48e2", "value": "24:Qva5EMy0MBy5qiPomoTgTCEi6Xk6KXRCm5emi3FoyFoToZjZCUgHfGgHf6v+0+6s:Qva56aoQN2ThHZHSTWOntli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041686, "uuid": "6f34b9d8-571a-4cc7-9bab-b45c6b368213", "value": 2453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041686, "uuid": "c9ca85e4-d06a-46b6-aae8-2665ae9e2eb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041686, "uuid": "0531ec87-4320-45d1-b926-dc9da5de5f1e", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74fcda7-dc1f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766068895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068895, "uuid": "4a36607b-c098-4b04-bbf5-b36975a5e0ca", "comment": "Malware payload (Mirai)", "value": "d7d218706c9bd1608d15789f259b5b16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068895, "uuid": "fc76bb8f-f516-43af-8d8c-74d065eb57e1", "comment": "Malware payload (Mirai)", "value": "63b5f71387cdc1811b7b27eb4a8f058daf36fd95639efca60f42c5c962035780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068895, "uuid": "95c21cd5-df78-4b61-9eed-42cc58e27f3d", "comment": "Malware payload (Mirai)", "value": "3e214f7d1866d841c509ab38020cffc539d80ca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068895, "uuid": "6605be28-6d0e-4bcd-8d51-9deb7bce42f5", "comment": "Malware payload (Mirai)", "value": "b3cccfb414ffc449696c240cc7fe4ec1f9e1e7614c4ded041d0144f5ab6d13b5023a2bfba3801d5b6762a04c563fffa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068895, "uuid": "e2712695-524d-4486-924b-f32f5cb9d125", "value": "T182E33A46FB804F13C0D61776BAAF4249332397E493EB730699287FB43F8669A0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068895, "uuid": "46bfff0f-f902-41dc-8039-f073a5b83409", "value": "3072:DVtbZqT1YMAip9a6TWSn83iaaJuXE95dwbZnIcXy0+M/9SiIC:DVtbwSLs9a6TWSn8SaatjdwRIcXyFM/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766068895, "uuid": "637a1948-d54f-4eea-a72b-754ff93d59ee", "value": 154968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766068895, "uuid": "e7c36269-11d6-408f-90aa-0fc9c849f542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068895, "uuid": "541920e3-a090-41a4-81fb-c332f5000fc5", "value": "skid.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c604eaab-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085268, "uuid": "7a6ac307-d4d4-4d62-b3ec-2edf8e105794", "comment": "Malware payload (Mirai)", "value": "ad751d1b1e13364ded2924a886d0c1d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085268, "uuid": "af886e92-5e30-4452-9eb0-a1b824c434b8", "comment": "Malware payload (Mirai)", "value": "63bfd93aae06fec0090d075826bb3e104b21637badd135da22ecbd4462dac1c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085268, "uuid": "29c7f01c-d214-4fbf-9d65-85eb396bb883", "comment": "Malware payload (Mirai)", "value": "55aa75c69b47601e380fe46328524ee2cab2e74b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085268, "uuid": "0f50ba1d-8a7d-4373-a00d-20f019320492", "comment": "Malware payload (Mirai)", "value": "bf339aa4706f4aacfaddeef6d04db44ad2852ed6695c75130c549f35e1423183c7fc0a627305c6ab40fa10e78b1bf2c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085268, "uuid": "5b7c9e14-1090-4091-b99b-9c3a930ddd4e", "value": "T10943F19D92EC6CF1DDBEC5A42954D3B077E11CC7379A8FD202A0A663E86602C511EFE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085268, "uuid": "5b48af70-ae30-404e-aebf-7057db4901b7", "value": "1536:+0rOiVcFR112ojmsi6cEWHPAk6DI524u+qgw09C:MFgojmsi6cLr6DIw4u+qgwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085268, "uuid": "73997c1c-0bdf-4d68-aa31-3804d3378ffb", "value": 55796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085268, "uuid": "a29abae2-3793-4b9d-abb3-2c7cd9ba1a71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085268, "uuid": "c542cb1a-47af-464b-8b73-3adaf07a8cfa", "value": "byte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6681e7de-dba9-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766018106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766018106, "uuid": "da6bebe9-5bd2-42f5-9281-687132dd338f", "comment": "Malware payload (AsyncRAT)", "value": "1d9d2e054a611fd8e18fec5d2b0542d9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766018106, "uuid": "2a0c4803-d3d4-4ba2-9768-30e0aa2c03fc", "comment": "Malware payload (AsyncRAT)", "value": "63e46d79684b1b4bd8b270b566466f330ba07fe8486140377b510f9cd8425e3f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766018106, "uuid": "539fcf8b-7cf8-4adc-bc90-414ea10071d8", "comment": "Malware payload (AsyncRAT)", "value": "4cf9679d8fae05e1957c7f0b2c6304b6254472c3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766018106, "uuid": "edfd5b74-1b11-46d2-9de3-f09a4fb495ac", "comment": "Malware payload (AsyncRAT)", "value": "861d1efb885ea3d836b1579b6d16afde07e3c5269b9bd60ce57088ed4167d6429aeb09493acc6fb6b6ce05aece8abc0c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766018106, "uuid": "25c0cfc6-9daa-488a-8c99-b68024cafe24", "value": "T157B3E9143DE75025F5BBEF74A9D075E289FEB7633A02F51A08A642970A13AC0DD43CB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766018106, "uuid": "05f194ab-b001-4dd2-baa2-72d6d4689236", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766018106, "uuid": "c8009fdf-f6b6-4bba-b2c5-f5895521ae3a", "value": "3072:iRQIAOdQygeEuH4iOnF+lvlTqbhCIObOZVJd8e8lXQ:ZIAOdQygeEuH4ifVqbNOu8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766018106, "uuid": "4aecdffe-5bd8-42d9-8302-708835009482", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766018106, "uuid": "1e3b2103-7441-4e22-a4e8-56e73feaee7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766018106, "uuid": "b8c50cbc-1e76-4bb9-a158-1c432449bcd9", "value": "1d9d2e054a611fd8e18fec5d2b0542d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a30b6e-dc03-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766057007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057007, "uuid": "f5911bc8-2b38-426a-a396-1808ee916b51", "comment": "Malware payload (Mirai)", "value": "4414cc92d140e1221cca9aec33f78b9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057007, "uuid": "f0fa4edc-b698-4978-b9da-117b8c1c46e3", "comment": "Malware payload (Mirai)", "value": "65d2be5b66b37f82babebccdb45795b3e6920a05d64de7c3a202504cd77d6796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057007, "uuid": "00d9eb17-2e5a-441d-9105-fd4c37f96b98", "comment": "Malware payload (Mirai)", "value": "1233645dc1cbb28f291a36b176a89c6d4abc21e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057007, "uuid": "23b0a69c-99f7-4c2d-8ea6-4491fed0de46", "comment": "Malware payload (Mirai)", "value": "19ad834dac12a9f463178727fc5d612edc9f39cba7293788cce443d772e07bdd5cfea948cf724ba57c5d0394d12f8c53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057007, "uuid": "811789ce-a2a1-412b-8b01-3ab76b36e541", "value": "T139833B42BD819F13C5D222F7F7AE418C3725ABA8C2EB3142DD25BF91378689A0D67711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057007, "uuid": "8d48e685-c3ca-4e2e-90a1-15d00e913ee1", "value": "1536:nbNO7EBZJ9DLHZgq0aB2iU2MCi3fTzvoAswoXewWv2l61d63tP:nbn9gh0PGCWfTTbRz24KtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766057007, "uuid": "455dbf56-2f3c-4eff-bbd1-4305e473ca7d", "value": 88336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766057007, "uuid": "dc87cc6e-24d1-4c73-a1ae-9c2d60db2090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057007, "uuid": "70068551-ad1d-46ba-a520-d70badfa796d", "value": "nova.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7827e8-dbe4-11f0-a129-42010a9c0007", "comment": "Malware payload (RondoDox)", "timestamp": 1766043320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043320, "uuid": "a54f0911-0638-475f-9005-165b14398080", "comment": "Malware payload (RondoDox)", "value": "6108d299e12cbb1c77031ed68e1d4127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043320, "uuid": "e35129b3-803a-4c8d-beab-79e3652cc39c", "comment": "Malware payload (RondoDox)", "value": "6737e4f5d70fd165a8ec3b4d17174d8fd2ff03b703c33a521f52378ac586ef02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043320, "uuid": "1af10b07-d793-48c7-803b-95d49bd6cd26", "comment": "Malware payload (RondoDox)", "value": "66861b74709e2ae666c3f6a8926b7cc6a25df1c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043320, "uuid": "232760a7-dec4-4caa-8985-a357edf725ce", "comment": "Malware payload (RondoDox)", "value": "b78642f13cb8d1c23df74441bc68ddf9165604d950df14827da473487fc3de4cd01fac24e1dc3246c0f2f77113c63f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043320, "uuid": "0265acdb-b209-4bf9-b793-10cb75e5d1f6", "value": "T1CB94D056E3202A97E51A8135588147446B84AEB573E2D302FFA3B17E302F5F58F287DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043320, "uuid": "ed93d230-0276-44ec-bf5e-002c2dd2185b", "value": "12288:C5D+6n4Xslor5gUNn/T52rk9av/KpBSyb0U9zgc:kDrkslO+UNoi00x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766043320, "uuid": "b1fdf641-05ab-41cb-bf2d-29f140c2b78e", "value": 426688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766043320, "uuid": "b1068a7d-8215-482e-9d07-4e68b38db130", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043320, "uuid": "b3b9e5d8-b532-4e4c-886f-d85412d33964", "value": "rondo.armeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e82ad6-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085325, "uuid": "db24569a-9463-4893-baf5-863d290daa2a", "comment": "Malware payload (Mirai)", "value": "0a34f79e14bcfe472ec4334d8c7c6272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085325, "uuid": "ad76f4a8-65eb-45d0-b92b-451e31046ef5", "comment": "Malware payload (Mirai)", "value": "681a8267fb9afe849646ea2f01a24103d34c20cbfde23f9182946cf323972c71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085325, "uuid": "fdfcf418-6918-46a7-a5f4-9052a5c50b77", "comment": "Malware payload (Mirai)", "value": "4dac87bcd494d61b70735b97191bf044a3214441", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085325, "uuid": "d539142b-155d-4bf9-913e-a910ea0907a1", "comment": "Malware payload (Mirai)", "value": "bce44344167ee9cc943aadeb6a08fb0d4208c7419f222b90152adec7d97a7317c8e30054a1ff33ef1b0bbb48575d7094", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085325, "uuid": "3df801ab-36a2-4b6d-8906-417a0d9da15a", "value": "T172E34B07B5C0CCFDC4D9C1744BAAB53AD971F46D0238B26B27C8AA225E4EE305F6E614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085325, "uuid": "d97255d1-4a75-4335-b4d3-eaba6d2ff0b3", "value": "3072:rt5WhuKwvm1QNfNWxX+xa6WChTa0200GAg2QeyOYAtmSKvc2:x5WhuKwvm1HTETMG2YJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085325, "uuid": "e790acce-dbe9-4bbd-baef-7183f32cdeee", "value": 155208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085325, "uuid": "41477c72-edac-4e68-84a5-9a988c11bf8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085325, "uuid": "6f8a49c4-2f4f-4383-a5cc-630e525ec5c5", "value": "byte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188b8937-dbfd-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766054053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054053, "uuid": "25b2f62a-ced7-4138-8fca-b8e1b3b4c083", "comment": "Malware payload (Formbook)", "value": "9213c972362816d83f54c398c6fb41c5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054053, "uuid": "38016e73-206a-4a1f-8c3f-d3636ed092d2", "comment": "Malware payload (Formbook)", "value": "6b1107e6d61f663df5812b38808fa5741333babbb7120768f2adc1dd6afaf8eb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054053, "uuid": "57bcc827-0533-4ec3-adef-6860deca9927", "comment": "Malware payload (Formbook)", "value": "493241806eb28e801484c3a643de57ac1f59898a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054053, "uuid": "a9e35673-1e7c-4e1a-a218-b75e6a970dfe", "comment": "Malware payload (Formbook)", "value": "b84d9bca8019a8315655c73e3e0760159d23becbf6ddae60e0079cfe16859eb9a00e0d16d806911194f3b62d5f2a9d44", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766054053, "uuid": "6ae9f875-4b80-4023-a869-bdc2f35ed158", "value": "T1ACB4233C96CE05985F3AF0BC75E10F48E776A126A20E1DD53A1D6319D8488F2D85E8F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766054053, "uuid": "96bb20bf-e133-41ba-bf26-0941e2e50464", "value": "12288:YNPlTfMsmv253gCaV0kprsBhLDCkP8z/yAFOYdHgRm:adLMZ+WxVXxeNtU6YdAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766054053, "uuid": "02785cbb-290d-45d5-9f3a-f18a7f0d2e87", "value": 516271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766054053, "uuid": "57a5d0f3-1f9c-49ae-94d9-3e5ad4b78e82", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766054053, "uuid": "faf6f74a-75d1-4b31-b0bb-22a4af85ae98", "value": "Purchase Order Specifications.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd942c60-dc06-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766058303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058303, "uuid": "5ccd6f7c-156b-48c3-8e7d-eae9e7bfbb57", "comment": "Malware payload", "value": "b627f85fa5994ba7eb2630a09cd8873e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058303, "uuid": "f3d7bccf-d1a1-476b-9325-3d5745e77789", "comment": "Malware payload", "value": "6bc0098c4ba9e7f1cbbb0f107cb8ff561bcb98beb637e9b8950705d766245160", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058303, "uuid": "7be01a8b-7e7a-45c2-b25d-a745a70e48cc", "comment": "Malware payload", "value": "8d7b17566adbe135118a39f4addf9d0cdb8aca76", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058303, "uuid": "4ab2eec3-af6e-47e0-b880-4a8db3df3ec0", "comment": "Malware payload", "value": "1e1671dc9da34cf1090d9b9b5229725d98cd34bdaa01146f9bd25f8e4a18de297e449e04bd1808e5e84be007a9c67553", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058303, "uuid": "c14a2252-93b3-4323-a4cf-49894b2498f5", "value": "T168C61282B7289F2ECC7744730DDA5271225A4C678E8297177948375D78B3AF80F89BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058303, "uuid": "fb6045c6-fcf0-47ce-86e2-6edc4841f082", "value": "196608:YjUtjXzKv28KbFXqT+3tLHEFEs57NkJCF+aG+2k4gUdtxEgQifVdZgdlw5uuMCT0:YjU0KpXAsor7NkJWk3HxEIVo8Xtza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766058303, "uuid": "50da1171-5dbb-40a1-82d1-7d0eccfe79ad", "value": 11673354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766058303, "uuid": "61d81afe-749c-4858-8927-e0db70fb5028", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058303, "uuid": "1c88613f-c4de-4e4c-814c-8005af42fa07", "value": "inat-box-v14.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993f14aa-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052980, "uuid": "d7bc72a1-7e1e-4da6-bc54-a2374e970302", "comment": "Malware payload", "value": "27d26c09a3a184ddae27c13938cbe290", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052980, "uuid": "ab047d33-2548-4327-8725-00e1f9df260c", "comment": "Malware payload", "value": "6da4e49a33c0dba408047971bd0688676f677f4323e6a5692804790b54cbca27", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052980, "uuid": "26d9ca68-e17d-4885-b081-4e51f32e2b84", "comment": "Malware payload", "value": "d3f283108eeefdc2218a75e8ad179335ba45c6b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052980, "uuid": "95f4f781-970f-4345-82ce-4f188ddb095f", "comment": "Malware payload", "value": "08c28c285c33ade4fb650b7f4aaade188d9c8b53ff4b978b1b3821fa61469a56fc606e7bd24236e36fdd3d2cb5f1bf14", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052980, "uuid": "98dab636-aa9d-4b7f-b70b-b59b7cbc0b34", "value": "T1DE26E49CB53B244384D5A975CE10F922AC7DD2432A3B0C537918ECDFDF312E9781AA69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052980, "uuid": "48aaa3bc-bf2e-4aa6-a528-49f318754927", "value": "384:71TpR1Tfj1/zR+Q4IE0pR4ANY8tpYugyUupDRS/hJ20pR+0FjiTx7Spp7HgCT1Tj:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052980, "uuid": "31789400-4f8d-4e83-bf46-f9ae731b2fe1", "value": 4423725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052980, "uuid": "22e23dbf-72a6-4a41-a01c-f5c6f1f9203b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052980, "uuid": "0f28ca6e-f851-4cae-bcde-e7d73ecfca53", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e656a0b1-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085322, "uuid": "83b7426c-b61d-49b6-82d3-dcbc7c276e47", "comment": "Malware payload (Mirai)", "value": "351c8212dbfe33a1ad7de1b90e3294ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085322, "uuid": "ef3d590f-77d9-4b84-8763-dbf0dcd759ad", "comment": "Malware payload (Mirai)", "value": "6de6ba4f5175c34911d9c8d35742d9a5477a0d0fd29cad4f7c87653d1ba55524", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085322, "uuid": "cc980801-899f-42b7-b2b5-61681024fdd1", "comment": "Malware payload (Mirai)", "value": "d665b7ee82d4188a73e3f881ed1a4251f7e2602f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085322, "uuid": "880a2d5c-8f69-4707-b79f-00d00ea381e6", "comment": "Malware payload (Mirai)", "value": "1cdbf877b21983a84fdb5bac3e3f0436de3cb4fab1c7a87358b3aa3e2daf4feecb7cd3d8d9399be6d93782e408725396", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085322, "uuid": "e5e9d32c-a4a8-448a-a62c-004d90163de0", "value": "T1E7E32B02B31C0B47E1632EF43E3B17E093EFDA5124E4FA44655FAA4A5276E32154AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085322, "uuid": "9e01aa76-7118-44a8-b28b-1d7407379af2", "value": "1536:i/44S1ULRR6FkowIixd6dTfmJrfBk5J4kanb0uBmQ/5tivABxThx9yya7CqcYMld:WRRsZ4xoE5BaynnbdB79BP4GQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085322, "uuid": "28ae64bf-2257-4a8c-bab1-ad2e61fba37f", "value": 148292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085322, "uuid": "4dbb9f5b-487c-4179-ba41-0bbbe64ed0dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085322, "uuid": "9b2259da-cb1e-48cc-a335-1b1070141e7e", "value": "byte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46a34d2-dbcf-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1766034558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766034558, "uuid": "5e48aa56-7136-44bd-ac7d-acab4ddea14c", "comment": "Malware payload (SantaStealer)", "value": "96c71fcb8c1642af13da711e8e14fd39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766034558, "uuid": "11831b81-b0f8-4cb0-89b4-3c33be836ff1", "comment": "Malware payload (SantaStealer)", "value": "6e9456d74c1bd42aee0d5b7df81efb80697bf5e7a5ceff9500fd857604c56aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766034558, "uuid": "0fc64b9d-8f36-4a72-913d-7ab2d1e356ef", "comment": "Malware payload (SantaStealer)", "value": "6b8180b5819f40287e2880a510831e49e7b29ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766034558, "uuid": "d17d5406-b3d1-4f4d-a782-53e8d5e4d845", "comment": "Malware payload (SantaStealer)", "value": "1924c8762145b7790f1ce2c644a21c3b6b00991fdc3e9c7ed44aa8c6ff988b205d8646befa0fc44d8d414e4258ee7dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766034558, "uuid": "82eee04c-86ed-46cb-8492-6432eae7898a", "value": "T1B2560217E2A360FCC567C1744B6B9672F931B85941347EBBA694CB302F21E606B2CF25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766034558, "uuid": "c52ecb78-71c8-474e-bf5a-f441b208164c", "value": "4a5d8453afe14087f629e7a76c194640", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766034558, "uuid": "040db69e-124a-4102-8646-571411a2144f", "value": "98304:mgO4vVMsqPL3Z7NwbtdseSQemF6U3tcbQLxp8j5D1m96GpH0qD:ASMsqPXWdKcdmbQVpG1bGpH0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766034558, "uuid": "15aa685e-3e6d-4061-b256-4987806d6202", "value": 6192128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766034558, "uuid": "379fd47a-fff6-4d64-be59-60c097f755ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766034558, "uuid": "78c2d215-b71f-482f-9569-65b7dc6b7b2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39f083b-dbec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766047119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047119, "uuid": "a84a1be0-5461-4127-8e07-b8b2cb2795dc", "comment": "Malware payload", "value": "b0390d385f92f5066ea2ef9a34bb63ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047119, "uuid": "f845402d-bc0b-407d-a3e5-11a21ecfb6b1", "comment": "Malware payload", "value": "704c9531153cd455643d38ecb1f3090d329584b22747e728c953a9d1e5e3e491", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047119, "uuid": "51a8c6d0-6482-4d63-8baa-45ea1ed48ca4", "comment": "Malware payload", "value": "593e7fa4b457e04eaefe17df291badd0f60beff9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047119, "uuid": "a7d6d30b-5f74-4a2c-a036-5da99697b9da", "comment": "Malware payload", "value": "01bdf838ed1ede8e082a31a6ee2bf48662db499ad2c7dabab276d0a38f99dfd89d6ce60ef9e62f07dbe533bcacbf93bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047119, "uuid": "79375727-06d7-4e5a-ab2b-f090e551d326", "value": "T17EE62813FA944AAEC664D17589AA02C17774FC442F27E7C35A01B63C7CB22F9AEB4345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047119, "uuid": "48981a8e-8a24-4914-81fa-cf77956179ec", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047119, "uuid": "daf57757-ec3d-464e-a14d-865154d06f7b", "value": "196608:LtqY+GIjAe6/I4kGiRREkc44WKmgLgmQw7RRUahRfRTmp:LPIUe6wRhDH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766047119, "uuid": "25d3ea8f-d07f-4b1d-a13f-9ceffc944ad7", "value": 15088321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766047119, "uuid": "0631f4cf-2742-4fa3-a9f5-6a4693b47d80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047119, "uuid": "db5e3b53-7f66-4217-89e9-318f8c21813e", "value": "mozcrt19.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277a7bba-dc23-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766070399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766070399, "uuid": "bcb49419-b8b7-4ba9-8427-0c8eb3d27eda", "comment": "Malware payload", "value": "55b4616ed45adc4e63e6324c16d25607", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766070399, "uuid": "c818482d-52aa-42ea-b51a-d9ddc35357e5", "comment": "Malware payload", "value": "706db678b85d7dc979d8482be893a247e8d1af5ae6cbcca717f832cd9a8f0330", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766070399, "uuid": "eb2701bc-23f3-4494-bc87-c95fdd246ccd", "comment": "Malware payload", "value": "d536420be1ce846a935cd6ec111edf677f065391", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766070399, "uuid": "d0435ba3-840e-4d82-ac72-88e12c5d5dc7", "comment": "Malware payload", "value": "119f17ff319dd2e4c4441a9463ff9553a9c40a54d0ad4dd32f546742330e69193a80c93d3b6d4ab316208c785bcbd65a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766070399, "uuid": "3b209634-15ea-4643-a427-34032481e4d0", "value": "T13B07336EA490CF5BE231867AD95A6BA09123FC5C1F848C62D9ED31E5E1F132931B34CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766070399, "uuid": "136ab9d8-7577-4795-8c97-8510ecd1a87b", "value": "393216:h8WAhZhdgSdrsJl86cdarKQA/vJn938E81HN:O/PdrKl8la9A/Bn9B81H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766070399, "uuid": "c84e4234-3874-4842-b740-10c01f8ca729", "value": 16912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766070399, "uuid": "a4efc74f-7e4f-400c-8739-b8a0a69a0883", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766070399, "uuid": "20a25150-4c3e-4ed5-9215-abcd708ec689", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68359bfc-dc61-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766097136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097136, "uuid": "d9a3f29a-a049-4cf9-8cdd-210b89f8761f", "comment": "Malware payload (Mirai)", "value": "3ba2f54d1ba7ba90b5d9d5feda908ef5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097136, "uuid": "92cdbed6-92b2-4bd7-8032-df2771db8ba1", "comment": "Malware payload (Mirai)", "value": "723a53477724f73376409cb36fe18a1d07c6992072f06816204f2e4802437af9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097136, "uuid": "3ca97b15-f792-490c-830e-e45368586b02", "comment": "Malware payload (Mirai)", "value": "224b8cbd1d285faf6c7bddef6656cd84e3cf5522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766097136, "uuid": "1076dcff-3cac-4c76-863a-582294bbcac4", "comment": "Malware payload (Mirai)", "value": "b69214aacff5fecf4b2f458bb5f73869c59e4fbc8f3eaacd5708494f385a7f842b57592a1b36e864f9a716ec39b42ffc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766097136, "uuid": "d8b20575-e824-44c8-a6b7-e037e7a76a05", "value": "T16A149E32D839AED4C2519874F4F5CF741B62A99042072FBB2AF6C5B5408BD98F90A7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766097136, "uuid": "81c217e5-2fcc-4267-a356-81c6378c28c3", "value": "3072:iPGsWxyBRwTS1EOsuH89XfiydCEIQgRNFJtU6eFWeKb5IFK:iPLWgXwTjuHYfiydY1Ju6eweicK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766097136, "uuid": "88f79548-a79f-4ed5-bba6-eed896e4d350", "value": 203144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766097136, "uuid": "f34b0419-19d5-45ae-a1e2-e48cf6b1807d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766097136, "uuid": "371f9e71-4a92-4497-be43-49ef67a2ffc5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b87afaf-dc16-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766064768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766064768, "uuid": "fb850e23-ed5c-4907-883f-0b65b84f1882", "comment": "Malware payload (Mirai)", "value": "98eebed7090db1c05793ef3ba479a397", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766064768, "uuid": "28627257-7476-4647-92ff-57da9893a1cc", "comment": "Malware payload (Mirai)", "value": "742175100b5a87773d24702aaedf8d01da5c55a73e6520f1ffb40a90fc4e8e31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766064768, "uuid": "2950971f-f68f-43a8-978d-349dadc3f24c", "comment": "Malware payload (Mirai)", "value": "d707fbf3a6a9b0ac63c88bdb87d7cec1bc846ff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766064768, "uuid": "3fedab91-f673-423b-9a86-c2c7c6de7387", "comment": "Malware payload (Mirai)", "value": "f50d456796cf763d602b562c3d4f3ffaa2ee5b96630dd55823452cfda1b3eb9751ea744f3cab58c718af7c21322c76bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766064768, "uuid": "506ca1ba-f894-424f-b857-f5796f4c16c2", "value": "T1BB832A52BD818F13C1D222BAFBAE418C372577A8D1EB3242ED257F90778689B0D67711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766064768, "uuid": "7395302f-f7bc-4e8a-acc7-4aa53ac3b215", "value": "1536:brdc7OZJtDLnzAg0aB2iU2MCGiFy1R/FDVJsT8PRJShl61d63T8wFSP:br5Ar0PGCGoy1R/VHi8ZG4KT8wFSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766064768, "uuid": "1f22e55a-0e09-4532-9483-ba702793a47f", "value": 88336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766064768, "uuid": "f278fc10-92d5-46f3-bc79-1bba7d4e27d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766064768, "uuid": "1e1eeb1a-2327-4049-af31-275ffdff6ca4", "value": "nova.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc1040c-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052984, "uuid": "8eed0c30-65c2-4af4-b98a-4c9eed4052bc", "comment": "Malware payload", "value": "a4b4686119c790bbb00e80b7aed2da2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052984, "uuid": "647b9e9b-86f4-407a-b5ca-50a95f4fc14b", "comment": "Malware payload", "value": "743ee294d9419a39cb0d15ad32ced4d3d78886eb98e34a39bfea2856b51b8295", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052984, "uuid": "de9d12a5-b0dd-4ca2-b31f-a25f64ccdce7", "comment": "Malware payload", "value": "8df26161f402b2c35fbc9f448011a1fa3fbc9141", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052984, "uuid": "52f12d98-9bc8-4211-86ae-ca6db9b96422", "comment": "Malware payload", "value": "d44d702b45516caef7c5a526f2db056812469b4907ffbde6b2e365f68dbd1a4b056b10b16d3c14ead105bb369d71f49e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052984, "uuid": "9501e35a-e3aa-4040-b286-9ffd5dab590c", "value": "T16ED3734062C1B8A403971F76771FB8D5FD3F09D93498498BC161FD90B9B5B0AEAE0A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052984, "uuid": "f84172e3-9feb-426d-b27f-239ae7f4ece7", "value": "3072:YbBpBN7kiBka+7xrl+NU8HJBeSZ9W2tmkZJCatDo+tvOmenvWMRaAS/US:YbTBdkiWa+7xrl+NU8HJBeSZ9W2tJkad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052984, "uuid": "9c5217f8-cd39-41ed-8ed9-9cccbfaa889e", "value": 142112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052984, "uuid": "fb033775-ff94-45d0-8075-f7ee8d02cd83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052984, "uuid": "672a8392-a71c-40dd-a09f-46b91bdfe634", "value": "shipment details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21809a15-dc1d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766067812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766067812, "uuid": "746c6e7f-723c-4c4c-8029-d34c2db804c2", "comment": "Malware payload", "value": "11efff600b9fb06274039e6b07dff1c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766067812, "uuid": "e7d8eace-1579-467d-b027-6039e4b4675b", "comment": "Malware payload", "value": "746d8bcbb79a9e0e030f5353ff26bb5851c81a7311d3679aa4a4051a1b4abb69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766067812, "uuid": "0f746183-525e-428c-adb8-fd155b1679f1", "comment": "Malware payload", "value": "bcf265a0ebb72848b83cbcf0723b7904acdd1fc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766067812, "uuid": "0c1e96df-b872-440e-afa6-a96440a9f2cf", "comment": "Malware payload", "value": "1632649a5ae0f4e36e86fe7cab01bb0a6bbb908e3e59fcf35adf7b0505accf10b2d76c9fad53b7349afb21b55b6d560f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766067812, "uuid": "2fbb0566-d117-4ef9-b3bc-3416cefe99eb", "value": "T1F7555A25729801ACD17BF0BC89560A27F3F178051365ADFF2AD0CA722E57BB55A3E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766067812, "uuid": "44c94c79-ee99-4075-90f3-2eddc87e8faa", "value": "77ea498ab4c59d017cd6a85eb58a7875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766067812, "uuid": "7b16231a-c8d7-4d39-8293-ccbfbde904c9", "value": "24576:LrRAcl6kQYJje4YtB20shAwGEtpHrzMOF4tp1nZjc:LrRNsk1eft1WJGEtpH0Oqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766067812, "uuid": "e049db4c-fb51-4d7d-9a0c-62558e8b4c9b", "value": 1357312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766067812, "uuid": "6cd30289-8bf1-4479-b26e-1f789945a03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766067812, "uuid": "d8034c25-2223-4b59-99da-798ca545ae0b", "value": "pconsnap.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891ee816-dc1a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766066697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066697, "uuid": "88bb4e1a-a987-422e-912e-7abcc13e6b4f", "comment": "Malware payload", "value": "ec5c5be300b43acc6ce3687f080f39f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066697, "uuid": "1dcafba8-0243-4948-a7f6-d0d9c04df391", "comment": "Malware payload", "value": "74742b207d38d5a8520d69e9b75a0a510c41e065c0102253e650d9cdb196e4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066697, "uuid": "ac97e6ea-f1a5-465b-af7a-c64d0db2bf6a", "comment": "Malware payload", "value": "745ada9e165f459429e8f75a4f6218c0f709adf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066697, "uuid": "91647204-fedc-4df4-807e-03faa99c9a14", "comment": "Malware payload", "value": "45addbff11b00367ccd66217a6e6a77490e0608829e2b92c7845f7d5b09c4125a954923fe2387ce4c64565f28e998a3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066697, "uuid": "b26dbc20-a2a0-4a39-b7af-876b9c691268", "value": "T12E462208DA9005B8E8AAD7348AB3CC36DB33BC5D4670A65E13EC7D673F772914929712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066697, "uuid": "748439fd-2818-435f-9017-d0e528ddea99", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066697, "uuid": "b10ef9e6-ba0a-4bb1-a6f1-25ab1c25e86b", "value": "98304:HvOJAp2ODW6GcRFtd7bTxAOsssBp6UYuPoZcBaO/j8568z6Wwumw32dVHrSbm+M:2+/AYlNAOt+kU7PqcBP/jE68z6WTn30t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766066697, "uuid": "b422af60-6fb1-4c66-88e2-7e643ff62014", "value": 5673296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766066697, "uuid": "877ee3c6-24d8-4d5b-a3b6-4e7257dc9adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066697, "uuid": "c5d0b165-21e6-476b-a6df-87d6a9855c7f", "value": "RefundPayment\u202efdp.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09701a2-dc3f-11f0-a129-42010a9c0007", "comment": "Malware payload (BazaLoader)", "timestamp": 1766082628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766082628, "uuid": "9456ea5e-3edb-41f7-889a-8b1fb1cbab80", "comment": "Malware payload (BazaLoader)", "value": "3775785ad32200f185f3a01af08dade2", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766082628, "uuid": "bfa32233-1305-4cf3-a75c-e37d7d9e29ed", "comment": "Malware payload (BazaLoader)", "value": "7523479202d7988b078102bc299ba810280ae49944791a125d821a5dd19241bc", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766082628, "uuid": "7b27b17d-5578-4b68-8613-acc963a3f8dc", "comment": "Malware payload (BazaLoader)", "value": "49a1252be4d36bf60cb008f55b36596cc25ddc76", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766082628, "uuid": "7de5a3a5-9301-41e8-a2c3-a9a9e3f54164", "comment": "Malware payload (BazaLoader)", "value": "53de8fb02ed18cbdec5d8571750d678b50b8af04e6c114d32a519c67569c9fbfe208bf7457689822dd314a66d8dab445", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766082628, "uuid": "3d4f15fe-7c5b-42b5-9633-544d1206a1fd", "value": "T115963C9399604B6AD5EBF239E5A252867330BC44073124D76A9037E51D3BBD8133BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766082628, "uuid": "b76d64c2-645d-488a-ac50-6e583b2091ea", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766082628, "uuid": "5dc1d9af-dd95-4559-8e2b-cff696496b6b", "value": "49152:KGj4nXrnOih+oqmZH6QR6CJAZ53DUr91qjZ8UMu4S8uN8VyFevG0cNrU:KZOlFevG0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766082628, "uuid": "4096400c-c237-4f32-84c4-496464a7773a", "value": 8886488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766082628, "uuid": "1f51ed8f-0c01-4aa7-a165-8f359d4610bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766082628, "uuid": "683512f1-5bad-45fb-9f5c-e04a4e07a465", "value": "RivalMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba57301c-dbfb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053465, "uuid": "2de4a54f-e48e-45fa-849e-3e88bc6d86cb", "comment": "Malware payload", "value": "8c917d393baaf30087cc8db8911ca67c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053465, "uuid": "c0094be7-3ae8-4e5e-bb57-0a25b4fe5133", "comment": "Malware payload", "value": "773e1359c40e199a9c46a91686b7afabe5cd21c709920177ceb80ac39f4207c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053465, "uuid": "ada1afe5-e2f4-4275-94a9-25d027d2adf9", "comment": "Malware payload", "value": "cc414dddf945c932bfae12c2973a6ab3a9d3d436", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053465, "uuid": "34a51c78-c4f2-4982-8788-39c857d91f71", "comment": "Malware payload", "value": "7248b2f0416d1c9a63988ed9da972c929671f285c7ff3ba2e90218523881f4dda66ec473ed9927a2c006a25530631e70", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053465, "uuid": "1c96c272-54ee-46b9-91cb-e41ad368a389", "value": "T1D72323C83BD2B8B0136270A72D1BB05FF6BF1C44750C50E5D36698C5B96C358D6B6A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053465, "uuid": "0173fa18-34a4-44c0-b046-cce31bf53839", "value": "768:J9Pi+LO4qfnOQTUeFBgaVbY+teF/9m7sLtMfQq8e9t07MS8yt+rIUb:J9PiQDqf2ibonp596rI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053465, "uuid": "7b49e4e8-e807-4fd3-9970-71059d0a5340", "value": 50107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053465, "uuid": "c6213921-fde2-4795-90ad-b3c6a3217059", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053465, "uuid": "3c4648af-e74e-48fe-ba96-f0f99a87b567", "value": "AWB Number 7665278353.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3aba404-dbfb-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1766053561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053561, "uuid": "085036fc-71f3-4b7e-8c5f-b3c75a4f5e69", "comment": "Malware payload (a310Logger)", "value": "32b165cc91f7b42a0b68d51a2061aa58", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053561, "uuid": "02a917bd-b9c5-49e0-badc-def0cabfaa8c", "comment": "Malware payload (a310Logger)", "value": "791c8a3f64220eef4d4654c68fc89f61f29ebe18cbac0522cd13b77e21d7242b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053561, "uuid": "f3793246-6fbd-45d4-9110-9b9046425d0c", "comment": "Malware payload (a310Logger)", "value": "d46f04329fe31d3d7a37dd5cce27ce4c1edfd57b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053561, "uuid": "1f50f1e9-5f04-4830-b072-b9d8f9e09328", "comment": "Malware payload (a310Logger)", "value": "51c5c619bb3d1ea26fa9113c7ea52f36e681615828301f6817eb87fbf2e2c400b8580e9a622c3d47cf9cf229e947cf5a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053561, "uuid": "0e638d40-6423-4a0d-b4ef-9694a2420b06", "value": "T18405231354DBA7DD93AD73E97EDD448082C2278E2BD026278F384DA475082D8E4EF267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053561, "uuid": "90a3928d-17bf-4be7-8943-aba24ec51b97", "value": "24576:SJXL31iPXlVZJ5UPGQvlkr9l9BjAmttfjbn:SJ1sbH5UPHUl9hX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053561, "uuid": "72ddc1dc-d64c-4309-9ef7-329e980a9c89", "value": 841677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053561, "uuid": "d55edf70-3148-456a-b91a-d618d2c7af6f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053561, "uuid": "79f943db-ecf4-4eb1-9c9f-b94ce2abd79c", "value": "Halkbank,doc.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ad722d-dba5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766016605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766016605, "uuid": "0bf87361-436a-4991-929d-f028aa362afa", "comment": "Malware payload", "value": "00175e4602deb6e2575121f613bebd2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766016605, "uuid": "c27717c1-a5a9-4b27-a440-526f9fad22dd", "comment": "Malware payload", "value": "7a42cd81f209850773db48cf0ee6f7a50778d09211f39a18020909d47a870a95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766016605, "uuid": "a0705210-6da1-4e36-b22b-f70c31ad7373", "comment": "Malware payload", "value": "84af57db9de9d4cea8cda59a3a0a257382a9f449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766016605, "uuid": "dc58f911-fb51-424d-8031-20c78c7aa04d", "comment": "Malware payload", "value": "24d66f8bde0cac146b8af93451b000f60d1d4c291298ab8c2e90bf1e6c74f426e6cb1826941f4cf631e1334a725f08a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766016605, "uuid": "b27c5774-d93b-47cd-988b-5a76a6318f13", "value": "T11A085A4267EA04C4F9FBEA3589E65117D673BC166F3085CF224C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766016605, "uuid": "84e10b49-f787-4fe5-ad48-43415e61bd0d", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766016605, "uuid": "517aa13b-0d48-49cf-a0df-7dba1095155a", "value": "393216:96l8yvpcavR2rcq2qwOF1jUY+UwFD/Vhu0usIyNOnS0B4AycWMCYWbUll7aWGTbX:9IpC/o0sJY1G0G+or5rs3wbS3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766016605, "uuid": "41aed774-b6e2-42d8-98ca-de7ec2f6a608", "value": 77572289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766016605, "uuid": "0534bd82-6feb-431e-9895-544ac8402663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766016605, "uuid": "cf7a1084-496c-4043-989b-26226c9068a1", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4844b9ea-dc19-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766066159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066159, "uuid": "0e9d6d7c-3312-41aa-91a5-73af26bcef11", "comment": "Malware payload (Mirai)", "value": "c69a7c34eb4008f4238617ad536bb94a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066159, "uuid": "9ed4eea9-28ab-47d0-a5f1-0786e91174b2", "comment": "Malware payload (Mirai)", "value": "7a8adbdd2265926e4114ef47c6e1a9d74c2c6cdd8e0640e49eca36c06fa2259e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066159, "uuid": "4a9e61b8-31d5-485d-909e-3f986c5ee570", "comment": "Malware payload (Mirai)", "value": "a719f287eaf7177f09755d05bbbd6e56d44bb3c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066159, "uuid": "5e970866-7e03-49d1-bc48-147d99181268", "comment": "Malware payload (Mirai)", "value": "fecd9b4ca0b1713f8cb34de32cfc935e4410a7e1348b8ca2d0e032e7efc2f27ea4e85f10ab96aa619d81293bd8d8b6b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066159, "uuid": "0f8fdad1-735d-4eef-954e-917fae33936e", "value": "T15EB31A55B9819F12D4D221FAFEAE418833136BB8D3FA7112CD206F5027CA99B0F77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066159, "uuid": "1b26b03a-5367-4940-a9cf-1a49a8461b05", "value": "3072:BtbG8ocyFfrEsE561Qa6NVz5UKJl5fezm8RY42jx140u:BZG8ocyFf4uQa6NVz5DJbey8yb40u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766066159, "uuid": "5664390a-5ce9-4697-b593-478fd63df239", "value": 109200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766066159, "uuid": "4301a42f-8bed-4473-802b-65b8cae29ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066159, "uuid": "edcc7018-6133-471f-8b88-1f58101bd82e", "value": "nova.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab48a3eb-dbef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766048286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048286, "uuid": "264aa303-1f72-441b-bd6e-a0a12d743cd1", "comment": "Malware payload", "value": "fc26ffd9eff9d6a9703501a03a6b430a", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048286, "uuid": "a02b2fa8-fd7e-4e0f-a59d-6ab93eae22ea", "comment": "Malware payload", "value": "7acbde4bafa9657b6ffd3cc114dfa603efb6f93a72df33d5ff135f4db385a7cb", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048286, "uuid": "aa308751-d5d6-4a33-ac21-cef4ec85b84c", "comment": "Malware payload", "value": "78e6d93860fdaf2fa703519376ad0830a55138bd", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048286, "uuid": "a5b69b9b-2932-4cf6-a176-74ddfdf280ed", "comment": "Malware payload", "value": "f8c1c599a8f8a0cbe9f2f86dfe295ff88424e422c354bdc84d3e4375c33dbdca7aba55d11723870987c0aa9ecabe2daf", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048286, "uuid": "bf6bbdfe-ce09-4de0-a1e9-d44e89ecb0eb", "value": "T15142AF4AE12B541CC379107658394EEBF13C64C5234AF8CFAA485279BD11A8317CF6EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048286, "uuid": "f8d6745e-1d78-4fa1-986d-2034fd739f8d", "value": "192:HpeuyMavlfm7T4ex99cF+WFigYagjOoBmj4LENaj1I:H4u5qle7/cgHag3I3Naq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766048286, "uuid": "75dcecfa-4f00-4099-b5b7-0c515ca7fef1", "value": 12924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766048286, "uuid": "7f3bfc12-8e0d-4a5a-a29d-c5ef0ec3dbdf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048286, "uuid": "36ff809c-ca11-49fa-aaad-bf0e2044596c", "value": "Customer_Data_latest.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8640de3-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766053033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053033, "uuid": "41edd6d0-75f8-434a-825b-a4ec862794c5", "comment": "Malware payload (Formbook)", "value": "d678f3a2ff4b2d30fcbdda95b7bb7a4b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053033, "uuid": "4a7516bc-ee1c-4122-9b32-0135707a61bc", "comment": "Malware payload (Formbook)", "value": "7b01a62fd3fabd2a201fb159bbddf0bb737836cdf038461df425dd6a5dc5af57", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053033, "uuid": "1345a463-6283-4387-9acb-19e4466c6a1c", "comment": "Malware payload (Formbook)", "value": "c17bde2742f0268787fa0813cca250b77ced6e96", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053033, "uuid": "ac990378-1b66-4a6f-b929-86aec96a12f1", "comment": "Malware payload (Formbook)", "value": "225d28ffc4f3e472c63ff41ab853c514d1bcc96f4346b26f4c30ee691e632f8233125cb36efe2d2cab0761014292e53f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053033, "uuid": "564352a1-6729-489e-ba1b-ce54c6531886", "value": "T18826130E8B0C4951579914B1BFAE0A63F38EC547E2724036B9CF8CEB4FA935D9B30526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053033, "uuid": "b3690579-7c1e-44d6-ac65-a321a48c2cc9", "value": "192:PkZrIvUfu1q7lY2t3ktB4Qzp5LF8pkpuXVeOuuuuuuuuuuuuuuuuuuuuuuuuuuuB:PN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053033, "uuid": "2cb8ea9c-5e93-47dd-b9f2-06bc82c2d59c", "value": 4525662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053033, "uuid": "d9144f29-03ac-4ed3-b15a-f7617360d9f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053033, "uuid": "956ee344-d8b4-439a-b394-49c7b923d2db", "value": "Payment-SOA-00018120250.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99dc079-dc21-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766069812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766069812, "uuid": "912ec885-c97c-47b6-987c-f4e0ef9c7f6a", "comment": "Malware payload", "value": "46b0d4a02d84d3a3ec0e0024bf0d070e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "aassdd-pro", "colour": "#92A411", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "modulowinapp-com", "colour": "#5FD6AA", "exportable": true, "hide_tag": false }, { "name": "newkget-com", "colour": "#8EF944", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766069812, "uuid": "f93fa050-ff2b-4980-880e-d47168e4212e", "comment": "Malware payload", "value": "7b37f2f7b933f42fc81f05d9eacc0ef5d99099ab0672cc98ea57872a29e75dd7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "aassdd-pro", "colour": "#92A411", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "modulowinapp-com", "colour": "#5FD6AA", "exportable": true, "hide_tag": false }, { "name": "newkget-com", "colour": "#8EF944", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766069812, "uuid": "6faf87b3-c7ce-4dae-8510-239b33b7dd02", "comment": "Malware payload", "value": "49c4896060b45a885b57e08fbfdc9c74c71b5bd8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "aassdd-pro", "colour": "#92A411", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "modulowinapp-com", "colour": "#5FD6AA", "exportable": true, "hide_tag": false }, { "name": "newkget-com", "colour": "#8EF944", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766069812, "uuid": "d4152ecf-2cdf-4c6c-9d89-72642ccc9da3", "comment": "Malware payload", "value": "b8adfd7ac5f6c541aa7ddae642d25dbcd3cdcb69bf2d5ac9d8742c881f78f88acb61847f1bdc7900572b2959461aec37", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "aassdd-pro", "colour": "#92A411", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "modulowinapp-com", "colour": "#5FD6AA", "exportable": true, "hide_tag": false }, { "name": "newkget-com", "colour": "#8EF944", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766069812, "uuid": "93a538b6-016e-4cbf-8cb1-42315d448b8f", "value": "T195E633C0BD062B00C0DE24BC176E181AE2F3B2FA1918BF874597D8557A997ADF0DB257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766069812, "uuid": "2ab0f1c7-b54f-4a7a-b625-e4bb92c755d6", "value": "196608:E29iMH8Hprouoo5QUxZ+MHAqw/TYi924n8DrVg1+GZ5dQ82jFChEg+g8Hjn:/0pzbxdAT924n8Dhg/5dQ81hEhjjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766069812, "uuid": "42be034e-51e7-4e06-92b4-13d4cb8f89c0", "value": 14060707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766069812, "uuid": "55a11344-dd8e-44c4-b594-124ad9fb6d5e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766069812, "uuid": "be91f896-00e6-4296-baac-ebc0966a2a1f", "value": "python312.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dd831c-dbf1-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1766049275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049275, "uuid": "44d1bd79-49eb-4bde-a841-2973fbce5111", "comment": "Malware payload (CobaltStrike)", "value": "08d202831c4e98783e03ae80850a6fa3", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049275, "uuid": "23e29908-bff2-429b-8213-acb45ebeb002", "comment": "Malware payload (CobaltStrike)", "value": "7c66cbdaa10b3a0a0d7d200d2336d08fd18ec0b114e665bfb18f673b9469bdf8", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049275, "uuid": "9f2ed8cb-b49c-4979-a6f7-fa3af796a292", "comment": "Malware payload (CobaltStrike)", "value": "480ee5ad3e7cbcd13937f6d3ff7b6620c5907a53", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049275, "uuid": "662bd36a-48fa-4e1f-a88b-7888932a4ae7", "comment": "Malware payload (CobaltStrike)", "value": "d53d92711ea66c788d4631186bc1cb21c1ebe6e3bffed8b4bdd4c6e0ef5d3393fdc72429bc20d1039bceeb9fd210079f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049275, "uuid": "3cf51c78-7c69-4567-a3ff-f1bdd7f07cb0", "value": "T13C649EA999C72623EFB535FC64EC1E0CD3A099925221BC827A4C394C97E36DC743D91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049275, "uuid": "ba3b6313-36bf-4250-8503-71485570dfc1", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049275, "uuid": "a1b692d5-7830-4654-aff5-c25058fccbc5", "value": "6144:PXrOvF6453kUSh+rPplHsesmNSDnFZfYG+WSC/t2JF35TmJOZ5OgizkrySma:PXyvsQ3kUc+rPpVsINS7FZfl+K/sHmJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766049275, "uuid": "950ea570-5c2a-4887-a34e-1e48b8763f8e", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766049275, "uuid": "bbb21631-35f4-41cd-89a9-fd329285c1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049275, "uuid": "aa3de7e3-3530-43b1-8891-8d6ca79c3be9", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13011f2d-dc57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092698, "uuid": "742d872c-459b-490b-808f-f3e064cabd60", "comment": "Malware payload (Mirai)", "value": "9df99a866c6a2cec2618474729346b8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092698, "uuid": "46f399c1-bc63-4dab-8981-88f12ed01bff", "comment": "Malware payload (Mirai)", "value": "7c7617c4a0d9a7441a89e5622526aeab5760cf301ed80e9dbbde9811f04ad572", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092698, "uuid": "2acdec10-360e-4c3c-9e0f-7b707a52221a", "comment": "Malware payload (Mirai)", "value": "4259e0c2bec8df9a14d24bf9e86007d0ba3c19d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092698, "uuid": "925d4b48-74bb-4bb7-a411-0288a251c7f2", "comment": "Malware payload (Mirai)", "value": "570f094a9dc635af98b9a2c2c95dbd3b6cb1129404f8be5da3cd4ea4dde0bee72531bf52ead179f7d6a51dfccb61c69e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092698, "uuid": "47f06627-8918-4c79-a623-fb8db33dfbb8", "value": "T15A437CC4AA83E4F5FC9701751033A73B5A72F4351069DA87C769D83BBC52A11EA2B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092698, "uuid": "70a96dee-9982-4624-9b49-554f476d69ef", "value": "1536:ZyN5z8bAOpvnd02e98v2POtI7i7BDG+JSz0RZ17+v2nzhNKSM:0N5wUOpvnReO2WtY+gz0r1K+nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092698, "uuid": "10f8e293-ea4f-4f55-b8c0-abc8392682b2", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092698, "uuid": "b0d14895-7fd3-4824-8df3-8796b711fc52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092698, "uuid": "ac940c15-b901-4cfc-9f5f-22ab60052f22", "value": "xpx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe6276e-dbee-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766047811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047811, "uuid": "39fecd63-3469-4589-b142-02fb048e3028", "comment": "Malware payload (PureLogsStealer)", "value": "93b2869c836bc38d392633bb2eb7f597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047811, "uuid": "caa5b4f0-6731-4cac-a8ea-0e423f86a693", "comment": "Malware payload (PureLogsStealer)", "value": "7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047811, "uuid": "d2559c42-fd22-4b45-97df-9153f411963f", "comment": "Malware payload (PureLogsStealer)", "value": "60ded5cd8df92b2b6cd32ce94f095e9dddd93b36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047811, "uuid": "a8b83d10-81fd-474e-b5ab-8189ae5d1768", "comment": "Malware payload (PureLogsStealer)", "value": "a3a6f261f4d9f7704cdab38ee913b5fd7c82060de8cdce0cc066ed21e55fbb1e1abcddffe921045a5a73de87d190580b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047811, "uuid": "5a99ca56-d9f6-4125-a085-a50a07d3f8af", "value": "T1972512D05FA9EB16CC310B714AA4DD7672B09F28A454F8E79DDEAF5732D9300A408F1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047811, "uuid": "19bb8b2a-d69b-48a7-9ce6-f46e5db6ac69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047811, "uuid": "cf3e83e8-eca9-40be-a714-fd07dde0d5fe", "value": "12288:vae/KNoaj6JRFC5LPxv1ySmGVzOb6vmIT+3J3qFEYwCVbaUpM5bpc49qQiOJdgG3:vRQoa+ILPlUgQItVuUq5l9RiWGxJGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766047811, "uuid": "0cb8ed56-8280-4703-9857-72afdc3a7e2b", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766047811, "uuid": "7d9fd18b-aa69-4011-872f-b02c64177a5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047811, "uuid": "46ad7bc0-8791-4a6e-a4eb-acdeb573a8e5", "value": "ORDER-023674-KM436JK-2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfbf49d-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092473, "uuid": "9a98fe9d-afc4-4a70-8e39-5d0940ed835b", "comment": "Malware payload (Mirai)", "value": "09f712bc39074f2c4a825ce24763df81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092473, "uuid": "70b58f21-2404-491f-8653-71a2f73fdbba", "comment": "Malware payload (Mirai)", "value": "7ef1315c3e6667d670dfc11e07302c845b41f1e4643a0ca4c42e0d5390ad5080", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092473, "uuid": "2fe76e56-8ec2-473d-82da-c030d61aab2d", "comment": "Malware payload (Mirai)", "value": "8bc09df0e7704e4260bf41fb1f2160c6ebe2c8e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092473, "uuid": "ee35c72f-081d-4391-af86-20ec923598e6", "comment": "Malware payload (Mirai)", "value": "401af1f080319db0eee6539a8acdfd0d8ccb91d41dd1b4df2f73f9f6694ac001e53f05a9476c7431e0a3a1cebb0ab76f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092473, "uuid": "10df64cd-fe74-4954-8696-007264048519", "value": "T17DF2E09CEA589811CBCF19B34B6F67F20AD8B0C5318E0EE993660CCC76D57467A9D0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092473, "uuid": "6eef8a4e-d663-4a58-bda7-51585511f0f9", "value": "768:Bcic7wjLhYdTv6YRDJReCQOlmoNlbOnEmfUliWIO7+dPNWAX:WqadTvrRDzgcHd0UliWd+5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092473, "uuid": "f29a7c0c-5132-49e0-9c8c-fc88fed648f0", "value": 37152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092473, "uuid": "54d2baf7-0ab0-4472-9b5f-70f9d159847f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092473, "uuid": "ea06b875-0a30-4c1a-aaac-c5c91ea33b6d", "value": "xpmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed38224-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041689, "uuid": "3b042351-03f7-4479-a60f-fc22a530dce1", "comment": "Malware payload (Mirai)", "value": "587a838e0008d591620cf81bc38626c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041689, "uuid": "f322fd98-1424-4533-8158-70dc5733c682", "comment": "Malware payload (Mirai)", "value": "7f32d9884e60cc37af8125645617882845d8d77c4c330f5ca4c793a34a425ff3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041689, "uuid": "73b5326c-70f5-4ec3-9be1-4c55340d7cca", "comment": "Malware payload (Mirai)", "value": "7038034571717bc0df84aea9df16342a7abdeda2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041689, "uuid": "fa9736bf-640d-4664-ab8c-132739d0ee06", "comment": "Malware payload (Mirai)", "value": "b4e50a10fbc6e82a4ecab92b485110b7320bbc9bae5ab2f71bc80b9bd897561e5e770ef2901eceac421f07a0db28ff09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041689, "uuid": "7fc3949d-a0d9-4131-b07c-d9f58282d470", "value": "T151E24AE7D943D9F9FC110AB51132EB329BB6F17E2158EE47C39CD532A853902A60729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041689, "uuid": "0e46a33a-4931-47ab-b63e-1d193a89d29f", "value": "768:pQiX4BObNmW+Jj7kGzgUEI0bb2xDBUvyh1i:pQK4BOb8W+Jj7f0UEI4boDBeyh1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041689, "uuid": "0ab02e76-fcf3-4e91-84f5-d2941909c18f", "value": 33472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041689, "uuid": "5e0d6ce6-5f65-4f10-a5d6-dcdd94c6f79a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041689, "uuid": "0d55ec7b-c690-4d96-aeeb-f2360a87ff7a", "value": "kvariant.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502bcfad-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041691, "uuid": "6602c709-9187-4955-85e0-0b4c10d759df", "comment": "Malware payload (Mirai)", "value": "f1c3a02a50c3cdb2ddd8b5903a438125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041691, "uuid": "44fa6a29-da32-4de1-b7fd-22c71f70758a", "comment": "Malware payload (Mirai)", "value": "803bba074634b9eb886e23a67e99e4bbd16d035a09e67db4b6dd07eca3114e66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041691, "uuid": "0b3dbf7a-132b-4f47-b214-c38714b64113", "comment": "Malware payload (Mirai)", "value": "0a344ee2adec6819f523d018fc3ccef8ea577d59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041691, "uuid": "3124a790-b479-4542-90fa-e206a7fab807", "comment": "Malware payload (Mirai)", "value": "640600078c229cc8939e7dd4b97c86c927788cbfb4c5cc84651692a30fbbbaba820ad63745175e774fd293a70a7964de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041691, "uuid": "713c0198-33b4-441c-a252-e2b5ef1eb9b1", "value": "T164030995B8819A03C9E41377FA5E42CD37266398E2DE33039E222F513B9AD2F0D7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041691, "uuid": "8f3ab635-70ff-4fad-a3f5-30a1a77a51d3", "value": "768:KwnZy0Uyp5HFDvojtLzUoTPlmcpOugN+JPUEF611v:1nUyHHwnQcpBFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041691, "uuid": "e24d8be4-86f0-4dca-8b6e-c66eb86e016f", "value": 37704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041691, "uuid": "03a926ad-0e7a-41a1-8e55-a7313de7d335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041691, "uuid": "38a594cb-a389-4fff-962c-9fc30ace726c", "value": "kvariant.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79282a6-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085270, "uuid": "ab3ee439-7897-4f95-9dd9-e8a4577208a8", "comment": "Malware payload (Mirai)", "value": "f28991b06c2f73e43f72f06b05f66c37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085270, "uuid": "f3ee9c57-2f65-4739-8a49-d4a5b9022134", "comment": "Malware payload (Mirai)", "value": "808576d8a5b41a7c6db56b5090a5f2d7de2b06003d158494879bd015960f4cea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085270, "uuid": "57b6c06f-dbf8-4cae-869d-02911775eab5", "comment": "Malware payload (Mirai)", "value": "60ba700de3f33be192d1dee325fd3767301ac67d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085270, "uuid": "b4b59940-4d32-491d-a200-1e3820a686e6", "comment": "Malware payload (Mirai)", "value": "438a357c42fdeafa569d69b145386b090e61a2658d012ae79953e6f925f2290f54014b7ef5eef403f0ab095f56482d60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085270, "uuid": "55247e6e-5567-4035-9b07-a93a7280eb04", "value": "T11BD37CB3CC386EA8C668E5B4B0318F781B53A51182475FBE59A7C7B18047D8DF60A3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085270, "uuid": "a7410e3c-fff4-42a3-ae36-3a6ba3af7fc2", "value": "3072:TlooqweeIWYNFRdr3/WavLNZtWHElU3g4U4:T+oqne1YNF7r3/WavTYHx3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085270, "uuid": "4d6f7d2a-5fcb-41ec-8aed-596e7a3a9d79", "value": 131856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085270, "uuid": "e0cd2a8d-00d3-43f8-8b18-660c2e4e496d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085270, "uuid": "94e5cb23-a014-4aa8-84de-f07a9c5c2781", "value": "byte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722e713f-dc11-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766062793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062793, "uuid": "9223a486-a66e-4ee0-907a-11c8e69ae474", "comment": "Malware payload (Vidar)", "value": "75696e5ad1bac2965be28aa4ba2d9408", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062793, "uuid": "236f9fb3-410a-4323-859a-434a5d96edd1", "comment": "Malware payload (Vidar)", "value": "8123649be6f7c361e65dd0726f1db91bc7662b898a1cd203be2a2c4aa72f7eaf", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062793, "uuid": "b3ea7a7e-6605-4091-9cc1-3ee426178ebe", "comment": "Malware payload (Vidar)", "value": "99707db2683f1c81f0105ecf0cae06233bfb1ff5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062793, "uuid": "d1e34610-914d-43e3-976f-328a6d8be786", "comment": "Malware payload (Vidar)", "value": "e621d48439d4ef43e90f10c9c425aecd4d380fc4ae4199e1b615654e8e3d072f7f83e21bf7cefb5cd98ef30713f16229", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062793, "uuid": "7e21a5f1-a2ad-46f3-8892-36d50e107124", "value": "T107E64CD29D50076ED5ABF239E4A251466230BC44433224D7BAA52B954FBBBC4133FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062793, "uuid": "bef82c7e-4542-436d-889c-4192a8e72ac9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062793, "uuid": "b29330d6-3bcb-45bb-bd0b-2f8bbb16df8b", "value": "49152:OnE4fbJjYXjwxS4nRwWp9ZhPm1F4cNlkCFnL2PxmhhkvX9YY9tsHOA/EVK5zM0pT:OE45KYXzuHJ8/DWo4dEjJrfp77klq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766062793, "uuid": "6a683cad-59f6-4673-a255-956b30186703", "value": 15154392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766062793, "uuid": "e5f59c1f-bd94-491e-9170-81e8b7e2bc54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062793, "uuid": "f1714243-791b-4dcf-9cb3-c44b54c59a2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8394abfc-dc69-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766100618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100618, "uuid": "fa6bdaf8-c076-403e-8c47-87fd43047c75", "comment": "Malware payload (Mirai)", "value": "f1b85585d2ca42138855f09cc8d6ee35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100618, "uuid": "2fc10986-f32e-4372-a3fc-baeec239489e", "comment": "Malware payload (Mirai)", "value": "827c1de51a29de287547e551542c347a01ccdcdc7352625f0f2d6a058821053e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100618, "uuid": "bde596d7-0c0e-4395-933e-a6b0dcb5790a", "comment": "Malware payload (Mirai)", "value": "569a56ea20205e75f8f05c5baf081af00df0ce41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100618, "uuid": "be572100-a968-4554-9f63-82ee4f677e57", "comment": "Malware payload (Mirai)", "value": "dc532b7c06b912aa7481b0bbfe02fdd3e62f0351622bc871e56848cf442baa53ed9f29b76e587af27254f869ee158334", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100618, "uuid": "0e93c679-f680-48a5-a59d-6e22fb6d47a5", "value": "T14F54080ABB210EFBD86BCD3B05E81B0229CC654722A57F3A7674D518F54B64B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100618, "uuid": "06b88089-8967-4000-baab-dcadbfc554ac", "value": "6144:YYx5iGeIoh6A1M3l5WfaxUDBbgUY7dMjFPu:4IQaxUlgZZim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766100618, "uuid": "ada5a4be-eff3-4d36-ab4f-8c903584fe3c", "value": 301352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766100618, "uuid": "6de499de-03a3-45e8-84a9-62a3fc3cb3d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100618, "uuid": "39a0f91a-c93e-47cc-b53c-f26d66909063", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15777ff8-dc1a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766066503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066503, "uuid": "ae90f994-e4fe-441f-8f8e-e6733ed0e072", "comment": "Malware payload", "value": "d9e7c72ba71ccfa887c158e1261f97d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066503, "uuid": "8f46afb8-a342-49b8-ad81-6fa806236f54", "comment": "Malware payload", "value": "829a63545af673b454404d0de8422255373f32d5bf95511985ac7b27afbb094f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066503, "uuid": "a8231baa-fd61-4354-9198-05eb8fec8ae5", "comment": "Malware payload", "value": "033720182f8a80987208d73ef58bd8c31d359340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066503, "uuid": "a1bd8b80-dcec-4e67-ae9f-796aa5650077", "comment": "Malware payload", "value": "eda26095fa4560bad8bf081eda3cfdc64277cbf30561cf33cfcf69086597f3a4af44af22e19afda399a525e258c2e7fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066503, "uuid": "c2be5c4e-d3b4-4c28-a986-56fcdbfd732c", "value": "T1EAD49113F0684182E884D7F16140EE6BCFA47EF5DBBEAA09429CBC45DDC89054AFC679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066503, "uuid": "f75c4145-968c-4433-a33a-4ed8ccc7cc43", "value": "384:522222222222222222222222222222222222222222222222222222222222222r:23GIb9hkBHoEgr8N0HeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766066503, "uuid": "3719df7f-81f3-419d-91f1-77f1f4b9dc51", "value": 649582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766066503, "uuid": "a7e12a07-7ecd-4c59-b419-fd969570259c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066503, "uuid": "ff6e82fe-48fe-4303-9c5c-76a992364dbf", "value": "PO 4020005742.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2f774d-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041895, "uuid": "7e196b69-77eb-4ff2-ad98-3321dcfe7053", "comment": "Malware payload (Mirai)", "value": "fd20c1bbb66122844ce6412c52116c68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041895, "uuid": "e3571d3e-8a93-48c0-8676-64f2c80e79ac", "comment": "Malware payload (Mirai)", "value": "82d7067a500fc1262960fde559992e5e2f7d03c0489bf4dd017d5a0e915e108c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041895, "uuid": "73a1c246-b414-4683-b89f-4ef49392da9e", "comment": "Malware payload (Mirai)", "value": "0f82ffe5656b044467acb725b587e246b3d51ee5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041895, "uuid": "993afe3a-3f07-48ea-bd8c-f600cc38f71d", "comment": "Malware payload (Mirai)", "value": "ad4ce4238023c1b8ef692236278ca14e6955d30227b4f5e2c91cfd4498655fe3b8afc3d25ff0609e6476ae957ad43188", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041895, "uuid": "e453e72f-f924-4766-b255-c22b51e81c9f", "value": "T12E23821ABFA14EB7DC6FDD3709A91B4534CD641B21A43B397D34D828B20B62E19F3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041895, "uuid": "3c29da70-8689-4230-ad4f-936257eb4d08", "value": "768:OmkXpJ43OhBaKcaHelmaec5Qveme4Ee1KKjLNXi+lWxq+rhd1vr:Omk5JTaCeoaXijdEeKK/AxrrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041895, "uuid": "dc5b7c7f-25dc-47e3-b22c-4643d29a226d", "value": 48804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041895, "uuid": "62f21b69-ed7f-4fc7-8e9a-1b6e007c1269", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041895, "uuid": "3fcd4290-dc75-40a4-8da3-ce3fa3be596a", "value": "mpsl.b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976b7e79-dbf6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766051259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051259, "uuid": "f41a5d1b-eb79-4d53-9617-d4cd5b4c5437", "comment": "Malware payload", "value": "f251f92e94e0336d5f8da4582ab29f30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051259, "uuid": "0b87633f-d0c7-47de-b4e2-d5fd14ebb026", "comment": "Malware payload", "value": "85aa1e94ac7ce89a3edb136679b9c97cbf509639b00bc2993ca4c7b71e152250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051259, "uuid": "bb11b434-f66f-481b-8aa2-fd845f6d9140", "comment": "Malware payload", "value": "aef5aa87379dd6f23b7e5bcb78c80c2e3504ff05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051259, "uuid": "760e48d2-35b8-4557-9ce3-dfdeb9a6a963", "comment": "Malware payload", "value": "a4a757f03434a05ed64a96aaca1bbc75032412eefd6f9bfc885da0fbc706bc0bc032bdb31f1101642693003737b3a3c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051259, "uuid": "e7cbadc9-9839-4cb0-a59b-f2efb8a41dfc", "value": "T13595C03BB121CB6CD0CEC9B824E396E25E307E140AB5524616CE2B5F2E73D906D5E58F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051259, "uuid": "59722afe-88ca-49f0-a49b-63fcec20dd1b", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051259, "uuid": "dedf0d3d-7e42-4690-ba52-7369a2983acc", "value": "24576:Duf84r7YFz75ELy9vS9/aOHR+SftSRWLyvt487diDxHp+0w7W:E8a7anKy1S9/aOHRnFS8Lyh7JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766051259, "uuid": "db7e851a-b0b1-45ce-a5ab-4bb0c09c856e", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766051259, "uuid": "b9ea1bee-419a-4dc7-aea9-d89d2e987257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051259, "uuid": "736c3dca-ea93-4d20-91bc-cbcbd60a29a4", "value": "clean.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348f88bf-dbfb-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766053241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053241, "uuid": "0b1225c3-43bc-41f6-b242-6983a73bcf87", "comment": "Malware payload (Vidar)", "value": "95d73ab73bbf835f15aa943a9b467c47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053241, "uuid": "0ac511f5-6a5a-43b0-93f0-c9544a91c9ab", "comment": "Malware payload (Vidar)", "value": "86034f159de1d181f35de57a5eed35ca35997aa7db6282e920fa6359f235c97f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053241, "uuid": "e8fd681d-9ccf-4429-b698-d82ed86bf20a", "comment": "Malware payload (Vidar)", "value": "0652e360845131fd7d810a702f7a6bc526c345d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053241, "uuid": "8a4098d3-ae32-4a41-93ec-6f0f017340ba", "comment": "Malware payload (Vidar)", "value": "dfe6f6dd06730ce11994aad8064f6765bb0c8fdba31137af8b01394419db429a32311c2af87956bbf5b7f50b0e1ee9d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053241, "uuid": "d4d36eff-b04d-491f-86e8-945bc8ec48a6", "value": "T140D4015773F630F8E4A7827AC8641649FB7278365B209ADB07A046B55F233D19C3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053241, "uuid": "1149ba5c-7874-4844-bd68-afcc21b91c4f", "value": "f73c6a7c47053d807256877f079ae0ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053241, "uuid": "8ddd9576-ddad-47e8-adf7-ef47eac4b6f1", "value": "12288:/IDEwe+QGBLWY9NYAEqF7gUUiVP7uUiQhdsGY+YRIqja8hBr9L/f6d:JJ+Q6DYAJF7gUrpTODjj7RV/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053241, "uuid": "035d425f-11e5-4c94-af32-9cc73643058b", "value": 639720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053241, "uuid": "ddc926fe-600d-4b6e-a322-8cac6f7c3953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053241, "uuid": "c0c563df-b057-46d1-b8ef-a6da598b8ef1", "value": "SecuriteInfo.com.Win64.MalwareX-gen.19426435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979f4e6b-dc60-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1766096786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096786, "uuid": "1fb6c7c7-9e45-4997-a8ef-563036717cb9", "comment": "Malware payload (ConnectWise)", "value": "28902ffaaab42a29370204e9e4e307d9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096786, "uuid": "4d7ca7d6-588b-4277-98ae-cb4e1f82b0a5", "comment": "Malware payload (ConnectWise)", "value": "86b6f0171e9e3066125b1ae6abd6828f2079d580abe1c66234106ddac34aa031", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096786, "uuid": "531deee0-61f1-4d47-bc4a-948bbd5372bd", "comment": "Malware payload (ConnectWise)", "value": "9c3b1e523584f3f1ed6519c8d8467f65c9ed28ab", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096786, "uuid": "ef49564c-3622-412f-9757-53a3065de42e", "comment": "Malware payload (ConnectWise)", "value": "c70ae66b15198286934ecee619697f05428fa315d3ae7fcd69cee91246294b41b0e91adb5e3d5c45b336eeb407e58e78", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096786, "uuid": "ccb1f85c-125f-47d6-beec-d3bf9a9129c6", "value": "T11EA6233662E4C026E2B71E39E9794AF25939BC468913C15F533C794E6871E81E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096786, "uuid": "85920584-0215-4080-8fcf-30197f03db06", "value": "196608:w+kLGB1n+Z3/c+kLGB13+kLGB1I+kLGB1:VkqBx8kqB4kqBjkqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766096786, "uuid": "359c04ab-b965-4611-a4a8-b1db61b56b5b", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766096786, "uuid": "a6bad591-4e20-40bd-a610-0dc762ed623c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096786, "uuid": "4f0db802-9d35-44f4-bf1b-e14146a61bb7", "value": "EleganteventDetails.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b999f09d-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1766053035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053035, "uuid": "cb2ada28-b4b3-4b00-85dd-31b14bca882a", "comment": "Malware payload (GuLoader)", "value": "c5bfc026b122261efef00c634a5539e8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053035, "uuid": "6fefabdf-84ab-463d-a98f-a94696c8070e", "comment": "Malware payload (GuLoader)", "value": "872faba27401f1dcdf7189c5066f6b506ca76d8b0f69d9b11ad73a39b9c3cf91", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053035, "uuid": "7d44a371-f71b-4ddc-9ce0-558368d857a4", "comment": "Malware payload (GuLoader)", "value": "a804c75f5021bf17e3a71affdbfd72d3acd7b9f1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053035, "uuid": "636df9d5-e2ed-479d-a3c3-f3d925abca1b", "comment": "Malware payload (GuLoader)", "value": "ec67e257c9362d4639e237353df85e5979c510bd9eb1e932b2b57dfd0822d324b6b7812956e5a21d4f500caffcb30cee", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053035, "uuid": "efe68e9e-407b-4de5-94bd-35831663a062", "value": "T19CA42870CA2401B74F83AB9CBCA50661C66DD325862605F1F6D98B0D900EDECF7BD66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053035, "uuid": "1ec5e578-1cb8-4c22-9b67-91b080840d06", "value": "12288:ncZi01PI/W7OEH8q6jBQdrB/5kvL93RjgIjxkoi8/q7QXydUk:ncZi0u/W7OEH8zBOB/5kvLNRjg8xrieu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053035, "uuid": "0fd8127f-0d54-4f93-aed8-075dc39be314", "value": 456909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053035, "uuid": "f2183538-8100-4e0f-a91c-6858329326d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053035, "uuid": "02266987-50be-4966-8cf4-e98f3fc9d8ad", "value": "NotaCredito_en_PDF_12162500.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb52de0-dbe9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766045715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766045715, "uuid": "ba4b4557-a466-4be9-9487-6f150b2146b4", "comment": "Malware payload", "value": "087e0bdfbea59e2b5e799537df3f4e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766045715, "uuid": "421d980c-fce7-48b3-a21d-da5ab69890f8", "comment": "Malware payload", "value": "87ac4d92f9cb63340de45eac25dea4ef0197eec56962e34a434389c399ee7dc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766045715, "uuid": "1fba93ea-cbaa-4727-97a6-9cf669f1f94c", "comment": "Malware payload", "value": "2daae3696c25dee389254bfa0b50df683d748fb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766045715, "uuid": "b85f4036-0240-4c5c-92bb-8744553d5cdd", "comment": "Malware payload", "value": "f683a6a79460cb90b6836805637940ea7f94a654d87aab316759d22539585f2148a10f9025d2ba9295a44ac997418826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766045715, "uuid": "3de65e59-60d2-4e65-8ef5-6c74ab9050e2", "value": "T14CB6CF037B04DB11C96C313A92FF692D63A1F9CB0775891FDF053A9B1DD62A698CC24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766045715, "uuid": "98c8205a-ee20-4560-ab98-fca5bb80d6b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766045715, "uuid": "40d73556-52a3-45d2-99b7-e1130d839309", "value": "196608:2hZcvqHXwq/+vrjVqL9UC6Sd/vcCXfwHcT9bUgFrjwYTfSAw7oaGxJEQ1mWyh:GZcvqHAq/+vrjVqL9Uud/vtfLUgFrLf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766045715, "uuid": "9a40afc9-17e4-49ca-8eab-e21bdcfb9475", "value": 11412992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766045715, "uuid": "fec935b6-fd6c-4eca-8980-265806d943cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766045715, "uuid": "36e36f48-5ced-461d-af74-927e53bb15fa", "value": "087e0bdfbea59e2b5e799537df3f4e70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce03ae8-dc60-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766096634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096634, "uuid": "5550ce7b-5109-44a8-95a3-26edb60736a4", "comment": "Malware payload", "value": "fc6a485535a70170d8cd19d2db7aab7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096634, "uuid": "9a9c09d4-80c7-44e0-9cda-da51af6a0a95", "comment": "Malware payload", "value": "89cef8fb7f4a3b4bb1f3c3931efb72bcb8411ae622b53797eac80d91653f9ce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096634, "uuid": "47ed7131-d158-4ab1-b920-57c31419d355", "comment": "Malware payload", "value": "4804e09d8fb9263b6ade18467d0558d384d2effb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766096634, "uuid": "89fef18f-6705-4ec3-840f-c8c97b167906", "comment": "Malware payload", "value": "76ae686935a1ba079c8e3aa76cd77973c387c40adb87da04ccec17a2c25965c4d1a8683ebf17935bff221821726d2f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096634, "uuid": "5dde8b25-080b-43cb-80fc-76ec34ee71c5", "value": "T105E6E51021D96607FD7ADFFDC9DC76540F79B2A53723EA289B414EE90BD1B08C9029A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096634, "uuid": "763ca4f3-6383-45d8-a4d3-06fdc76f11fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096634, "uuid": "0ffc6354-cc63-4365-a5cb-c79334a9b1e4", "value": "196608:VYog7p1Dy6Wf4q0D0oj9QDEINLjrzMLuBLtgSX:ylFy6WQuLX7TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766096634, "uuid": "5bafb2a5-cc7b-4e1e-a65d-cdd7743e509e", "value": 14476288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766096634, "uuid": "8d5b06c6-5b45-4968-92fc-b023afa75a1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766096634, "uuid": "c4c57ff6-fa5c-4330-9b64-2eabcaa69cad", "value": "SecuriteInfo.com.Trojan.InjectNET.96.24894.2988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6fd0ca-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052982, "uuid": "e7f62d9f-885f-4fc7-8806-4ef8989732aa", "comment": "Malware payload", "value": "0f4e152a6877ee980fe1fba63f2ff13d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052982, "uuid": "d390ba1d-bce6-4b8e-b44c-4dca5eb1061c", "comment": "Malware payload", "value": "8a073c886156264ba5d8408fb79781110bd6ae36f8dc84847f52c593ddc2e29a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052982, "uuid": "bbb1057d-900e-4959-b40d-99f176818a1d", "comment": "Malware payload", "value": "7ad4cbde514bedbc1c0b84b8c1a2afa0d19c41a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052982, "uuid": "6f5afb80-6732-48ea-ab7b-32a088aa5845", "comment": "Malware payload", "value": "c66c9ea8424da7ff87a3bc94fe17450008ee591f5fd468ff44609cee69bd125c65bb8349c967d0360af4d0b87906efbf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052982, "uuid": "42468d18-65a4-4a1f-bf6b-6d54d0c329ee", "value": "T16A04711973C0B894539BDB7B772FB0E5E91F1ABD3948086FC211BC44A166B06F9E1932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052982, "uuid": "ecadaf68-0abe-4887-8fa2-14c59cffa000", "value": "3072:GLsKMRJEcTSkhINB6FA00oLG7AicEDdSyq2AkfPjHC:4sKMRJEcTSkWv6FvLTjojzHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052982, "uuid": "d0c90659-d74d-4158-b0fc-73496a0a867e", "value": 175972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052982, "uuid": "9b08e2c4-f037-4469-8e4f-88164b47856e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052982, "uuid": "d0a88f48-1fa9-4209-9ef2-15538d3378a9", "value": "TECHHAUS# 2407-01444.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99e4f5d-dc10-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766062457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062457, "uuid": "8f34c68a-5569-43bc-bf25-ae9f4eff3567", "comment": "Malware payload (AgentTesla)", "value": "c4503a69698140d64ffba8ff2ea7de82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062457, "uuid": "61c7d350-7898-4c82-83f0-eee46e325f14", "comment": "Malware payload (AgentTesla)", "value": "8c491ff716a5b1fca672bc23db6308d080bc3aba37f7b217364f7e1a2b9e8d7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062457, "uuid": "05f5546f-1ecc-4105-bf3f-ce2fdfe494db", "comment": "Malware payload (AgentTesla)", "value": "98ee66dc417e415fd059b0de961f8fd3c4b2eb31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062457, "uuid": "539753a2-aab5-47d5-a0f3-e9acea5c5a34", "comment": "Malware payload (AgentTesla)", "value": "156b2938358b9182d2a27a686e12114366881c667c485371c0013650d45c7c0e6a2c16a1c6fbc5d7f94ddd117a039b60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062457, "uuid": "2cd0fb5e-6e8f-40d7-90e7-055e83b9af12", "value": "T1177337A79C095AC7F22C83F9BE160CE96F09031CE9827EFF04265FD67E506135C5A46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062457, "uuid": "7b89bad8-4438-421d-83dc-e999c888d5dd", "value": "1536:vvusxs8JgCpJ6wQfxf28aBotckqVHmvru5266DeqkET3+C1KnQ:vWsxsYb7kraGtcNVGvru526ges+KIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766062457, "uuid": "d4913833-08cf-4014-bd45-f6b62d939d0f", "value": 76153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766062457, "uuid": "09cc18e6-f3d4-443f-9cd9-7e5c69b3d73d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062457, "uuid": "1226f9e5-b2a0-4047-a55d-7945d8085c97", "value": "20251218009.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2841428-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766052620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052620, "uuid": "8ca3ec5a-aced-4f1c-a094-b0d71ca76baf", "comment": "Malware payload (Formbook)", "value": "9670befdf5f4f071c63703e5ea064286", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052620, "uuid": "81bc09d2-e9e3-4fee-ba75-7f1a5b36ca88", "comment": "Malware payload (Formbook)", "value": "8deb42270a5fb9d7ee57a83168f4989599364500df8ca277cd6f33e8e2f9e454", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052620, "uuid": "f527246b-78c3-4471-9e92-7080dea154bf", "comment": "Malware payload (Formbook)", "value": "060403a0e9ffeb8213e02f87591adee251cbb72f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052620, "uuid": "ad90dd58-dadb-459c-9d6b-289f0ef0891d", "comment": "Malware payload (Formbook)", "value": "95592b35959e8fe2def1cf7d518fe89a31fb13fb4065c649a9a4ece9c812f55d567137b76dea73721f3aa1c5697a1a49", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052620, "uuid": "4a1697d0-2673-4091-8d97-14acf2037012", "value": "T11DA5B05D84B1ACD2A054FEB4F685FFD78CDB5385162B07421FE4858A3312C83FAA72A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052620, "uuid": "9adcd6cb-c62c-4beb-a478-ee43e05063a3", "value": "12288:F7FhKtv0w5qCZvkRloOdb3hdL0B+kHklWFyhgnc0QRq5Bc6MTyvpcmr3rcH3YIzx:F2nq++WPctW3gYIzUqqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052620, "uuid": "bfd43e23-9c2a-4651-89fd-a99d7007853c", "value": 2112464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052620, "uuid": "4ae6cb74-3c02-487f-a2f6-916769afe19f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052620, "uuid": "164469f0-8490-4c0f-8e84-c73b7a5587b1", "value": "Purchase Order Specifications.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1609619-dc16-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766065047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065047, "uuid": "6bf84292-4c4e-46fd-adf8-e959b7a976bb", "comment": "Malware payload (PureLogsStealer)", "value": "3634aa7cd8d0a47b5323e39aa84657b2", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065047, "uuid": "ae36c693-dffa-4e54-bd74-5172797b3133", "comment": "Malware payload (PureLogsStealer)", "value": "8df7a8188364b2a90b4c77e9729e98ef9d565bf85c4ca8239e578c42c11a94f4", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065047, "uuid": "50a5919d-d225-4696-a626-e50a7cd70bf1", "comment": "Malware payload (PureLogsStealer)", "value": "5b2784069ddd2978749d9ccb8dfed8f80bcc9f88", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065047, "uuid": "ae91e259-a77e-47dc-b31b-8eb2c7e10124", "comment": "Malware payload (PureLogsStealer)", "value": "caad6a292fc74215d90017b2d9f026e20e83d8c23bdb0fb6c7e09bf7691ede79da4af37d8e9f0a4f5a444e5ca3e68f90", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766065047, "uuid": "d2880eda-9fc9-4d8f-938d-dfeeca387bfd", "value": "T114D4257C8E46380B38A034D09C67E3188AFD7FE7F869B69140DA7BD153BA8DA4D15E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766065047, "uuid": "9c24f0dd-a7eb-48e2-9dce-989ed8a178fd", "value": "192:AVHZeP4tMfkWZCW3WsEW7WzEWZWpWz36K:AVHZeP4tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766065047, "uuid": "816e7ab9-c6ef-49d3-aeda-19557eb89b80", "value": 647640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766065047, "uuid": "8fb51020-d7c2-46d7-bfba-81d023448334", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766065047, "uuid": "2c6052c2-a03a-4eab-92ac-94d62c90c135", "value": "Cat\u00e1logo de Productos 2025_PDF .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091f38da-dc09-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766059181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059181, "uuid": "8ea30299-28ca-4ebf-b4b1-568a4e83cc81", "comment": "Malware payload (PureLogsStealer)", "value": "8c1bfe157abc8125f9ecb5a5299eb0eb", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059181, "uuid": "40723601-c365-4943-8652-4b96100928d2", "comment": "Malware payload (PureLogsStealer)", "value": "8e3d19b236783dc77e2afdae8121d16cbad1bc4ee4954c653a5af281423620ea", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059181, "uuid": "03f4f254-c74c-4b7b-b9dc-94c23de8a0b4", "comment": "Malware payload (PureLogsStealer)", "value": "1a02bb5d96e7f7448ad833ca319e8db3a2e5b3c8", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059181, "uuid": "c82bf619-8e0a-4cda-a3ec-a7d0725e8711", "comment": "Malware payload (PureLogsStealer)", "value": "369bc1b74dda3a9883ac26b73287b24ae92a3767f11b5cd2a9bddc7e1b2965e9fe84769170286f49a95d313d3e90f33e", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059181, "uuid": "52904026-7f3b-4849-863c-6d81e78d9e2d", "value": "T160D49244DA078658D749A215C740EE6DBFDE4469E7E4816A0FAC13EF6FF1420DB2EA0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059181, "uuid": "f3636ae4-ccf9-4216-85b4-3bffc749080c", "value": "192:Wsx/3SRA6y+QNAk4daYDjR6Uedx1oGfOvero+bOs1LF4ZdkCsgslyuDBScPf7pFA:WY0ZfWoEooLF8dkC9cn7ann", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766059181, "uuid": "a579b716-bc6e-468b-8412-e29a1ca9bc60", "value": 630039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766059181, "uuid": "41b96f9f-eaa8-4cad-9789-9279be13b244", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059181, "uuid": "f37c114a-c4c2-4d17-a05e-5d70bfffc9e8", "value": "INVIO DOC. FAT_2902_del_18 12 25_pdf .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8151dc-dc2e-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766075486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075486, "uuid": "c9c4777e-e7d5-48f6-86eb-8c1ee78e80f3", "comment": "Malware payload (RemcosRAT)", "value": "3f7f5e4cf81d7e13aa76430c2db9d37f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075486, "uuid": "91d119d7-1d40-417f-b32f-c979c8e1c4db", "comment": "Malware payload (RemcosRAT)", "value": "8f73e814ebe964497fc34f7395b1022a732b5a22dcfcb741fe22fd2a24f93971", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075486, "uuid": "3ec1a27d-e270-4279-b64d-084aceefd14e", "comment": "Malware payload (RemcosRAT)", "value": "f3bd266687381308d12897e71cd8be8da52b769b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766075486, "uuid": "18195770-85d1-4303-baf3-574560ed8058", "comment": "Malware payload (RemcosRAT)", "value": "4b20b0d99ddc32cb519fdcbb4b41ef293117c31f7636d5026cee2dcf57b19008838bc83813856eb44eae6e3ad5d9e45b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075486, "uuid": "b50229f0-ef20-4a72-ab16-36d0a0a4d061", "value": "T1815533F5EA2CB4F6862C5EBF39890FCC08456729D387C1AC26B2E6425E03D9D342F651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075486, "uuid": "d22b4b23-1fd9-49d3-86b5-fbaa65b6270b", "value": "24576:T7gBPsGFxaoUgfspGm9q2C7eS6XE2kndKblKxlYekJ6UrYmcLBR:T7gtbFg3KmxaeSrnHTYeGwNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766075486, "uuid": "80c21f47-3900-400c-bb72-f18702273bb9", "value": 1404609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766075486, "uuid": "cca78fad-6a0c-4058-b5b0-0d0983389eac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766075486, "uuid": "b0dd6796-32fe-475d-a45c-5de2af0df38a", "value": "nIMG3456789000987654345.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9456da14-dbc1-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1766028491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766028491, "uuid": "099b20f3-03f2-4057-9b06-ba1332ab3246", "comment": "Malware payload (Joker)", "value": "109ada70913c2a1fc8dc3eaf4f062066", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766028491, "uuid": "6d5efc39-4569-49b1-af09-10c5237de584", "comment": "Malware payload (Joker)", "value": "91e467b2b509422032dda3fc68e10e1919aac75a0ad66c018267307e133d6f6a", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766028491, "uuid": "0583236b-60e3-4ac2-acd0-e5484c520b41", "comment": "Malware payload (Joker)", "value": "6b4030879cec45a7f9aa54ab8bcb0b0222c1e46c", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766028491, "uuid": "080bc991-8fb5-4e3b-aad5-1344515fdb59", "comment": "Malware payload (Joker)", "value": "1000cbde32220c7d95bbd9683bffcd77e8e1da7f8118603eadd4f1b2a570b66885611762a95fbfd9ab86f5a575a2691a", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766028491, "uuid": "84afe708-93c0-40bc-837a-8370e07e7c02", "value": "T1B657F14BF61CD82BCED6F07CAD96076232267D948291D3172415B22CBEB76C84F667E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766028491, "uuid": "04e1914a-0eb4-4a1b-81ad-2fd0306c7c88", "value": "786432:/RtJ4lCus8Rr27qW4tRkrB0mrZCczcLfY:/TJ1uvs7qJ/RmNhgzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766028491, "uuid": "edb5a1a1-4221-4614-8606-77125dcb6e52", "value": 28092137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766028491, "uuid": "fafc5243-41f2-4933-9512-93343e1acf40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766028491, "uuid": "9d0845b1-8571-413e-b239-9bba767e4874", "value": "AI+Storage+Cleaner_2.0.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a300dcf1-dc6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766101530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101530, "uuid": "5099527e-9e12-42f4-8143-b9803d52d4e6", "comment": "Malware payload", "value": "33e3bdebf5df9b53fe5b3f4c35e322ae", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101530, "uuid": "78458b44-a64f-4350-ad6a-b841824b7ffb", "comment": "Malware payload", "value": "93df35ec9e57a2e044147ce9037b613b96a8feaf4242fe6301dd9a2a68011964", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101530, "uuid": "11ef9304-69e1-4099-ac83-90a7f6916fa6", "comment": "Malware payload", "value": "897945c076bbc6fd3b40608756289be82b37a087", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101530, "uuid": "6ee74503-9c50-45ea-992f-16a36f6bad87", "comment": "Malware payload", "value": "ded0a7046d87202262615741a5eefe971fa503ac9027d51beddc0e7fdd05d279f4656b9f43383cb9328c0de387883cdd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101530, "uuid": "3a17c05b-b55d-469c-937a-d0e9d557f269", "value": "T159F47C30D2B71193DC622B747AEEF9347AA8FCD369E1681B04913D4C0A38D42D666B7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101530, "uuid": "f1c28873-b44c-439c-a7b1-9db99676e1e0", "value": "df7a8c015a0eae9e08c9e52fd7e541b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101530, "uuid": "11dfc0ef-db4e-402c-8411-d5d14739bb98", "value": "12288:jm/MWdeKoGTCKSbeO2+MyOuBhIQSmvJdOIDQe+Q+ha3sAmzoi9:jmEWE9GeOd1udSen7xL+Qs1si9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766101530, "uuid": "0bdd0672-7ba6-4f3a-8bb0-6037b72af040", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766101530, "uuid": "76859a0a-a19c-48b2-936d-19958fa50b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101530, "uuid": "f64c4f6b-f9b1-43a0-97b6-c231a63631b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b084ac9-dbf1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766048876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048876, "uuid": "450425c8-cd1d-4ee7-84a0-b4352073371f", "comment": "Malware payload", "value": "49fbdc400f4058b7e45422c2319b9fa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048876, "uuid": "7b6e7793-7434-4932-8c2e-0cf3c0bc565e", "comment": "Malware payload", "value": "9479dd68398c35f878ef03d13390d060883e80c288c157c6d8677ea1da699373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048876, "uuid": "0c53db6c-2ef0-42c0-b531-f56327fc0252", "comment": "Malware payload", "value": "ea4b4f64fbc3a86fb8163d5459b72c3760e12e9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048876, "uuid": "a555d43c-6b5f-492c-96a2-2a2fe2e07237", "comment": "Malware payload", "value": "0bb6a20333323e1b6a49b9eefa762bd1ea90baa224307ed11773625aef4d6844088a7341a648e3a69084bd964a590b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048876, "uuid": "4d9af096-01ed-46b4-9f58-d8ac77de735a", "value": "T1F7364A07FCA155E9C0A9E2318A669212BB717C842F3123D72B61F7782F767D06E7A344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048876, "uuid": "6ad2096f-637e-4c21-8aa6-d8885bc8b186", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048876, "uuid": "f1ec9758-a567-4e78-9709-68af858a6de2", "value": "49152:aUOuop5cQHDo2ht1TnKIkMstblbZlnTn/tJykhj+SQWK+K9KqqCasw14RQJ5EV:a6ybzOBh9JnDMXBrQ4RoEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766048876, "uuid": "b931df02-5239-41a4-959c-84882430b244", "value": 4948992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766048876, "uuid": "02e119f4-137c-415d-bab2-5d115a941217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048876, "uuid": "6a9f913c-eac0-4bf4-91cd-960853c43920", "value": "ssh2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd021261-dbfc-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766054007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054007, "uuid": "d8f5a25b-fce7-47a4-8595-afd18a7926a4", "comment": "Malware payload (PureLogsStealer)", "value": "be27796e8ab0967f155bcb6e81b1be27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054007, "uuid": "ad77f56c-f266-405f-9d45-f7e36e658a9a", "comment": "Malware payload (PureLogsStealer)", "value": "957ab5ff285cb072d03de9cb8438820bde79ce9dfb59400a5b98dd45f6baa50e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054007, "uuid": "2e493706-d275-44d3-9c01-51c46b6dd889", "comment": "Malware payload (PureLogsStealer)", "value": "a88a1683dc5559e252b3c054b5200980a565b964", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766054007, "uuid": "c319ed75-8396-46f3-b703-eed49cb630f1", "comment": "Malware payload (PureLogsStealer)", "value": "2cab6f449027fbe7f26c01718bb0f440b8ca76ea3c2aa76aa883bb0a3450703f5bf4a48505cffabfdfc7da58b43f5c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766054007, "uuid": "af8bd0b6-2b2a-4b5e-a200-354a982272e5", "value": "T1B455ADB6AA865F16CC3028B80B7397F99F6C0D13F500DA9259D6791BB9BC280354E377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766054007, "uuid": "d173b424-3b63-4d5d-bc9e-55bc11a7cdea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766054007, "uuid": "dec5cccf-ab12-400b-aa56-7d2e1fc0f1b5", "value": "24576:Jhb0v712kBeE6gghSS5IvOjValBSTRdLEdDd5VjVsgTGxdzCh:JVo2kBeRkS1j8lBSPLiD1jRyjGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766054007, "uuid": "9f987231-1ff4-4756-a24a-0c971461fe53", "value": 1340416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766054007, "uuid": "e10c3e67-684d-4226-9da1-fceaa01c01b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766054007, "uuid": "e9be8d2c-f018-4356-9831-207e3f1fa46e", "value": "INQ-N046687-12-2025.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e2dd76-dc13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766063818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766063818, "uuid": "8f711792-3884-4e35-b193-f74ceef8fa35", "comment": "Malware payload (Mirai)", "value": "8df24bcc92cc821d61edcc14dc25848d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766063818, "uuid": "44e32723-382b-4780-b3c8-ecaa87af61e4", "comment": "Malware payload (Mirai)", "value": "96928c218875f3acce550804fb85890559953a382d80dc67864d8c1c8d64465c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766063818, "uuid": "e6741e4d-698e-4207-80f9-70a8abdc21f0", "comment": "Malware payload (Mirai)", "value": "ddd642f29e6f72c4d4e4097979dff1f477dc33f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766063818, "uuid": "64ea38d9-8dd7-4403-be94-3beec528d8ca", "comment": "Malware payload (Mirai)", "value": "985b1e1d723ac83720d83ba780bfab83c3bd0f0bb3373bcccd210cc590c3dd0fb3f47f59fd3fdc9c0d0595db3ecdebe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766063818, "uuid": "f957c8c7-b042-4c65-950c-fdee372ddf2c", "value": "T1EB83080273080F47E1532DF02E7B1BE087AAFD6219F5B685A51EFE854231EF22546F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766063818, "uuid": "95600822-bb62-4426-a43a-e184fbaa45a7", "value": "1536:0KBE+QGfYYRnpVHpONSbS9tZl18OJiFruDUQAl61d6+3vQ:0NDGfVRbJOpb1LJr04v3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766063818, "uuid": "990c2943-2c3d-4a55-8da7-d96ae7262593", "value": 84356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766063818, "uuid": "e827b125-83f1-465b-92ab-7916020749b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766063818, "uuid": "f8fb1b35-0774-43ae-a0b3-1fb2ed53c0f0", "value": "nova.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7a654c-dbef-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1766048291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048291, "uuid": "6ac0f4f3-2abb-407b-b437-e2f122de0956", "comment": "Malware payload (CobaltStrike)", "value": "96ff9d4cac8d3a8e73c33fc6bf72f198", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048291, "uuid": "177126e1-3085-43e7-9252-8f0dd130ce87", "comment": "Malware payload (CobaltStrike)", "value": "96db5d52f4addf46b0a41d45351a52041d9e5368aead642402db577bcb33cc3d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048291, "uuid": "10af813e-36ff-4141-93bd-4162c2c29422", "comment": "Malware payload (CobaltStrike)", "value": "17d7edf6e496dec4695d686e7d0e422081cd5cbe", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048291, "uuid": "cb679419-eef4-4279-885a-0359fe76e55d", "comment": "Malware payload (CobaltStrike)", "value": "e39937fd625ce129c4ce78eab8de9eb880b2a6efd1fa7d6bba5dd3458b33639b4e4c647818e24dd88825671365168ece", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048291, "uuid": "74c55054-dac3-41dc-8369-85aa9762100d", "value": "T1BB830215D68A7727F17BA93C080950F3E2666142C51D2A17F90DE3AD228C4DF2F0E9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048291, "uuid": "7693876d-eb82-42e6-bc3d-44da04a87613", "value": "1536:lDZnLvdWcSVUj473eXfb6K3ABfSlH+ArfocK4XEorNColhVDo8NYzyReCxRVZs+x:vDAzVY4zSfb6mABfSleqocKg7Bo8NiCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766048291, "uuid": "d6b38c75-5261-4ee1-ac9f-e87a939e1d8a", "value": 88417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766048291, "uuid": "9b376868-7b3d-448a-95c5-48e60afa9b64", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048291, "uuid": "b3e5c7c2-7d2a-4d28-ad8b-52565c65328c", "value": "CobaltStrike.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc5e64b-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053018, "uuid": "55b0fcef-69aa-4c86-9a91-bf541ad5f31e", "comment": "Malware payload", "value": "7212d28cc8384ea9c4998f5791f5d6c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053018, "uuid": "b8bad211-412c-430a-be25-5bf4b6c7e890", "comment": "Malware payload", "value": "976d3dbb29ded7acc18890d2fcce151dc8ed74cb8cf870e42f1586b795af4a75", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053018, "uuid": "b97c6dd4-1d65-40a0-8e83-2724b9c1ad15", "comment": "Malware payload", "value": "3c35c485926cf99a08fd2d0e34f14316d3da8e3f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053018, "uuid": "9a50204f-06bd-40ac-961d-db448dad041f", "comment": "Malware payload", "value": "d8ebeb130c0e45d6ea93d10a2d0b57c7c98f22f8a9801ee430145e01694cf77f111302c7bdfc1cda3ae5c3e0e8762393", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053018, "uuid": "4095cd34-c676-4899-a407-f213a1c67378", "value": "T1571600E7A2689096F52C0A20B99D7914775D243BBF0B1D9C3D7A02DDCFA08B35BA1335", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053018, "uuid": "91c43028-a208-4349-bfae-b7f313b7b85c", "value": "192:Y8Yhv0w+0U5RE5kcZCWI6eVA+58w8B/K0:Y8Yhv0w+0U5RE5kcZCWI6eVA+58w8B/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053018, "uuid": "e3ddac77-623b-493a-ba71-8971ad341b46", "value": 4410489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053018, "uuid": "e1fa98e5-c542-48d8-b70b-52973bc67fb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053018, "uuid": "8e86cb90-d30f-44b7-ae2f-3ae888f17a3b", "value": "QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2126dd1b-dbf2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766049343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049343, "uuid": "a8338cf1-b86b-40be-9cb2-d71a24b9784e", "comment": "Malware payload", "value": "ebdd06e27203393dec56bb99cdb0cb91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049343, "uuid": "cf88d506-b076-492e-ae56-cfd2f7191afe", "comment": "Malware payload", "value": "989daa79bd180ac90d4a74a372878966c0171692a119df09cf68f62c4cf3c0fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049343, "uuid": "fac10ad4-b79d-4b6a-bd57-c9ed3a8fdf7a", "comment": "Malware payload", "value": "b32a3cdd5fe6b9c1be4e18d48a8a0dade56a6f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049343, "uuid": "9bc5b8e9-7822-4a43-8443-041a627bdfe4", "comment": "Malware payload", "value": "d15c41c287fe9731f0632fc79b9aa43dffe2d6b21bfb0556ed7479caea476ef4e007f85554deea223bf77158ef18c4a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049343, "uuid": "86814c42-71d7-45f8-9c4e-0381224e9683", "value": "T1F995C037B122CB6CC0CBC9B864E386E25E307E140AB5524656CE1B5F2E73D906E5D98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049343, "uuid": "7ac64bbc-80fb-4be7-ae5f-c1be78f35902", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049343, "uuid": "6b0f9916-0920-4bda-b176-1aba30fc5dda", "value": "24576:gfs4r7YFz75ELy9vS9/aOHR+Sf3TRWLyvt487diDxa/+0y7W:asa7anKy1S9/aOHRnPT8Lyh7sW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766049343, "uuid": "c956216b-dede-461e-824b-17db5e98719f", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766049343, "uuid": "e75f853d-8f24-4d80-9066-f67fc40ee68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049343, "uuid": "3cddaf66-750e-40b8-bf25-dd56c9a65a83", "value": "temp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed92a81c-dc36-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766078892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078892, "uuid": "c6b324c9-2c60-4bd3-867f-4c06f10d63b2", "comment": "Malware payload", "value": "77371cf63c40a1f2bdb07646f27b1112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078892, "uuid": "4bf756d5-21bc-43e4-8dca-c5bf554aafad", "comment": "Malware payload", "value": "9993ae862e80930fc460454ed36f9811ab106eeb4731a6f319b3f9a09b284ae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078892, "uuid": "86d3c6b9-54fe-4449-a2d8-93827f0bb116", "comment": "Malware payload", "value": "14992b634a069d5358f1ebce3ccfee7b115dd66d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078892, "uuid": "cb31253d-c85a-48d7-b4ce-fb28612ce428", "comment": "Malware payload", "value": "f99c6f0c21954e29d804fcc19ed07eef2c000fe5924d8df991c845eb0e1d4ca3ff2bfa9b8993580e5429eb80d9566439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078892, "uuid": "5c5a2b0a-f4b6-47d2-a79c-2319f4c68c26", "value": "T15935057162F8C2E0D1AAB138CD5775F49561FC01CA209E4F3E947E6A3A32251F93A72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078892, "uuid": "ded53292-186c-4c19-844d-69df31b46df6", "value": "e1ef94fcb4a00cf7efd22c87fc01e13c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078892, "uuid": "0b93eb90-1380-4e54-9161-307c34a18ffb", "value": "24576:Qzfe8F2AnwPPMw3KEPcDVncfJzlCRpCHTX:QzkjcDVnKNlCpiTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766078892, "uuid": "23e3f562-ed96-4077-9d14-8e69943cd581", "value": 1072592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766078892, "uuid": "8feeb8ed-108e-43f5-bb90-3fe7c8f68c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078892, "uuid": "b849cb35-b8c7-4bb3-9886-6cdffb5a6375", "value": "LEBENSLAUF JASON KEINZ - VON ALL.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c393c35-dc0a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766059616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059616, "uuid": "08d7cbeb-bf05-4aeb-985e-3f25da1d62a2", "comment": "Malware payload (Mirai)", "value": "b2cc4504dc5cc9137828dcc22d013115", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059616, "uuid": "3d1cbd7c-0dfb-46a6-9e8d-2e7d52ffcf13", "comment": "Malware payload (Mirai)", "value": "99a98ba377f54ce79cda3d3efd91bd8fe0c5e1583a5b557b460709f2f73c07a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059616, "uuid": "f71c5bf7-30f0-45f5-a6ff-a211279cd15b", "comment": "Malware payload (Mirai)", "value": "fa0ec9abb53d22fa2638751fbc8476e1667c90b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059616, "uuid": "e52659c7-a8db-4424-aeaa-303371ca704c", "comment": "Malware payload (Mirai)", "value": "253aed9fe991a830c36ddf6fb5af4637843861eeece025224f263e38f236f33ed4b9523b0db0f523f013a319cf7ac82f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059616, "uuid": "c79f35f9-a6f8-4a12-9afe-6d56906862de", "value": "T107A30606BF110FF7D85FDC7706EA0B01298CA91B15A63BB57534E858BA4B6CB19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059616, "uuid": "81f38457-485c-4152-ba94-9eb5e74cb796", "value": "1536:WmR4bkFj8v2VWlrL4XE+QIeMpIEkLS6Myzs7Zk3g6gl61d6gnQD5:WmR4JriLpTkLhyCg4JS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766059616, "uuid": "f3cdbebc-18ba-428e-89e7-028277be2004", "value": 106756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766059616, "uuid": "f7614023-183d-4207-a7c3-372b4bd31384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059616, "uuid": "ff698083-2ba2-4843-b891-24df7f6a742e", "value": "nova.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d7273a-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1766052406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052406, "uuid": "3f0c4c8a-d8d6-4a62-933a-3fc93b31f7e6", "comment": "Malware payload (SnakeKeylogger)", "value": "56263b8d253128ae243057ad3aa0f25f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052406, "uuid": "5d0415c1-8478-45b9-8661-6329927985c6", "comment": "Malware payload (SnakeKeylogger)", "value": "9b469e1380ae0f4077513feaf35df27c6d039f80b8c555780e29be6e957b40f3", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052406, "uuid": "b3ff1554-4667-4375-a534-d945aaef7ee1", "comment": "Malware payload (SnakeKeylogger)", "value": "91a52275e6cb2b32532a0c6310221e66607d5126", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052406, "uuid": "348d2669-8e21-416a-9f62-4ecca7049033", "comment": "Malware payload (SnakeKeylogger)", "value": "3708ae4fb1d68cd6d58b08e9755c40df7190d9775cc17f9aba9260d01ac9c6089af69c713c842c83e61a88d4854a4149", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052406, "uuid": "15df4437-ddb8-40fe-be47-010be8172ffe", "value": "T1016502118D882FB5CFAC9A1C90BE121E93F04A9B505AA58EFB37BD079FF7644521F085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052406, "uuid": "82259a9a-1139-4d2a-9a1c-41fa867ec0d0", "value": "24576:iuDURsm+zSuPyJbS9u1pncYMOwG9NHk2n7otJIRfq2vfKsdIm3XqNyqY:3BTfu1puK2IRjKs1HgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052406, "uuid": "291fe694-5040-40da-920b-7f079ccbc6cd", "value": 1466668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052406, "uuid": "0223370b-10d5-4fe2-920b-542e2aa66355", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052406, "uuid": "62e5ec38-0765-40da-ada4-8ba3e21c37f4", "value": "PO PUR-2504003.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db91c62-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1766052531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052531, "uuid": "bc94f34a-f214-486f-859e-150415f9b49a", "comment": "Malware payload (SnakeKeylogger)", "value": "64fb2d52222ca958add6a34de2cd6d31", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052531, "uuid": "7ac3b1ce-a7aa-4f18-a9e5-045fac198aa9", "comment": "Malware payload (SnakeKeylogger)", "value": "9c2ae3c61df899184d2050c940624808ac6c10b183327f651ca4a2e12886ef47", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052531, "uuid": "3260e444-d5ab-4a95-b80d-4320b3344700", "comment": "Malware payload (SnakeKeylogger)", "value": "38af7eca949570ddb6899214ff520f3f88e7e701", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052531, "uuid": "0ed07387-d32a-4e32-8dcf-23e12b3cf088", "comment": "Malware payload (SnakeKeylogger)", "value": "b1fa04392461754f8366f296c3e500710d1b0e7c1ffbce8370363b30b9f6b74be2cbcceaf04c64621b77414b2f9585c4", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052531, "uuid": "829506a0-5132-4361-8a47-2882746704e5", "value": "T1FE6502219D846FB5CEA8991880FD161ED7F0468F4426748AFB3BBD4BAFE7604420F1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052531, "uuid": "b81ffc9e-8f47-4539-a8f5-6435204397b2", "value": "24576:inoDaaHEM/5EqzYrslQbAB5Og3ITAysBjTchdIya7F8:vBfutcyejWdDKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052531, "uuid": "e767338e-ea62-4abd-96b9-5cc4c3727024", "value": 1466668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052531, "uuid": "10d7d755-655c-42f9-8632-404eaeb89312", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052531, "uuid": "3799f5d4-2866-4061-a991-e3c561fc376d", "value": "PO 4500725711.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c646fa11-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092570, "uuid": "923e3b27-c742-4b1f-8bd2-006b9f1264be", "comment": "Malware payload (Mirai)", "value": "1282a132161ce37e76614c845c480355", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092570, "uuid": "566058cc-330a-4e07-8425-e514aab53872", "comment": "Malware payload (Mirai)", "value": "9c2c71084ec60f3df3fb5593d171e415af377298eff7f4bc4475be22cddbab25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092570, "uuid": "a0242184-a502-4d61-bdf9-a6dd9dc03d36", "comment": "Malware payload (Mirai)", "value": "c1478d7b97634e1a0228af4a0a87392ef59b49db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092570, "uuid": "5980773f-6e4f-4b74-a953-8a944912eaa6", "comment": "Malware payload (Mirai)", "value": "5078c4a984f994e64e9a10ad90082658c58af38afb1265b94646645932b0656867de531893193ed4394ed2f78fa15250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092570, "uuid": "16b86927-d455-4ea4-b014-260fa820317a", "value": "T1FC430264C3C38A70E702B8789A6BC458FAC59E7AD4F91C132E048E723E46D15D7E8746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092570, "uuid": "c44563d1-b7b7-4981-b824-c18669ff3d7b", "value": "1536:EPS4tGKcEtFCIML8P2uBXyP3D5HaGjLCYYH9rD:EPltGr4tMOxBXg3DvLCYo9rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092570, "uuid": "647002b1-3501-4aed-a9cb-badc6c5748b3", "value": 59072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092570, "uuid": "881bbf6d-2d2f-4d4a-8129-a6e396556677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092570, "uuid": "e98e5bdb-8829-46f9-9599-e4a2eeac1928", "value": "xparm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0b3769-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085276, "uuid": "4d3b7c17-8e1a-4074-8824-fc4ebe1404f2", "comment": "Malware payload (Mirai)", "value": "514330e82f77078dc0492fdb8976fa75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085276, "uuid": "152979f3-5c0c-47d6-a12b-6cb9f84bf241", "comment": "Malware payload (Mirai)", "value": "9caf7e8ea62dc00f3f2625592cd92cb97e222aaf1c3dba4ffdae04fa937bee8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085276, "uuid": "1af5d4f2-9771-45cc-94d6-33ee8f9bc360", "comment": "Malware payload (Mirai)", "value": "c03d0119f2e06e46f25832bb6840a41543e8a8f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085276, "uuid": "3a790399-1427-4b5d-abac-0bf57dd13dac", "comment": "Malware payload (Mirai)", "value": "9fa2eff46228ea01ead18519f64812bc9c7a203b5835450757648de8ed001ed2ca05980fa90f6bba0efabde99f06c848", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085276, "uuid": "2bb2e121-0a82-4ea9-8256-ba15326bc187", "value": "T1895302E2E6B8B870C4746277B0B8D885E5405F7D192668AD17EACEC4FAC2141FB38874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085276, "uuid": "3ef96080-213b-476b-8d66-3a15936f55a9", "value": "1536:+WBXGhRo6Y6ogDByf7m92JyQR0L102XBTCA2GMrxipjVtaX:+WV76PZyzmSyQmL/XlE1opxtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085276, "uuid": "5c9992b7-5576-48af-a2c3-3e4efa253a79", "value": 62940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085276, "uuid": "bb81faa6-90cf-4c97-866a-ef13e3a48735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085276, "uuid": "66706bcf-d5ca-4fb8-ae90-e2f631e60a55", "value": "byte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07934d1b-dc5a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766093968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766093968, "uuid": "2c1b7ab1-dd54-4e7c-a41b-e55bae681125", "comment": "Malware payload (Mirai)", "value": "8c4f13c8b06d2005db1eed46e9be0d1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766093968, "uuid": "9288255d-ee4c-4346-9966-a995d56f03c1", "comment": "Malware payload (Mirai)", "value": "9cb2beece6422be8aa96fa8db050b57a21a2cf16741839e9c2d9567bf7102908", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766093968, "uuid": "b61cc11b-258a-4f84-9df6-27a153243bff", "comment": "Malware payload (Mirai)", "value": "31b5a61e81b06f501834f001d8f2046203486e91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766093968, "uuid": "abfb677d-fab9-43ae-b269-302d97157400", "comment": "Malware payload (Mirai)", "value": "c874e16baa55cbbe692f1896a5cb40f09f771221d8d8f21db039ddec3bf4273414d6c94468f26d27c3358701e9061064", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766093968, "uuid": "49bde44e-0007-48ce-b717-9a856767d782", "value": "T1EC241845BC918E2BC6D123BBFB6E428D372667A8D2EE71139D215F2037CA85B0D37641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766093968, "uuid": "7e469760-9a61-416a-ab82-774ec148fe2d", "value": "3072:5EPQEu8uxvNMb8xK5FJpWakL9B+qpKa5lNUCsR8fccg/9m:5EoEleMbUK5FJpWfz+OK6HUCsR8fbgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766093968, "uuid": "724361d0-c6e4-4694-b4de-2aa1ef4e32b9", "value": 226916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766093968, "uuid": "c6aaa7de-db35-47f8-b3f2-587d3db0a568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766093968, "uuid": "ae64cc7c-d5f2-4ecc-9396-e7ccdfbfeb63", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4278a86-dc09-11f0-a129-42010a9c0007", "comment": "Malware payload (BazaLoader)", "timestamp": 1766059575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059575, "uuid": "63f55025-7faf-4a21-b9c8-329fd416f5d0", "comment": "Malware payload (BazaLoader)", "value": "f932caa25a2a737e6297bbff229c1863", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059575, "uuid": "66e20338-ca67-4be6-b3d3-b3c180d55574", "comment": "Malware payload (BazaLoader)", "value": "9eb3b1639e9892bee1d9ce4917e27c219a20ac96926695e21626821f7d8574ec", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059575, "uuid": "90111929-7f42-43fb-9c1e-12cac7384c8b", "comment": "Malware payload (BazaLoader)", "value": "0ac6ffab6253b59a733403fdc8bf08538b66e59b", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059575, "uuid": "feca2bb6-c738-4462-ac44-ee282e004d91", "comment": "Malware payload (BazaLoader)", "value": "ccdb215494dbc2f08fedd5ae9b88811318bc87320b31494ca0f5ebc6508f917f825c4af7f9e1b244090b8adf09a7d678", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059575, "uuid": "acee97fe-1884-4caf-8ede-9ce17c3d9a84", "value": "T19BA66D92AD904A69D6AFF339EDB252952330B804033124D77A9537A94D77BC4133BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059575, "uuid": "600f57d0-a87f-4b01-9821-6fcb2ae1ee5e", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059575, "uuid": "10f4f45b-c645-4b17-b0e4-059c5b244e0f", "value": "49152:MLcAzLrEsB5FIAlAPyYYX7e9MMLtPm1KxtQAYH2VbP7DSAX0TANMTJDTGfA9infd:MYy9JFkSA3fAVapsP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766059575, "uuid": "fc92ff4a-127e-4882-bc58-bd414b482c75", "value": 10256704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766059575, "uuid": "4adb1af1-43e4-479c-9ba3-c693ead70d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059575, "uuid": "55dfe01f-e257-4aa7-8c51-87bcdd32699e", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de8c73c-dbf1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766048881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048881, "uuid": "fce7a757-4afc-4bd8-9a73-571a09ab0bff", "comment": "Malware payload", "value": "179cea8d8102e02d6dc18b05266bb8a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048881, "uuid": "670f78cd-87a2-4fa1-8d51-cd57cc98be0d", "comment": "Malware payload", "value": "a181eacbcae36dbb6aa77174689ce224bacb9208e87a53148f1009f90ab432e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048881, "uuid": "47bebd0e-dd0e-4b40-b1fc-f8d816305609", "comment": "Malware payload", "value": "11e8070be033faa18df094e3900ff7080f16087a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048881, "uuid": "c9b6e4f0-89b3-4a8f-8aa7-d70cae42dd83", "comment": "Malware payload", "value": "f91a6be5cdfd1d893c3f9388aa3a1fe38d055cc17e808a37aae2aa634731c50b7245c28f83e37ca24af6dc97c79b3788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048881, "uuid": "cd52cd00-ddb2-4f6a-9e54-c95b5e9bf8f8", "value": "T194062903F89581E5C1AEE234CA66D292BA717C841B3123D33B10FBB92B76BD45E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048881, "uuid": "6c7cebf5-2306-42c5-977d-d9f3a11b088e", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048881, "uuid": "56c03ff2-0aa0-4df4-a973-bca8dc7580da", "value": "49152:uIK+w3Btrb/TWvO90dL3BmAFd4A64nsfJTCIKgHBlQJb2UNBL2HTfcqDzcW6If+6:23xG638W/gcKEEAZuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766048881, "uuid": "8d8191d5-029d-4519-9e5e-a2dff63d9de2", "value": 3936768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766048881, "uuid": "cc8a87fa-97ff-4a8e-8751-2b75b566b9b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048881, "uuid": "092ee28a-ba94-4ee5-8f52-5973864afd1d", "value": "ssh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de1ee0d-dbf2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766049337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049337, "uuid": "836df104-7809-4af8-b3f8-7d794ec18c68", "comment": "Malware payload", "value": "174b908cd325521b258e1fcb569684b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049337, "uuid": "0432887a-0d79-4bbf-9368-6f24afbc4b72", "comment": "Malware payload", "value": "a26f590d5d4083ff08c6fdddaf12a61a35cc84272b6560b0ce480539bb4eec28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049337, "uuid": "4b92fea4-68c9-4703-a8f2-f3b35932dbf1", "comment": "Malware payload", "value": "22f3c4ca4bfc25a69621b171dc90530e3f3bf27c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766049337, "uuid": "e026e2aa-937a-40ed-a5d9-3f6035aa6d63", "comment": "Malware payload", "value": "f5ef95a1737f77e60eaa90eb1600d5ac694d23942b799f0c08bd524c9161f603c14f67a31aa58f70ee16019e8c2f7607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049337, "uuid": "f3a889b2-90a9-4922-ac85-b93046bc00fc", "value": "T18E95CF37B122CB6CC0CBC9B864E386E25E307E140AB5524656CE2B5F2E73D906D5D98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049337, "uuid": "c36c8702-b81c-4e0e-9a4c-744a90157186", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049337, "uuid": "b7de8bf8-a65a-44a0-9e67-da609893adb2", "value": "24576:ifs4r7YFz75ELy9vS9/aOHR+SfysRWLyvt487diDxa/+0A7W:Msa7anKy1S9/aOHRnD8Lyh76W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766049337, "uuid": "a22c6466-d1e4-4188-a1cf-e41880db6ac9", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766049337, "uuid": "c8e8d10a-e83d-4f28-8de1-6379949c93cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766049337, "uuid": "0f8757ee-edd5-4296-9ab2-9c1306e28e85", "value": "cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb31f73-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085338, "uuid": "2d11275e-e3f1-4a04-9556-496caa441b3f", "comment": "Malware payload (Mirai)", "value": "daf7a02b6cb4bfa114953fd3371eea51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085338, "uuid": "02dc3a4d-dfe4-4b97-8b9e-2155c555c3cd", "comment": "Malware payload (Mirai)", "value": "a65e718e9adb45baa93b41f58cda112ba7105b36a9d71ad83ae34ee8c3456bd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085338, "uuid": "e8433515-9ca0-40d1-9b2c-044b93b0f462", "comment": "Malware payload (Mirai)", "value": "4ff446d504c88ae074d848a7d8a73b01eda680fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085338, "uuid": "9c925a54-7ce9-4dbb-be10-51197a0d892d", "comment": "Malware payload (Mirai)", "value": "053f80b61ddd4188760761a0b5318975728194e3d51af3a5234be013ed7fe4f48b87c740daf4b641ba9cfdcd66af4f22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085338, "uuid": "940d5150-badb-4a96-9ce1-8bb5084786fc", "value": "T1B2E31851BC514B26C6D712BBFB5E428C372A17A8D3EE32079D156F243B8B45B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085338, "uuid": "98a6cecb-dfc6-4e09-86d0-cf5adfac108d", "value": "3072:GfpRkprCRx5fstd9YX4s9H0tDQdGJ4jfcB4mF:Gfk9C+ji4sStsUJ4jfcxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085338, "uuid": "3d6f0e6c-eb50-4f5f-ad76-490f6b62ce8b", "value": 149036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085338, "uuid": "c33c8165-10fe-4e43-8591-aba7fc565cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085338, "uuid": "c9f9a47a-ade2-4511-9ada-092f58252cbc", "value": "byte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddeb91d-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092636, "uuid": "82f3c24c-b396-4647-9126-40aaabc5d786", "comment": "Malware payload (Mirai)", "value": "9f89d33e5367cd6bd12509aac99965f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092636, "uuid": "5d24fd12-f337-4ab2-a87f-586a3cb18817", "comment": "Malware payload (Mirai)", "value": "a76639e5ec05e6394636795bb2873c0127b0aa340d9f0f0067377263008d9dad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092636, "uuid": "31009ba5-0cea-4487-99f2-12f7cada074e", "comment": "Malware payload (Mirai)", "value": "0b19b44221af8a3584f6b65c0bb98189727a1291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092636, "uuid": "35403bb2-74ac-4ea2-9857-fc01c56411c5", "comment": "Malware payload (Mirai)", "value": "89e8200323bc1aaed0f3897f60e10dc7c2edf30eaadcd4ef76336598173ec34fc68f1abc2e9230039ce5c16f90613f6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092636, "uuid": "5040cb19-3a5c-4908-98a7-78a3a5493323", "value": "T1A0E2F14A88DCAE0ECA6553BC556E7780FA15A4A42F5F53016ED5CCC2A8033F5F131933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092636, "uuid": "afb66124-a885-434c-ba08-cfa1b33a7af9", "value": "768:WBbVkTrCrlN46JCSVO0smsL0AjDTK1xtltOF:KpyADsLjPK1xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092636, "uuid": "c343521b-05ae-4be0-8d6c-f5123742dc02", "value": 32276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092636, "uuid": "4d8a2ecb-b78c-46a2-b7aa-11396b5baf9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092636, "uuid": "43e57f86-9db3-4e60-a388-f33ce90aded2", "value": "xpx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7f4679-dc64-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766098407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098407, "uuid": "ad0af6f0-5ce1-49c4-ab6f-7554e16c8c3a", "comment": "Malware payload (Mirai)", "value": "730e9fb1333396dc7f2a1770b2451cb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098407, "uuid": "4318fbef-8e08-4212-9c76-8a09b3824e15", "comment": "Malware payload (Mirai)", "value": "a80e8ebc7b7449e3a95cfdaf71fd6cfe977081f1fb76834aae92055eb70f4b1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098407, "uuid": "5beb9c00-a86e-4fe3-8193-b0ed86ec32d7", "comment": "Malware payload (Mirai)", "value": "2c38a53eb20c6dca1c050d3e5b8e0ef9ac0a4610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098407, "uuid": "ad035173-fcb9-447b-aaf3-af08fffc7d6e", "comment": "Malware payload (Mirai)", "value": "5d5a998713abdf1dee5161904f8474ef746d2a2b70bb4765f7fb34bdf652ec72a21a28492aaa620ed739a2ebb47239f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766098407, "uuid": "52b6076b-2b3d-4f1d-88cd-be3ae78ecfa4", "value": "T104847E53BB064F50F11AA1B105F79BA57AE510C30ABA69E2D362CF917B022D47C1FEE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766098407, "uuid": "8b0deed6-8583-4575-8fb6-571f172fb10e", "value": "6144:/wYc9XUupXsFBQxB+m3pVaoEGonOOJ8FksN+TYCFF/rzzzLW:/kXIFBQTiolWOA8SsN+TdF/rzzzLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766098407, "uuid": "1d0c4742-61b1-4975-87b2-f7cd1cba5a7d", "value": 397660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766098407, "uuid": "00ddbeb2-a6e7-45fb-ace9-1580ac4e5243", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766098407, "uuid": "0f4fc736-d4e4-4428-ab92-113763071e71", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26e1ef6-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766052566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052566, "uuid": "911b101e-b709-4e75-81a7-b1acf9379b89", "comment": "Malware payload (Formbook)", "value": "c4e82e9efc94f7381dac78d2696e6a56", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052566, "uuid": "f87e52c7-7a8e-40de-b36d-f4d0ed46d75a", "comment": "Malware payload (Formbook)", "value": "aab48aa1f927bac0d0e9b7896943f906724f786666cc28038006737c8e8e58f0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052566, "uuid": "f57ba56d-f72e-4cba-be5a-5a936cf45d44", "comment": "Malware payload (Formbook)", "value": "6cfaa7cc0904095aaa0bf45801bbe66bc4340775", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052566, "uuid": "1340afd8-3f9b-42fe-935b-3e0ba73e9315", "comment": "Malware payload (Formbook)", "value": "ebc0dee41426635500bfceb9b2d163c3e3f1b984c9a381d9de60c1333f23d101ba43ff19d12542d4a37db2bfe1616370", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052566, "uuid": "fbcd064a-ea02-4660-9096-3fdc6617e335", "value": "T139A5BD5D84B06CD26014FEB4F685FFD7CCEB5385162707520FE4858A6322C83FAAB6A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052566, "uuid": "465b35e6-b79d-47d5-a21f-fed523594038", "value": "12288:CHPVnsXoJluE5W7Be05DGE/iK/vwYAIzXWl6RPnnZ57aNnnyAmzP+XahWH5taCw4:CeY7uE5HU/vVY8LaYpcJmhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052566, "uuid": "e54bbb8b-b6cf-4192-ab0a-03f38db60bfb", "value": 2120656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052566, "uuid": "fc71e45f-1bd3-4e80-ab94-4402a6a89111", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052566, "uuid": "93c537e9-5ddc-4f2c-b572-e513feb54bd5", "value": "RFQ 172025.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cae0ab-dc10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766062561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062561, "uuid": "c402535e-a9be-406d-a1fc-c5ed88b4abe5", "comment": "Malware payload", "value": "0fc5c62b3b6aa218a05996446f82787f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062561, "uuid": "b567a310-1b97-4c1d-8f92-23b4d2503bd5", "comment": "Malware payload", "value": "aceff7aed79e0619e045e3d3dd4f3564bfa8c32791971a802120d0acbee8829f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062561, "uuid": "2ff09977-c615-42e3-9c7c-1361ae92e334", "comment": "Malware payload", "value": "bf4252fc55a9fb5d2d2be64433118d64a78c5174", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766062561, "uuid": "e9fda9a3-52fd-44a9-b9e8-cd876b435f39", "comment": "Malware payload", "value": "284ae5640e3781778e6548553ce8d814de508c78f69f96a6f0cb539e3df3597b554fce52d14c8e8f95493c8c266b1dfb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062561, "uuid": "47ab0468-10da-4195-bf3a-94393e381233", "value": "T19EE07DF36D023E0C067149B089A885480966C142832191ED94A0DA1D514016EF40482A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062561, "uuid": "c354cd55-3e7d-406c-a3c4-ed5424fc01d9", "value": "6:hmRZHYuvQ69nubv7HdMGsVRc7hHLNKDSbMBM0uyz98bUa7923o2:wb4u469nGz9MGsjctcDSbz0rz98A02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766062561, "uuid": "6f133759-ade4-4868-804b-b3573faf743b", "value": 294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766062561, "uuid": "96663776-71b7-45f4-9f52-2f3665473114", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766062561, "uuid": "c313749e-dbba-4c07-9cd7-e43765576db3", "value": "file.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4a7d54-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1766052586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052586, "uuid": "99e5513f-3ee2-4f8f-b179-b6f78c31a8d0", "comment": "Malware payload (SnakeKeylogger)", "value": "6f5da7d67229923304b420914d20f954", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052586, "uuid": "5be4d3d1-3815-41d6-9dab-b34c32ee3397", "comment": "Malware payload (SnakeKeylogger)", "value": "ad0fafe0c982c19758536098624e6cc0ced9856c493a8ac59885f67693ad615c", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052586, "uuid": "d008eba0-1e2a-41a8-85bd-fa44c2cf50c6", "comment": "Malware payload (SnakeKeylogger)", "value": "f40d32784fe48dc7978a19046fc007a8de961dda", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052586, "uuid": "851a9bf2-e286-4d8c-a6a9-3ff83b074e0d", "comment": "Malware payload (SnakeKeylogger)", "value": "9b2fe07be6a4c319b22522a2c6280e9cb4f7a9b15056b82840cbab6c4a2dbb55bd3926058f5037c8ca124749310832ac", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052586, "uuid": "18099567-d962-42bd-b162-e2412287a72a", "value": "T1B8D46C8386F15D5636D3E455D81206902D8D1AE7CB30D4C69B3E7C8EAC36472C4BBBBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052586, "uuid": "4d5aa57c-337e-49c4-a56d-a13f64e400d1", "value": "384:WksXeWZJbjhepefc8eqLkY7VEnX0fLZiQixL:NxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052586, "uuid": "8260af8d-b908-4902-abde-623f46148713", "value": 654667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052586, "uuid": "5c01c5a0-f334-4e9e-b6f0-ba88def35f6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052586, "uuid": "29b84215-9587-4a93-9afc-78f4a34b31c4", "value": "dekont.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4a7b62-dc23-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766070432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766070432, "uuid": "83521d10-4dbb-428a-93f8-e7ab2f14f526", "comment": "Malware payload (AsyncRAT)", "value": "6507c9a87ddb7658473280a1dd46b50c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766070432, "uuid": "cd1653af-138f-41ed-b44a-ee65ceeb879d", "comment": "Malware payload (AsyncRAT)", "value": "ad14f3e10ababe1bc66802b2ba0e927639d50b8f4c8795009f0ecb9d7385644c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766070432, "uuid": "8a1b388d-bf03-4368-823c-7fbf70c4a9b3", "comment": "Malware payload (AsyncRAT)", "value": "2940dd79491a933d6e03c9a31675fcfde61c57c3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766070432, "uuid": "b00970e1-ca08-4063-b125-54ab656e6782", "comment": "Malware payload (AsyncRAT)", "value": "d174da6fd3590d296e7859faa7bfc5649f1f866c75bdd68a237cb8f3a59ec91cae09aee041e6c935d3de17bb54696751", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766070432, "uuid": "86c2c0f3-8814-4f59-8d12-9759da95f8b9", "value": "T1E5536B002798C926E2AD46F8ACF2550146B5D5372006DB5E7CC814DBAB9FFCA5A133EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766070432, "uuid": "fb6d33c2-e844-4f49-93d5-ccca9653f23f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766070432, "uuid": "d85c31a4-cc06-43df-9c4e-439ab9f54572", "value": "768:65G6KlZRniP/tkiY9Jquvwszp0aZeF1+ISCv7mqb2nJpwH1owA090qIZm8GxYVcD:62ZRAiVxpGFeGbbcwDA0WjGxYVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766070432, "uuid": "89962811-ac82-4b48-b103-818a3c180986", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766070432, "uuid": "fc6e5449-c389-453c-a703-ff3a2b516105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766070432, "uuid": "a4a635e0-32cb-4064-85f6-37b835053dcd", "value": "microsoft_support.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a845402c-dc1f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766068897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068897, "uuid": "66dc383e-0c44-4fd9-a93c-ff3ba44f6e0f", "comment": "Malware payload (Mirai)", "value": "a066857ea6d9746543dad226e541cd7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068897, "uuid": "592c62ca-5826-40f6-8e10-74e7eca0e6e7", "comment": "Malware payload (Mirai)", "value": "ad15685f65cffb8efb629da4f74973b65406c744aff5cfd463e674f337490467", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068897, "uuid": "853dab76-a1d8-4520-8dbb-318d1271a2c5", "comment": "Malware payload (Mirai)", "value": "3c9bbf0c23ef06d14168dd52e582d805d8cbb778", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068897, "uuid": "aaaf9647-1821-4d97-b5f9-c4e84da5eba7", "comment": "Malware payload (Mirai)", "value": "8765c5498ea286de8c850b1edb0893ee19774a53f8d10388950e30f05311c897614c9fa1ec6efbfcc20b4faeac4d34a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068897, "uuid": "568ac9c6-3570-4eff-bd45-90e263f4a358", "value": "T117131956F8924E26C2D4137BB67E5A8D3370A3E8C3DFB217CD506B61B98640F0D96E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068897, "uuid": "58cb69a3-9caa-4a88-81aa-7949edd05b5c", "value": "768:0SM3TU2VvG5lMFL/7mUPaNrAL89GLJamto7+PYvotTVMP/OXRMbziwvwbZn:RMA29G5yF7mU0rR8toyPYgV8/OXKzvwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766068897, "uuid": "3c55f3f2-f98c-4611-a9f6-36da1cbb9f3a", "value": 44624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766068897, "uuid": "7b73366d-5807-4b1a-b79f-161167d50693", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068897, "uuid": "f9229937-6fe8-4d72-80dc-bcaecac54a7a", "value": "skid.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90c8192-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085273, "uuid": "c1411293-6146-4dc6-b0da-fcb870bdd341", "comment": "Malware payload (Mirai)", "value": "92c29d23c4eaa53fbedfa89223c84a49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085273, "uuid": "6c9ab100-c857-4fbd-b9df-5f04e2473dc1", "comment": "Malware payload (Mirai)", "value": "ad80a73c60af7494dc06af5c2ddbb7abbf4a67adfba3d81dd76d35d5de2b44f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085273, "uuid": "259cda14-e583-4d61-aacd-6a2868aea732", "comment": "Malware payload (Mirai)", "value": "9ac843c79c6a88c240d9aec9f4e17a6138245c3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085273, "uuid": "afde289b-06b7-4229-b607-ef9ff0c1cf99", "comment": "Malware payload (Mirai)", "value": "e59344517249e2f7841ae2633d2b07124cd91891b37ad7697d1a1d2a1be69ad116c34c103aaec8f15a7d2c413a6ce0dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085273, "uuid": "09c0f3c5-a47d-4791-9726-64dc4f2fbede", "value": "T1845302438802FD60AAB09E36997095994CD71E7AF62FFCD35A30E94CB5CA1CC9D390E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085273, "uuid": "cdcacb48-65b9-4a1e-98c2-ef45f28b0244", "value": "1536:A6zgmeq8ZUcrt2fuCzXXrapQMGoyy4dsRNjhTAHnuJI8OsLu:ymXcrazXOrmqRNF0ulvLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085273, "uuid": "fd16e997-bf1e-43f1-98ec-d182c1c3d563", "value": 61360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085273, "uuid": "c6b9e620-3204-436c-90ae-2fc226078f20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085273, "uuid": "fda8b964-f913-4e2b-81cc-170958abe91f", "value": "byte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0923ebc-dc6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766101633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101633, "uuid": "ccc0a563-7ded-4659-8379-9fb60fbc9832", "comment": "Malware payload (Mirai)", "value": "96c93d39473e2652c57672ebbb9394d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101633, "uuid": "d7be6d54-9b63-40cd-bb81-6a5474b225f4", "comment": "Malware payload (Mirai)", "value": "addeb4808b1c4867b76c536aca0be43effceecc3acff0805822db25c6114a430", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101633, "uuid": "832101bb-4a80-41a3-9355-9a97f69a89c9", "comment": "Malware payload (Mirai)", "value": "d30a9d5835fea3667e39afbbc34d363cd89d9649", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101633, "uuid": "de0460cc-c55e-4896-90b0-5b09c25ef97b", "comment": "Malware payload (Mirai)", "value": "b072f5bd43727f23c387ddaf163f25cb05d96393fa184816a497d4272e3a93f7a3f6d58927f188079fbc615b6471a585", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101633, "uuid": "14fd1b2a-6368-41bc-bd3a-f27c18033f66", "value": "T1CCB3E551BC82866EC6E223BAB66E528D332177E5D3CF7127D8604B243AC561F0D67F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101633, "uuid": "8af8ca69-b45a-484d-9459-dc79e74f959f", "value": "1536:VF9dqT+s//i6V0UPfjpEBD55aJ8XcAp5hDB4gKmGvqTfJSfJ91X/1L/kWvpx3zRU:VwT+s/HV0VU88vZ1X/9dn31/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766101633, "uuid": "f240df3f-0320-4885-b8f5-3b0d3856d30f", "value": 117176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766101633, "uuid": "320287f9-8722-4ac1-8ba8-52506ed10cff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101633, "uuid": "9fb34926-9076-4755-a4a9-8fe0b06481a6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9647f2e6-dbf6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766051257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051257, "uuid": "9cf7cc45-1f11-4891-b69a-e8f6255676fe", "comment": "Malware payload", "value": "bfbf0e994dc488853375f8c9dffc65b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051257, "uuid": "bf79bdb3-1260-44b5-a64a-4a9a6ca27798", "comment": "Malware payload", "value": "adf81fd6875f52e358044a7adaac9d56200fe6b019508c84ecf2cd47fc855a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051257, "uuid": "aa2c5e25-5c25-494b-8c64-20925782d502", "comment": "Malware payload", "value": "681a5e3373a3a9f49ac586d048a25709e68ca792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051257, "uuid": "7c1bd68c-874d-4ce8-b1d0-5aa845581473", "comment": "Malware payload", "value": "ec9e827e0a7e6d8d956270e5734b40be88c80c7c23a113dba0f0bee04d3b5f67a9c3d2210cc0e4a8413beedee1db736f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051257, "uuid": "cc1ec0dc-b813-4adc-81d1-00942d9e01b6", "value": "T13AF6122236D55E08D0B387F806A2D9B997337F1A2535D25A20F5BE87FBF3A414C0664B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051257, "uuid": "aadd7675-8227-472a-9ae5-402023d04750", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051257, "uuid": "6e915b14-72ad-4768-8fc9-9b26e5b5d61e", "value": "393216:i7F7QNH3hGZSLoMkCLQMWu0VwCnzo+vSe7PEmrkSB:i7F7SXn8cQMWuCzie7P9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766051257, "uuid": "ec066a6f-66ba-460b-a5c0-70f5c4d9f2c9", "value": 15466496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766051257, "uuid": "ac85c3e3-246d-4fb3-a552-f79f84ffadbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051257, "uuid": "83e782ec-f056-4988-a957-5d3cccaa1d7b", "value": "64th Services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af24e8b-dc6c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766101785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101785, "uuid": "71320e46-f92e-4ae6-b18b-a3252bc2b7ff", "comment": "Malware payload", "value": "90c540086b27688dee1c8b5688827e85", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101785, "uuid": "13430c05-9daa-4410-aea3-355b734e2e17", "comment": "Malware payload", "value": "b198e083a31b209adc0c7904919768078723d7202c7cbd068213627590a9709a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101785, "uuid": "ea9876b9-5a96-4c1f-8d5f-2fe379852349", "comment": "Malware payload", "value": "9ff9bb42130f771480234d26a252568090960581", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766101785, "uuid": "2e70576b-eeb5-448c-a623-a4c30ddf09ec", "comment": "Malware payload", "value": "fd8b0dba15e3f428a0b3b52f96ca523d839228329c5e9e6335c44314e1879cd34d16bbce8c48e3ac94e915cc4035c963", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101785, "uuid": "3cf0018b-476c-4186-9cf7-12ec11d06757", "value": "T1BA187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101785, "uuid": "b445ac63-4bc8-455a-81ed-00b73ec5492a", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101785, "uuid": "4df41e9a-a7ad-48b2-a683-7f8252dfca58", "value": "786432:lAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:lAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766101785, "uuid": "c529ad44-0d05-47f1-b48c-7430c76645c5", "value": 90424832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766101785, "uuid": "7c163297-c5f7-42cd-889f-ff2033ae7568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766101785, "uuid": "e39cf567-b920-4264-850b-680a26ae275a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f06441-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092571, "uuid": "0e809f5c-d43a-411b-831d-48e353b08894", "comment": "Malware payload (Mirai)", "value": "0daac12d5b9fa439baf89013c5069fd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092571, "uuid": "38e79f44-1adf-4b9f-91be-d0071fa96807", "comment": "Malware payload (Mirai)", "value": "b1fc3796b8cb3d426fc74e6d9f06637ab1643f071283dd63ac8a1ce5a26f0834", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092571, "uuid": "a99ab8e2-102d-4939-bf83-abd4a0d393a0", "comment": "Malware payload (Mirai)", "value": "1dd9d2d7e4c0ee593c1ff16514d49c6b5e5b06b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092571, "uuid": "1790b45d-4501-4dbf-9ec8-fba0c3c43e07", "comment": "Malware payload (Mirai)", "value": "70fa9eb238fb741d722ee693351aa0b28138594dd15180db9a8c5d7b1bf1d01a3202db5948087e54a843e8930a7bab5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092571, "uuid": "d725d464-3dfd-4342-a708-436f10ac9fba", "value": "T1F253AE77C8396E64D25581B0B8748E792B53F88482571FFE1A99C27A8047EECF6483F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092571, "uuid": "49ea18e9-75f0-4a43-ad05-b79740f0c536", "value": "1536:caCwtuAPFqcgdEcA5KU3AwHup+CSXHld5Zo:c58PMcgahAUHup+5FPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092571, "uuid": "75c8f378-44cc-47fe-8d6e-28642f52f22a", "value": 62948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092571, "uuid": "aab41f37-8dad-4aab-89d6-42176bedb0fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092571, "uuid": "789bc2a5-403b-4c51-a2eb-2928a85b67d1", "value": "xpsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23cecc8-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085342, "uuid": "dd7ebec0-a0be-49cb-9cc8-a2a1808e506e", "comment": "Malware payload (Mirai)", "value": "123688000794c610e44a867e91199cf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085342, "uuid": "14b8b4bf-199c-4c1d-bbb4-0dab6edaf0b3", "comment": "Malware payload (Mirai)", "value": "b2c2a8614f7a40898629c336a18a47ca796d5746076511f98288da6691a99a8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085342, "uuid": "8284358c-160f-4884-9203-886139724771", "comment": "Malware payload (Mirai)", "value": "24184c51d7dd9ed41f02d072806d290f15bc2528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085342, "uuid": "41ca0cf2-1773-468c-9668-d1aa6c04b213", "comment": "Malware payload (Mirai)", "value": "eb679c74799c296541468fe70b0b6180ed7d625d465c780538a71bbb3d69e102029579f795bd8249ba7245595e056a12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085342, "uuid": "b02ffd88-bd08-4f89-bc45-a0a6705b29b9", "value": "T1FBA34AC1F647C8F1E00708715067F73FCB32D5355076CA6EEF5AAE32DA67602921A2A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085342, "uuid": "bbb41c4f-0d3a-462e-9e66-089597d1ef0b", "value": "1536:P5uHuaDF0bIc83x8SHWkw+MX+Wzgw+uIaLmZ8CCJ02CVBm:P5au80kc83SS270w+uIaLQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085342, "uuid": "51df72b8-2ee7-4e63-b875-4e01833e58c9", "value": 106828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085342, "uuid": "85681b00-a890-41f6-8f8f-3c81c2bb639d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085342, "uuid": "2687626d-63a2-4d93-b0e1-098f81b4443a", "value": "byte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e23ed00-dbf5-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1766050626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766050626, "uuid": "1cb7aee9-59dd-415f-837a-31a5e5c490d7", "comment": "Malware payload (CobaltStrike)", "value": "a7e9255c2745a9e65f62f6216ed96647", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766050626, "uuid": "da1b1dd8-1ffd-4354-840a-fd3e5c5b3eba", "comment": "Malware payload (CobaltStrike)", "value": "b32d1a6a05e8e6b38f61f6b38d96e8ac79e83301eee36583c1f2e0ab7494d729", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766050626, "uuid": "a926e3bf-a524-4e27-ab2c-0861cb026e0a", "comment": "Malware payload (CobaltStrike)", "value": "ab99deb30ef3405b844592d738847fd03b9eb371", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766050626, "uuid": "ac975bfe-e881-4b8a-87f0-050a0a222464", "comment": "Malware payload (CobaltStrike)", "value": "0632243f2dca4c0abf1b3c15bcd2711b223c9ba09da4025cc35f702e8731fe405bcbbcd3736799f2b76a49a3fbe239d0", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766050626, "uuid": "fc0f4187-6cae-4bd3-a54b-f880de52c588", "value": "T13571D8185BDB7A4A989A2447BD3E94811E3C1F6786C93C00B5F49360E4D7D25D1F7B44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766050626, "uuid": "605baab7-5b99-457d-9bdc-e4c9f77a8de7", "value": "96:pg5SvvvOmVeLx1Yn64VkjoMjEdSA0lgUV0la:SIvOPLx1YnaoGB6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766050626, "uuid": "044befa9-aced-42af-922f-ed7a5ec4812b", "value": 3555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766050626, "uuid": "5360d21f-95df-4f23-b97d-175f51cb8046", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766050626, "uuid": "e1c5ee84-d83c-47b2-bf82-747e6d1989e4", "value": "payload_x64.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f18d5d8-dbf0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766048454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048454, "uuid": "f7ec4243-d578-481b-94c9-f0821116ec6a", "comment": "Malware payload", "value": "195a1e3e5234e2ddf505e6055921ea28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048454, "uuid": "e10309bd-4e45-4ea9-9ad9-1d566b78393d", "comment": "Malware payload", "value": "b5cb3ed3d89e868cb843cee1bcaf07438a66e01ece7f20eb353d5bf5aa210c06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048454, "uuid": "38cbd1b0-c98a-4a75-b217-23d132f28321", "comment": "Malware payload", "value": "2f05fbe06b0fed39fc10a115525e2a8cec91f0a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048454, "uuid": "0ea800af-389e-4199-b9ae-d50fcbbdc478", "comment": "Malware payload", "value": "909af030dd8a9874534e71cf7d0726fafad68825bee10c2b6ecb17f0da0893b5af036c23983cac60636a615684badef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048454, "uuid": "d961000c-fc93-41a9-9545-c7a2d3493061", "value": "T108D6338866D54CD4ECEE423ABCD19817A7D1BCA607A8C6DB97EC06820E635D4FF34361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048454, "uuid": "e60bfed4-e947-4da7-8859-87dc21b15ba3", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048454, "uuid": "8c6e3edd-c9a2-4e70-8972-5389b9125629", "value": "393216:YnewbW84CXMCHWUjYjx5WsqWxT45xHMrl7vNxTnES:YnewbW8vXMb8vsqAAMhLN6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766048454, "uuid": "59ff0dd0-6020-4dd9-95e5-cde7ca25732f", "value": 13685542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766048454, "uuid": "9e7c62ef-00ea-47a6-9cb7-b3466ec87ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048454, "uuid": "4fcb81e8-2416-4347-8512-749e6e5709fd", "value": "main2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552f0e17-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041699, "uuid": "29b4e356-ed38-4dac-90f3-e75b51d7f5b7", "comment": "Malware payload (Mirai)", "value": "d438d57b5e2e31fef5de76f55f9d0846", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041699, "uuid": "5aacf3ad-2f25-4e35-b8e7-80d4ed5ac8f0", "comment": "Malware payload (Mirai)", "value": "b60852993bca2e7db9ef2be63f11ddae407e6be3bbb33e2c2eea3c3d9144e33a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041699, "uuid": "df845d87-9cc6-414c-9ddb-e68dfd5fe07e", "comment": "Malware payload (Mirai)", "value": "e8ae4f37016fa9e737f4fe2bdf617e6c00055663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041699, "uuid": "2e82e61b-8441-47cf-a8ba-56531ed68a13", "comment": "Malware payload (Mirai)", "value": "63255491c6e6ea1446d516dea0765aaac6703cffb6550d13c4bb665556659e1281904f7be4536e34055c12770ed97a77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041699, "uuid": "8c36b946-5e4f-4510-bf7c-733cd0a8db53", "value": "T166D218D1B8929A1AC5E8277AF99F059D3311F7E8D2CE3A13CD141F402B89A2E1D77681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041699, "uuid": "ee50c034-c81e-4475-8ecd-1600a9f8a6f8", "value": "768:W5vAjKXMaHi5S9sf/VmKX0HAeuilldNN61v:BeXdi49lDu2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041699, "uuid": "41b98fa1-0663-4988-b62b-543f7ce59e9c", "value": 30100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041699, "uuid": "b5631254-b2d7-471e-baed-b051aaf6a38e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041699, "uuid": "aa260328-0d86-4d09-b943-e6a716728839", "value": "kvariant.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33ec19e-dc06-11f0-a129-42010a9c0007", "comment": "Malware payload (BazaLoader)", "timestamp": 1766058205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058205, "uuid": "0a282cf5-1303-4b42-ae7c-fc3246a7f1f8", "comment": "Malware payload (BazaLoader)", "value": "47fcd4b9b922cd5f88e86e165d39ebd7", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058205, "uuid": "e9b2414a-7b2c-4730-9c92-216f6a455ead", "comment": "Malware payload (BazaLoader)", "value": "b67cde2dc18cd53570245ebc8c0a22e25fa6e8a1eeb6c90686262034d6eed70f", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058205, "uuid": "47e20161-6033-4267-ae40-6c29e2677119", "comment": "Malware payload (BazaLoader)", "value": "d9e8b7a2ff21d95e39e8badc90809491848c8e84", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766058205, "uuid": "4fb10571-695d-4656-b2d9-a1948c13fd7a", "comment": "Malware payload (BazaLoader)", "value": "c7518fa57c0f20608f5294583b44b1c26da23f77437586bb393b64fc5825ee91de31529b8ee7dc22044bae9fed9e55d0", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058205, "uuid": "6a3dff63-f6dc-4d29-af3d-f133749bc010", "value": "T15F074BD2AD60076AD6AFB239E8B2524A2330B844533214D7BA9527954D77FC4133FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058205, "uuid": "5b2dbcc3-cb88-4418-8088-ba71aa4d16d8", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058205, "uuid": "a3794762-80ba-4cf4-8af4-ec8b02601a8b", "value": "49152:81gLdIjVZiLsOvjrvE4RWbvZeduqVno7LKbcq01r/kwy3q7NYZwThwjxSHxlLRuA:8pjv1lajDG7IaG6Fbqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766058205, "uuid": "87c61a42-b24c-4f29-b842-cdc9e25b9d55", "value": 17376288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766058205, "uuid": "f09d1704-6d7e-4923-9ea2-6a287ce92b9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766058205, "uuid": "bb42dfa3-5067-4212-8cc5-b51a01614d40", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb4bcfc-dbfb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053468, "uuid": "e28b702e-fff3-4625-8325-e9b3390caf46", "comment": "Malware payload", "value": "97fb974156fc195533264bb5afcad872", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053468, "uuid": "33e98df5-de32-422f-b0c0-fccdbdd67cd0", "comment": "Malware payload", "value": "b7ac498c464d295c6a71568d2b6e65e2b39c4447c6ac86d17b2eb370f10f3fac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053468, "uuid": "d310bf6f-d681-4b37-8f81-c6434f9289fb", "comment": "Malware payload", "value": "d05b9c8c43cfd772eac32ebca967e85054fcf0ea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053468, "uuid": "8701a1b0-1515-44ea-aab2-12913af206f5", "comment": "Malware payload", "value": "4af8a366c5d64b2a0e971b175259abd1d9bef04b40d9067af3d68eca664580975e2abc3bf81375e611d3533d74241050", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053468, "uuid": "f78212bf-e3fc-4c07-baba-4f57df5fef2c", "value": "T1972323C83BD2B8B0136270A72D1BB05FF6BF1C44750C50E5D36A98C5B96C358D6B6A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053468, "uuid": "f54c83e1-821e-4899-a87c-848f755d0b9f", "value": "768:J9Pi+LO4qfnOQTUeFBgaVbY+teF/9m7sLtMfQq8e9t07MS8yt+rAUb:J9PiQDqf2ibonp596rA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053468, "uuid": "f235fda7-9bc9-4427-9eac-ce38bd22d492", "value": 50107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053468, "uuid": "64741bc5-02b8-4939-899a-414941432233", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053468, "uuid": "ba36ff81-3735-4baf-871c-410b8eaec71b", "value": "AWB# 886037219395.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5132c94-dbe4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766043685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043685, "uuid": "2bc7ab3c-fe4e-4ea3-879c-d3baee1d75d1", "comment": "Malware payload", "value": "bc9d5ef00b49ee24171b3bab20ddcf33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043685, "uuid": "56894b47-ed2a-48e6-aa3b-bdfbf0f87adb", "comment": "Malware payload", "value": "b91f25e8d77359e6045e3385527395144afbad5388a135544b20e14e33dd8459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043685, "uuid": "502774c8-f349-4edc-b83d-a9357b6c7e99", "comment": "Malware payload", "value": "7e6310b2d3778088bb5aa9e02a6da9c6385fc676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043685, "uuid": "60466413-e351-4dcd-8988-53fccf2152d0", "comment": "Malware payload", "value": "4273267830c5e710e1bcbb5ddd504840989e52e44c45033dd87cd831e9d42bca2a11896ab2f669a3ef5133d87d904cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043685, "uuid": "88a2f82c-2b47-44e0-bd9b-1f6c3dbf4dfc", "value": "T177633A862AA54697E5AF43B24DB3D125573258523A61B307B22F921C0FD23C4BE17FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043685, "uuid": "6b027cc2-981a-4b58-83b3-d06381fe617b", "value": "d579bd61089d94ce65513a158fd2adfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043685, "uuid": "46cfbe05-6918-4ed5-9652-7c8c74930364", "value": "1536:u5mA7ZLGsHFkNhjIZaXcfIT9M5IfSF8WQ+BQk2ESP6tdWiX0L4z9Wk5/Wu:Wblk7jXcfIT9M5IfSF8WQ+BQk2ESP6t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766043685, "uuid": "1bd944cc-2f80-49ad-8bf8-faec38461056", "value": 72296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766043685, "uuid": "deb27313-37fe-4f5f-ac4e-b9e5ea490322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043685, "uuid": "e75c00ed-11f1-4fe2-92fe-172a82355195", "value": "DockerDesktopNoZeroes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4951cb-dbf6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766051299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051299, "uuid": "a1e361d4-bf94-468e-aa3b-1927bf6c970f", "comment": "Malware payload", "value": "aeb9f49760919e7ca24fd446594628d7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051299, "uuid": "656d5052-cbdc-447f-956b-5e418f112832", "comment": "Malware payload", "value": "bc349034570f57b48b6291476a829194199bfcede16020f7ee70ebb9073acc21", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051299, "uuid": "2364f761-89c8-42cb-8da2-2851519d8744", "comment": "Malware payload", "value": "541dc42a4063f6c0f578012c5c97362664337eb9", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766051299, "uuid": "db6011bf-7f91-4ee4-b358-72d454135f0b", "comment": "Malware payload", "value": "1010faf9f1d9ac0d411a3096255383aa63ee9c178e25f6860fa9c680db013c454e3ee5c1653152f9a868298364d2630c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051299, "uuid": "1f4a432d-67b2-42f9-b610-f4cbcc72e6f1", "value": "T193E26C4129ABAD10C98AA535B40C464ED01DEC9E81E70DF1B95C02C2AFF6DBA0BD37A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051299, "uuid": "ab61df69-e42a-4d5f-a663-0a04450f53c2", "value": "768:TVo/23/DIHVJy6g6uq0vQ0v7YZeED9ixPOO:J3vZvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766051299, "uuid": "6a5ad4e7-c01d-423c-a302-8b704c0d00ca", "value": 32817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766051299, "uuid": "5838414d-797b-497c-a3ba-39ed0cc1e1fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766051299, "uuid": "e5437424-202b-4a1f-a095-ced343b761ae", "value": "m.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7390b817-dc31-11f0-a129-42010a9c0007", "comment": "Malware payload (BazaLoader)", "timestamp": 1766076539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076539, "uuid": "95361f57-53e2-4d19-9b07-76eaa925fd3f", "comment": "Malware payload (BazaLoader)", "value": "7b7990d49ba60bd9e66f5f0d0ef12b8a", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076539, "uuid": "6bc295f3-9030-4db5-9b20-a53e4fc73d67", "comment": "Malware payload (BazaLoader)", "value": "bcbab17266fcbc791ff931e8af5b6c659192bce6c45ed3b045d9b341f5c590a2", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076539, "uuid": "20892849-a41e-4f2d-9f97-785773e48fcf", "comment": "Malware payload (BazaLoader)", "value": "769039a05d66b76f38c8a91f4935f7b65f779e4f", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766076539, "uuid": "958189e2-c6c9-417b-9342-b2ea37c451bc", "comment": "Malware payload (BazaLoader)", "value": "a524ecf45462d1c0064330370de1076ee6b7d2f48bd83101aba8e02231afb5f34f020b74513a404ee1f46d7c2bbecec5", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076539, "uuid": "1be7a935-ad1c-4698-9e60-6c2bf8438f75", "value": "T1ADB65C939DA04A69D5AFE239EDA251567330B804033224D7AB9537A50D7BBC4133FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076539, "uuid": "12a2c65a-ac29-4f52-84bf-7f5e52c22d8d", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076539, "uuid": "d951db16-f482-4e09-bd69-fb7fbe15fe08", "value": "49152:7pFRX3WszSRSaXIzjyEPEBFlV7YhV83zZxZb4jT7aBTxcP72A2fdvszmzviSUX7D:7xWbc/1G7KSUX7SKKuSqIRYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766076539, "uuid": "4f39ad4a-9c3d-45a5-9f38-bd6d66a9bb85", "value": 10798296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766076539, "uuid": "ab8a9300-a4f9-4d7b-a62a-7757bfdc12db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766076539, "uuid": "4dbada98-31db-4240-9cf9-3ac0e9fcad66", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba36a19-dbed-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1766047213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047213, "uuid": "3ddf8dfc-2dbb-4353-a080-a271d09b5921", "comment": "Malware payload (Amadey)", "value": "970858f1d92c8ba2312db57bcae9a3d7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047213, "uuid": "6014a31b-9985-408b-9e9d-775e28d7e52a", "comment": "Malware payload (Amadey)", "value": "bd1ace692e4904c13ce9ff258a3f8703af41735b5d9b1a698eaedefbee6eca08", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047213, "uuid": "b6432486-42bd-4c7c-98be-f792a384926e", "comment": "Malware payload (Amadey)", "value": "6651b78c3fdbcdbd63df6660e7b88013d8b6849d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766047213, "uuid": "4899745f-9c33-48eb-9cb9-31b8ef128a1b", "comment": "Malware payload (Amadey)", "value": "65004438c06ff06841f82d5b5dc71a0cd17272c34abab7384d671f8dadc6776bd65c0a6edc0bd06d03fed9cb3e783e54", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047213, "uuid": "3a7c6606-8560-4b9b-8025-4efeae7da6a8", "value": "T1E7E5BE14E3A805B6C96BE734CA558333E6B079524335E14F0A9DD7462F33AA29F3B712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047213, "uuid": "a8a0aacc-e63b-403e-9b87-b466d537bf42", "value": "e2aa63e3f0d9837d01e53951cc9f3e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047213, "uuid": "cd80969e-1b78-4280-9af9-e3e5840d101a", "value": "24576:x6OCDqbMfiKKZ6cXaWGloDnsCba1UeRnmvgnsKbHf1H2tpM8X2U293xABMXX/GZu:1CDqbub6XDwowIlpzCL1bOEePAr03A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766047213, "uuid": "7d40087f-e565-4889-859d-874669f50823", "value": 3087872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766047213, "uuid": "a0b4ef63-2279-40c9-b2f2-0f673761745a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766047213, "uuid": "69948bcf-e8a5-40da-9d26-f3e49d4303f5", "value": "am.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caeb0291-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041897, "uuid": "a1ae389a-255a-46b0-a311-dfb425a4aced", "comment": "Malware payload (Mirai)", "value": "13c3b6dcffac8d807466d4af92d6300f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041897, "uuid": "0706f832-a43f-44d5-9a63-1a5d62918b3f", "comment": "Malware payload (Mirai)", "value": "bd5e5141c43414552086ec047db513965d47bab4118fc3b574a24a9ad940d782", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041897, "uuid": "c12ba5ae-f407-41aa-b07c-9e77be89a1aa", "comment": "Malware payload (Mirai)", "value": "81f5cdf71b93c33e9649222043837f9fbbdd7fd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041897, "uuid": "6b8332b1-faad-40bc-b7cf-a49ae4705001", "comment": "Malware payload (Mirai)", "value": "cb97c2cac7dc135af1428712126310c4eeb759972f932eb91912e9e58ef83844a393cc16d0074fdb4de421664cd60284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041897, "uuid": "dcb96c35-74a5-4d96-96a0-e79414f6a93e", "value": "T1C7030995B8819903C9E41377FA5E42CD372663A8E2DF33029E222F553B9AD2F0D7B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041897, "uuid": "c96207bc-2f1b-4777-b9af-4c3e85533ac5", "value": "768:fs3JN8kEhPFrHortPUgTflvQE2JXN+bkbtWqr1vY:GYkOPyFQETI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041897, "uuid": "7eec5ce7-a1d4-4023-96ea-911eba39293d", "value": 37704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041897, "uuid": "191dbc0c-ade0-4bfe-a7a4-fa32ab3621c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041897, "uuid": "1c1d1ab0-3bc8-4f57-9073-5594faa743d9", "value": "arm.b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77af8b02-dc3f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766082559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766082559, "uuid": "24ab7921-b0c8-4863-935b-184015738545", "comment": "Malware payload", "value": "65d3353c1fd191f3256b758b00aa549f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766082559, "uuid": "989ef865-a222-4465-bdec-6ecb599a9107", "comment": "Malware payload", "value": "bf3e56c007dc76b2427ec1f6a546e81371ac9a3b9674de161e7aa5b038630dbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766082559, "uuid": "afa911fe-801a-4517-af00-4f33401ac9bf", "comment": "Malware payload", "value": "ad62e70857f7827901e0fb920b8021de9881b640", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766082559, "uuid": "433f8249-e295-4e39-817c-7bfe42f5b539", "comment": "Malware payload", "value": "8a7c9fbb76c3ee72fdb9fe4f37af5044289165a3aa876f29018b50bb287f9d878da324f2ebc703ab6db291092fcb1c1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766082559, "uuid": "68e0104c-30a9-4962-83b1-94dbeba839bc", "value": "T1CB860964FACB44F6E8035D3045AFA23F27351D0A8B28DBD7E6447F29F93B6920972119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766082559, "uuid": "26384c5c-cf96-4b75-9029-1b42535d6453", "value": "49152:GSk2Pd1ZIyl+rfpjDiA+v+0gohYRCSwaYtZKnRbt928BhBZgNfadWkA62Uui7WAt:Zk2Pd1nl+rfV+VSn9d2+CKV9rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766082559, "uuid": "af133a5e-9428-44b7-8b8f-ce85d70d7c22", "value": 7921799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766082559, "uuid": "ea361208-d8e6-4226-9087-b4e60085d289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766082559, "uuid": "8fffa8a7-e9f1-4522-99d7-8f4ba38149d8", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7487f43-dbeb-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1766046561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766046561, "uuid": "b0572a1d-5d7f-4a36-9aee-8f2d8516dbdb", "comment": "Malware payload (DarkVisionRAT)", "value": "579bbf5417ebb0916b6f6ea9ebea3244", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766046561, "uuid": "d8822acb-56e0-47ca-ba90-150a00a4727c", "comment": "Malware payload (DarkVisionRAT)", "value": "c1a9b4928efb23673306553543b9f6efbfdb3dfa801c734a31a90a550cb2e3dc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766046561, "uuid": "0cae96c2-642d-48aa-b7cb-14436366e161", "comment": "Malware payload (DarkVisionRAT)", "value": "022396ffbb199bc3fe50f0f8e95841fef8c42f98", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766046561, "uuid": "01b99c55-0316-48c5-8ab5-b2763f6a5f0d", "comment": "Malware payload (DarkVisionRAT)", "value": "1ce8303fc04338f5212406cd32ac6037cf44d6bf4cba69942dc0da836036e394ccf51f4b72f0b653d6fe25584d8d4cd8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766046561, "uuid": "979268b9-fc34-4de9-a33f-0267d7ce2dc5", "value": "T1A0955B11D5FB463235D6287C09DF9632B45AF7980EA47B60B44119EF079EB073EEAB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766046561, "uuid": "1bea3db7-b170-4d06-be03-5f6ca6f23402", "value": "6144:3i6hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhJ:3i+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766046561, "uuid": "36f868d5-38be-4632-bf6a-466f4129c64a", "value": 1986296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766046561, "uuid": "48425b9d-e16b-4581-8660-00c67bd73291", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766046561, "uuid": "6f5ef3a1-c025-4461-953e-b0387e174f76", "value": "PO 8755.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c41603-dc50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766089945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766089945, "uuid": "2e4d7178-c9f1-488b-8b90-f7f2c690aafa", "comment": "Malware payload", "value": "75e719fda34e5f7fd9457ddca6385f65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766089945, "uuid": "3dba60a3-555b-4d4a-8ca9-d1eb9b0d163c", "comment": "Malware payload", "value": "c227ffa75ada4898032a77733269565d8a4d0c528dce1ab762dc967bd21bef3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766089945, "uuid": "1249ccc1-2b42-40ce-b5e2-ecd04123d876", "comment": "Malware payload", "value": "cdaba33c8ede247b6b34dea42a59c18e72c23cf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766089945, "uuid": "d98afa0c-7f9d-4297-8569-79efbaed5b21", "comment": "Malware payload", "value": "5ffddbb7d03f786a55301958bc2143ca76047fddaa21f69512c6992184bc722d778c058c942aef2059f917fb43d3fdac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766089945, "uuid": "b1f73bcd-62dc-468d-93e3-2a722a819a1b", "value": "T150E6F51021D96607FD3ADFFD85DC77440F79B2A53723EA789B414EE90BD1B08C942AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766089945, "uuid": "2adf8777-067f-4da7-bc0a-69026c715533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766089945, "uuid": "e93bd302-df44-4026-b895-8dbaf4a57e9a", "value": "196608:fYogekjgipsND5eV/ARlCuS57EWuJwN3JKh0H:QekjgipoDe/ARAuShEnJwN5Kha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766089945, "uuid": "a6f10dcf-14dd-4f88-ae1e-c0f6085b93f5", "value": 14476288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766089945, "uuid": "762726bf-af4a-4ec1-9e1e-51e2bd43d57c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766089945, "uuid": "96862bd4-0912-402e-9527-5256984b333e", "value": "SecuriteInfo.com.Trojan.InjectNET.96.5913.12222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388f66c6-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052389, "uuid": "4da29b4b-c770-4c86-997b-73aff5546e02", "comment": "Malware payload", "value": "a3ca58b93d263f674781b29f333a907a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052389, "uuid": "23ba5492-3a21-4806-bda2-e39bb798e839", "comment": "Malware payload", "value": "c2c6aafdacc47507c8089f54f51032fe12301fecd95e89972724f4bfa377c5f2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052389, "uuid": "826bb46b-3b0c-4e85-ad8c-b9242f0c7e21", "comment": "Malware payload", "value": "bab5b974439f3132e90425648aa14ea6215b5cd4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052389, "uuid": "f735116f-eb5f-478e-9f90-5aebb0eb1021", "comment": "Malware payload", "value": "63c938d8ff646cc5de227dfeff25b4800b6983e016fc69583eb2f7b4d42523af96416629c2be324d92a3f972084eb746", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052389, "uuid": "6181bae8-a513-465e-b60b-66d17ed24dc0", "value": "T1E6D4AA2269E9C8087B636706BD370354D24ED03F194D6B2F5E3F0FB4D5A3A69E09C5A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052389, "uuid": "f0b085d1-a975-449f-a56b-b36521f67ad1", "value": "384:vIOO3SOe3RGpr8LyywLOBtazx6/IhbqlUdCGwMAv1J4wsk0egCHlsbw+3sH5+3Ru:vp8F8vwL3xSYqlUEGwvv1J4wsN/yZ8Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052389, "uuid": "5ce5d1d2-2645-4bff-9c38-25c9bbd115d9", "value": 622771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052389, "uuid": "af9d7b58-0487-44e6-ba80-0db4ae63d3ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052389, "uuid": "4d2950b0-17df-4af3-abfc-403b95b9bbc3", "value": "MMNNNN.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bca202f-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766052555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052555, "uuid": "ca39b8de-e8e9-4806-bf66-13235e1fe40b", "comment": "Malware payload (AgentTesla)", "value": "99c736cfe64ed295fa69424db3a45d4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052555, "uuid": "e20f1fa6-dba7-4b13-9c15-bb5f4f7796a9", "comment": "Malware payload (AgentTesla)", "value": "c3122d8d0658551ccb2a6d93ca882462ed3d3291068aecd06ee27c21fa533c1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052555, "uuid": "de1035ac-0f5a-4687-b5d3-102886cba04d", "comment": "Malware payload (AgentTesla)", "value": "08a960821c6ba3eab3772d34f04a751d2a22bb19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052555, "uuid": "86e30d81-36f2-48b8-8f7c-3cece3365c23", "comment": "Malware payload (AgentTesla)", "value": "7fe1b6e3f5557b8830fab88ad4339de5505cc0347668ce6c47f89de6eb4071d0c378d03d55baca3a577c18d0d0308dc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052555, "uuid": "58d1aa87-4e47-4d5b-b860-7f6a28796686", "value": "T16845F1118DC46FB5CFA89A1880BE161DE7F04A9F41667489FB3BBD46AFF7644021B1C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052555, "uuid": "0e9ae0e7-792c-49bf-a4db-aa1565877c5a", "value": "24576:deLd+ZpKwIzJJ903IjCHIqaN9iN8BnVSuk:dAdPYzRNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052555, "uuid": "70893cda-7c1a-4d65-9cc5-28225958439c", "value": 1249592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052555, "uuid": "96c22d02-1baa-4a20-a69a-91513ccbc057", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052555, "uuid": "134766d7-b5ef-4eb3-b1f6-8bd4d789f5a6", "value": "Kopje pagese bankare.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab6d840-dc37-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766079128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766079128, "uuid": "33c393ef-8ee7-4f25-ab5c-d53ae8608b45", "comment": "Malware payload (QuasarRAT)", "value": "25b916160015a5e532172b39e6b54bda", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766079128, "uuid": "fbb3a8ec-cfc9-487f-84c3-87a63028450d", "comment": "Malware payload (QuasarRAT)", "value": "c36db5c9e90ed0abac94523ba9f0316e5dc662b9f331d548be9b8ea80806c9ab", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766079128, "uuid": "a536babf-e2ea-4486-8bc8-83184a6a5942", "comment": "Malware payload (QuasarRAT)", "value": "f88904be90dfa1b35ca8f46350484023ead80157", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766079128, "uuid": "a36e7870-a315-4027-bea6-2c17f2ab09e9", "comment": "Malware payload (QuasarRAT)", "value": "72fad503dd2f73c5df1ff4265d408f80099d2c51123e5a555e52ae4b1b38ef15ca116b0035ede7ea19f08acec4b72a85", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766079128, "uuid": "ef8b5636-fccb-41c4-a2d4-51bfaf18f417", "value": "T170E601B74E64B967C3AF0914A9BF190C0FFE8889C0017B59A3E1DE79A17672515FB203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766079128, "uuid": "b23895d0-73b9-4c38-99af-2544912a798b", "value": "49152:JbaMWdgfEYH0Th+EM6R+gu1DFJ0Di410auHlCtJ+1biL6gGOHohdS1XzOdnLoyGJ:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766079128, "uuid": "3de38a06-877d-4002-8b9e-880452f715fc", "value": 14211111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766079128, "uuid": "03cecdb9-1182-43e2-8655-ac4fa0ebe4ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766079128, "uuid": "0428a0ca-754a-41ab-b1f5-788118e7739d", "value": "WalletAiFinder_Crypter.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1e3b39-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085280, "uuid": "319e43c6-059b-4439-a3bf-8f7f38bdc37f", "comment": "Malware payload (Mirai)", "value": "dbba0b97add9d9a7aceed2c003070edd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085280, "uuid": "07bc5b76-9ebf-4b9d-a859-2b7cdf02a6b6", "comment": "Malware payload (Mirai)", "value": "c370178409b81fd8b11e65d443266756bded526350b2f9782dfdeea5b3bade81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085280, "uuid": "89fe482b-59a6-47e2-a329-90712343646b", "comment": "Malware payload (Mirai)", "value": "9f23276641cce9e362bf695c9832d1312e73bb1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085280, "uuid": "2d15f879-e2c0-4044-bb52-ae8ccd6f205e", "comment": "Malware payload (Mirai)", "value": "aa06916a04923389271d9a884cf043ed22130b2efd37c2d38b5b9c1941d0676fbaa349f50827a66341f6c9eb5757e77a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085280, "uuid": "49035002-263e-4f4c-9619-5f75bdedbf81", "value": "T17F13F19BD0195F3AE14E407D4D5AAC192C14ADDCA38FDCF4BAC496A66323B1634393E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085280, "uuid": "aa042a87-918d-4717-820e-e06982891d3a", "value": "768:FhUllsP71zmXxBMsAH9IM1cIPRLz+I/DTymY/rn36zoOMWmMu6ajdVDu6iTgonbk:FYM9mXHAd9mQZD//G6zohLJjdVIMonoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085280, "uuid": "8830bd2b-35a5-4838-86a1-42547313014d", "value": 44456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085280, "uuid": "ae20cc7c-03de-4fb9-ace3-5f53ab97d077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085280, "uuid": "830bb5a3-7acd-42bf-9eb5-26fcb11ada0a", "value": "byte.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc875970-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041899, "uuid": "7ea78494-c9d4-48ea-b273-b5cdc76467bd", "comment": "Malware payload (Mirai)", "value": "bf3cc68dbf0f3a1d6ecbfeba4f654336", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041899, "uuid": "14e9b05f-925d-4ef9-8e01-a29c2d09a44a", "comment": "Malware payload (Mirai)", "value": "c477d1e8e3f8f033c8c20e0c7de5e0c659320bca059043c905a073fe8b87092d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041899, "uuid": "69a51955-81b7-42ad-9fb6-5b9cef2d3d71", "comment": "Malware payload (Mirai)", "value": "8e8696c0d73f8d4c522fe596db648b4942d5da7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041899, "uuid": "2b0923fe-aba0-414b-925c-f4441938118b", "comment": "Malware payload (Mirai)", "value": "64ae56481eb6cb677649f4eb967fedfaa7e945d2eb16a557c33c5a78e6251c6e5043ccab9e2c5c2593874996d3eff0bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041899, "uuid": "9d52749a-414d-47e4-8c3f-408cd405153f", "value": "T17C033A31BA7A1E17C4D4A57A62F34729B1F5564E25A8CB2E3D720F8EFF00A8075136B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041899, "uuid": "45c82b3b-7b68-4c0a-a928-e8ab990463bb", "value": "768:I4FaoCIlq97DiwhjvB0UaOo/YO+CDCPZ8wSGoI:I4FaZIlS7DiwhjSxy+RXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041899, "uuid": "7b414f45-9b74-4eea-9497-77f4b8388f7f", "value": 40196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041899, "uuid": "0981ea4a-a84a-4f3b-ae48-23648ca2d787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041899, "uuid": "7cddec1e-0bd2-4a84-ae1d-704747cd7838", "value": "kvariant.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba87fc7-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041898, "uuid": "92a2f170-0983-46b9-bda3-7c7b8ece6c65", "comment": "Malware payload (Mirai)", "value": "518d8abad14a53c022fff12718bc6ec3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041898, "uuid": "49297b22-7198-480a-9c7b-fef3877b3495", "comment": "Malware payload (Mirai)", "value": "c796482c29cb0feed0c775e52905f87efb8799bbee0529012990615475b262b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041898, "uuid": "0b31a972-f629-4897-b297-54f78ba0b2fb", "comment": "Malware payload (Mirai)", "value": "7e30b8a0c608ecd1bb4854c325cb7d2d587d4090", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041898, "uuid": "95fdac69-2884-40cb-aea6-d082face277e", "comment": "Malware payload (Mirai)", "value": "3a4ea52f152586d7d97499649441e13f2e2a34d1c6969926d13d036ac9b49670c1c4dad76a5522364c27ee78170550c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041898, "uuid": "763b3498-cb8f-4354-a659-0a24dc824d30", "value": "T17CB31956EB418F13C4E51775BAAF42453323AB1593DB33064A18AFF43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041898, "uuid": "8b12241d-c841-4790-81c0-ecb71c077b79", "value": "3072:T/sW8+IVI+GNP+esIQQ6diQmnpgvjM/9uUzZ:YW8VKXNP+esIB6JmpqM/97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041898, "uuid": "0d68d6c8-c1b2-4cc0-a6bb-c1fd84ca6568", "value": 107637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041898, "uuid": "d03816ba-0fb0-4495-a2fe-a3076bdb3841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041898, "uuid": "f10f3045-8ea2-44ab-966f-c43997bbd917", "value": "arm7.b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0ec77e-dc54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766091537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766091537, "uuid": "a339e2be-62a7-40e2-9a21-a5a71db776d2", "comment": "Malware payload (Mirai)", "value": "d53727224bb831c5fa0f4fdd858abceb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766091537, "uuid": "e21904ab-6ef6-4184-802e-904b3b5b4fa0", "comment": "Malware payload (Mirai)", "value": "cef4707a51c75127f7a1aa4e30b56747294834418068be3d4041d7b98c1f6c30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766091537, "uuid": "98523364-4cd6-41b2-a77d-ecdc132381ce", "comment": "Malware payload (Mirai)", "value": "be81cda7db47d12aa0b19ae79b8d8157ad8d8134", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766091537, "uuid": "26690808-9d82-45ec-ad2b-c580c0bbf548", "comment": "Malware payload (Mirai)", "value": "ab97cae5369bfafaf3ed1ecb9d728541eb160f547f1076b856f70136a5b67903ee066cdc63e4d87d700ead4dc2d411d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766091537, "uuid": "3239978f-4461-4aed-996f-7a177b99ccc6", "value": "T1FC341B56B8818F26C5D012BEFA2E118E332327B8D2DF7213DD245F64778A96B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766091537, "uuid": "3ca0587a-d668-47cc-af60-4fe120d700dc", "value": "6144:lyZHZ9zPNCseT6mHINNZas+94X/LuAADrA+:lyZ5vCsirHITZa/aX/LDADz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766091537, "uuid": "32b04ba2-a778-4752-8ca3-2804860252e9", "value": 241300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766091537, "uuid": "5d9e9df1-682f-4d8d-b5ed-9bda98357a81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766091537, "uuid": "cc5a58ea-bb07-47c8-8425-dbef251a8b50", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a503fe03-dc1a-11f0-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1766066744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066744, "uuid": "c743f33b-3d15-427e-84d4-5716edb860ad", "comment": "Malware payload (Expiro)", "value": "cf1ebbc3c0d62dfa03e9e0339a40a78a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066744, "uuid": "c71e5fc4-0ed0-40ca-9da9-fe18eab91a83", "comment": "Malware payload (Expiro)", "value": "cf017035f2d395e64f4838f4f6ebcc8bbbaee8269329c82162372a0676ff0802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066744, "uuid": "76a95160-14cb-4252-9e27-80dc9a2bdd89", "comment": "Malware payload (Expiro)", "value": "2b02679df18e19bf0033a15b5ab5d6564fdba81d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766066744, "uuid": "a73ed936-810d-4319-95ec-2e22bcad5b45", "comment": "Malware payload (Expiro)", "value": "b1e866fb992fea1c173843fff08d4e19845407a397a70b04c1ce2b8237430b145d2d608b0a30224f38274f4306f0cdfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066744, "uuid": "aa05d652-f7fb-492e-b462-0c803ffa7d9c", "value": "T17395AE22E960F465E8978570E83562F6192A3C71E511EC0BF780BF9A3A7198779F070F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066744, "uuid": "6872bc99-e20e-4f2f-b91e-a86fb20301bc", "value": "ce5431f7f80ca345a86285d5b243f8ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066744, "uuid": "8a6d5f7c-28b5-476d-87de-966123a508fb", "value": "24576:fphXSITPWVg9N9JMlDlfjRiVuVsWt5MJMs:fpIITPSgFIDRRAubt5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766066744, "uuid": "be988632-5898-4da4-9034-8e2a21bb1dc1", "value": 1978368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766066744, "uuid": "8bbdcdae-e9ca-44fe-946f-d6dc7998b399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766066744, "uuid": "77bfac12-c32b-45c4-b89a-67cd1f1cef0e", "value": "ELEKTROMATEN COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa5b603-dc41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766083584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766083584, "uuid": "b5f8da86-f221-42d6-b0b5-d77aea13655e", "comment": "Malware payload (Mirai)", "value": "8cf104e0cbc31c780aca4689925eaf6d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766083584, "uuid": "0690dc5b-94fb-4b4f-b6fa-33dc6b2a292f", "comment": "Malware payload (Mirai)", "value": "d0e164aca64197432f7bd969a66d5395498278368c14e414bd2c706d6b750d74", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766083584, "uuid": "e92dfa55-8cec-46bb-bfe0-77767fd6ca11", "comment": "Malware payload (Mirai)", "value": "e94977ec4a389a3d048e0e2a6d2e13928c1bc3ce", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766083584, "uuid": "85c179a6-668a-45d8-8da9-356ee12ce76f", "comment": "Malware payload (Mirai)", "value": "11a6690f01daab142f0f0dd641a5da8943297878ca5d1f07148cc2ec68d5e6a25d147b5e975093cb8d2d75211f5b220d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766083584, "uuid": "7ac38b1a-ee9e-45fb-9ab5-30e19fa3f68e", "value": "T1214100C5A323BD02064FBE2EFB6007DEA0E14B4DB05F4FF8ACD84A6E5498991A024B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766083584, "uuid": "6279f144-449c-4027-afbb-2addc840a593", "value": "48:h4qbtUHzcS/ka/amyUyfAkTyXq8vdBxRBx0ek:JbtUH9kmz/gAkTyXq8vdBEek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766083584, "uuid": "c88de013-d3ee-4ae9-9598-8e3fe979d312", "value": 2426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766083584, "uuid": "79b920e2-55aa-40f1-8a02-0d643e7b698b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766083584, "uuid": "6b54878c-9b95-4e28-97d1-dcfddff328e6", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e206970a-dc0b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766060404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060404, "uuid": "79aec6a1-14de-4db9-954f-bce99e3fde55", "comment": "Malware payload (Mirai)", "value": "fee2694ed0cd94507e869bef138eec6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060404, "uuid": "15acca80-8e28-4d7c-85a8-90a6be56430c", "comment": "Malware payload (Mirai)", "value": "d2722761441437dae4db4da7b27fce1281974a892bc16234156b9c54801a6bf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060404, "uuid": "731fc518-f50a-4899-9dd9-eb11d5f4b461", "comment": "Malware payload (Mirai)", "value": "07253bb02a8cbd0a521ad062a7f2554df8fef1b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766060404, "uuid": "995aad91-5e3b-4307-b648-06cb5325577a", "comment": "Malware payload (Mirai)", "value": "8b15c01b2d1f81e88aa14ac5c07deb843290096cafea2f4a90bb012fca73c118bdbffab0cb7b36aa5c08f89ab7cc92fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060404, "uuid": "7d680f5d-8b70-4ab2-8f3f-d160d42db1d0", "value": "T124734CC26A43DEBAD80311F511B75F368A35FC3A093ADA86E378FEA259015C1A50736D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060404, "uuid": "e3d0d88a-d1cf-4483-83b0-df1f70825234", "value": "1536:szdiRRuOecLkioz56OD1ydrwwaIoXfMicakSGSNB4J:bDuOecLkioz5P1ypwzIsXcw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766060404, "uuid": "b6f96a2f-f03a-4047-9bd2-244aea1d9b4e", "value": 73820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766060404, "uuid": "fd80e016-eb3d-41b0-9f9c-2247ca3e963f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766060404, "uuid": "178ad090-1f71-4855-b639-bb9759e92f9d", "value": "nova.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d57db9c-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766052343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052343, "uuid": "4bee5973-d61a-4023-a9fd-c8c169985a53", "comment": "Malware payload (AgentTesla)", "value": "7e702a992ebe05ce2440f2bc11e43ba2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052343, "uuid": "9deecc9a-a39f-4dd6-8c5c-0a78b40d1743", "comment": "Malware payload (AgentTesla)", "value": "d4bafe328a2f95606f3b003856d518d4fae8bbb3f47b36a6d70ab7aa29b5c54c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052343, "uuid": "313db932-fd40-4aa0-a649-a15bf0ee1bbc", "comment": "Malware payload (AgentTesla)", "value": "b5328798cca87d6d8fa2f25e3506bc76ff63c2cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052343, "uuid": "43ae31c9-e8d6-4217-948e-5e6fcbd7ac87", "comment": "Malware payload (AgentTesla)", "value": "23b9334da1bf0491fdbf924c2a2e1c65a3d715a0e4f0838207bd90149193306e8e0a71981656fe1bcffaec3ba77082a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052343, "uuid": "3043aacc-e4b2-43e4-80e3-8f7d6d303a0b", "value": "T13545F2158DC46FB9CFA89A1980FD161ED3F00A8F442A658AFB37BD46AFF7644010F199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052343, "uuid": "2fe5c1e6-8d1b-4d3b-84ae-cc2856effb26", "value": "24576:WBHTYWP1l4D4pbfPhteTSBcPmez/llkQ4roucUjmCL:yE2hcM+iZ1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052343, "uuid": "711b985a-d1cb-49ca-84ed-2588bc62ae74", "value": 1248688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052343, "uuid": "f8faf097-a184-448d-adfa-23c84b2c008f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052343, "uuid": "20186155-f42f-493d-972d-3007e9eb9505", "value": "IMG0001251612.PDF.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e3f702-dc17-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766065299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065299, "uuid": "7e28d387-6178-4bd4-8132-5d83aaa48629", "comment": "Malware payload (Mirai)", "value": "ed707cb36701695c659b89a2567ae791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065299, "uuid": "3fd11b1b-6ca9-4f3f-bf7c-5129feef4ab7", "comment": "Malware payload (Mirai)", "value": "d8a9128e1a6e59d452aa3db1d07318b4d9b34d06aea33eb794445ad3f54edc49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065299, "uuid": "b297d54d-a3ba-4063-a594-0d3174fe75f1", "comment": "Malware payload (Mirai)", "value": "de2851b6e4d7d07b590846e356500a77ffdceb9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766065299, "uuid": "c551bd73-904e-4c31-b293-99113e48862e", "comment": "Malware payload (Mirai)", "value": "4988ac835e50cd3b1d653a422a1de4269affd991f30e6e930fc68207454dc595fdb1a3c3d8e47da8a84a0825519f84f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766065299, "uuid": "3ce4b374-3abe-4c0e-b0a4-29257b506c96", "value": "T178931B56B9918E12C5C221BAFE6E418D33136BBCD3EE7212CD246F5037874AB0E77616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766065299, "uuid": "fd3fda56-d126-4d4a-92ee-7cb39778b508", "value": "1536:O/nVFLNlGgEzHXgisYxYl+lReyjUWNBYtidnjaSq6L3jMliRzw6DEu7ay5RYnl6x:W0gO3gLYxA+e7CldnjaShzw6DEumyPQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766065299, "uuid": "7f18dce0-a79b-489b-a708-276afe0a650a", "value": 94032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766065299, "uuid": "29a92faa-8eae-4c8a-b58e-12eb392332ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766065299, "uuid": "82bdc8f6-60de-4c0e-937c-96fee891493c", "value": "nova.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79964a4-dbfb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053488, "uuid": "ee1be361-01c7-4aff-99a9-0a91bba2d707", "comment": "Malware payload", "value": "44e9c74c1754c82ed51ec877b0c74a47", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053488, "uuid": "03a2d271-adce-4ac1-b1b1-f764241852f0", "comment": "Malware payload", "value": "d8da9690cdee89f7e28c2f8417fd08645bc864bab450853c593d2f4d66075d34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053488, "uuid": "869f4415-a8aa-49c7-8339-70cde6d10c70", "comment": "Malware payload", "value": "3fdb49c8f0194d410ddd7a2085ceeeed953d0102", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053488, "uuid": "7e486d82-0a4d-49f9-bf7a-a9c0cf4872e1", "comment": "Malware payload", "value": "ba398423dd11423ebd3acec11fb0005caf4b9c239634f90258add17cb567cfb2ec1fc68aec40946ccf6c6a26eb884bd6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053488, "uuid": "0245dfd6-7175-4dce-b6f5-91238d117de3", "value": "T18416034399949450A8B43C6B6A10FF005C5DA22E27736C76749BA3EFFB9EDA03472CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053488, "uuid": "19cdf4ef-7588-4217-a715-a4a0c584c68d", "value": "96:ZdJNgkZlLpL5+u6IpiKuH6fOf/67J+Kk4wEbQWWDtqLolcOg5lJWrvZFkun4DnLr:Zd6oK2OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053488, "uuid": "0266b8b0-e70e-43c9-9722-1b48b217df5f", "value": 4358329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053488, "uuid": "be82e12f-9bc0-496e-bb5f-cc8925cbc355", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053488, "uuid": "34520652-f0c3-45fc-a69c-a5baf8c46bc1", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a8ea57-dbe4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766043317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043317, "uuid": "9f5ddd8b-4d92-4e5c-9fb0-1abd9e981b92", "comment": "Malware payload (Mirai)", "value": "02d19ca673598585b9018305d96ab0dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043317, "uuid": "fa397db2-d14a-4a15-b221-0e8678810832", "comment": "Malware payload (Mirai)", "value": "da87f19cd5e906ea71341af9d9e6432073339446fb3ed644102670f027088f93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043317, "uuid": "7a2c5a9c-3b77-4bb8-82cc-c7e68b2defa0", "comment": "Malware payload (Mirai)", "value": "dbcb2bbed761bcced0a10dac3b9d0c4a8a6cc8e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766043317, "uuid": "61ff5ff2-0ca4-4c46-bc15-bef3387444f0", "comment": "Malware payload (Mirai)", "value": "9f929d1751eaa1f88cf552508a5efdf4173cda1f65daa2490938400bc142343e6b45fdb7ddf9091e3b9063205fce1ff8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043317, "uuid": "778462b2-8ab7-4fb0-a196-6477a9b82256", "value": "T10DC31966AD829651C9D30ABBF95E858E332303BCD3DF32179E394F24678A42B0D7B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043317, "uuid": "de6f129d-08e9-45af-8bb2-29a0bc90ad3c", "value": "3072:XFF12TxAdG141+y3eONZJlaCAofNJUH1zGzZQsZ:XL12TxAdG1c3eOjXaGFmH1ziZbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766043317, "uuid": "c9bb9ac3-4315-44df-b321-b9c157a3682d", "value": 124880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766043317, "uuid": "b2a2363d-f1da-46e2-984b-fcfb325e05d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766043317, "uuid": "318f3be4-044a-4dd4-bdb5-7fd534bbff34", "value": "rondo.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5422101-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052571, "uuid": "e19c78b2-56bc-4f0b-84b5-501d56e1b7f3", "comment": "Malware payload", "value": "e953ae5d24640a2b909fe5095b472b6f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052571, "uuid": "49a57b0c-247c-4a5a-81ce-0369c1e7d474", "comment": "Malware payload", "value": "dab8b3d169646219ed9b717dde20b09db8bef18a22f07414a365b346dff13486", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052571, "uuid": "681f25d7-327e-4c08-8d17-13dd38463eba", "comment": "Malware payload", "value": "c8fd6b4702ac43190e66a281b52b420c8799fe9a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052571, "uuid": "b1754d40-c01c-41a0-8213-a75d69b45ddd", "comment": "Malware payload", "value": "b6d1d76d4589f4bde5073bca4eabd90c12be2ead1f09cf6db5c5da3c24ad71ee005adea44b79bace690c6f745d94c411", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052571, "uuid": "d939de7c-3e7b-4f4b-b17b-fb548e8f20c1", "value": "T1F2C403EA5733AB3132F8BED96B14E5493ED01589B8DC2BE85190B9B2953DC0FD21DC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052571, "uuid": "22d50afe-03f3-4f58-a979-7293f6839ca7", "value": "768:TFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFK:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052571, "uuid": "54e14409-31ec-4729-9546-26e884b4cb8d", "value": 589910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052571, "uuid": "f4a43e28-78d7-437e-89a2-0ad21653993e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052571, "uuid": "cba352e3-3c2c-4bb0-8aec-682a3800c556", "value": "\u043f\u043e\u0440\u044a\u0447\u043a\u0430 \u0437\u0430 \u043f\u043e\u043a\u0443\u043f\u043a\u0430.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7d8837-dc06-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766057950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057950, "uuid": "ee9a4891-7979-4592-a6ef-7fc30368aae1", "comment": "Malware payload (Gafgyt)", "value": "debc07e1581a161dff034459e4ca03a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057950, "uuid": "ba1b1a70-a5e9-401e-bd3c-7396a43ef183", "comment": "Malware payload (Gafgyt)", "value": "db2a3a4456044827aa0ca9b0efbc5328fb979cbccb4620f5a067adcc3c74d0bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057950, "uuid": "86f88c19-d3a0-4dd6-adce-fd255175f0a5", "comment": "Malware payload (Gafgyt)", "value": "279215e1a1544787ddfe3b56d3c85c400d78a0bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766057950, "uuid": "0cd0c95e-9a28-4285-8ab3-92e85a08079b", "comment": "Malware payload (Gafgyt)", "value": "c468d962ca5aee1c0e989b35c81294e8eb234cb59794d3ebfa8137fce1e4fe9058b97b442040af9a61bc6adab8e46bc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057950, "uuid": "ed893ab3-3d2a-4397-a9d2-e9d493a7d6cc", "value": "T18EF3C60E6D319F7DF36C833807B74F75A25DA3D612E0C685E2BCE1052EA0649255FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057950, "uuid": "39d36ff5-8085-455a-9f42-456f98fe2d3b", "value": "1536:aGDnboJpwoAM9yfbtAshNc3kFMrNrCjlD6e9CBmqMFtZLiqI0h0hB/lw+JBtgwlY:aLofb1PL1Of/lLgwXaemh8tC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766057950, "uuid": "9e605a2d-85d4-437d-8b83-5a8caf8bb1d7", "value": 158028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766057950, "uuid": "521727c4-8bb4-443c-83a1-85551360c2a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766057950, "uuid": "e2c7c3cf-3288-4e4d-ab6b-c5474f5522b2", "value": "rondo.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a950cf19-dc1f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766068899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068899, "uuid": "1731e457-e9ad-4ed4-9492-a45733ff1812", "comment": "Malware payload (Mirai)", "value": "68d6fa67bfc1d79c67b24cfbde9e35ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068899, "uuid": "a5eeccb8-2645-4c4f-abab-ece4458dda32", "comment": "Malware payload (Mirai)", "value": "db83670a7f1f979dca8718b92f8127db1d0860bcba26ec50e91ab49cf98ae7cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068899, "uuid": "b127ff43-6cf4-4ae4-a032-d8968e1500ac", "comment": "Malware payload (Mirai)", "value": "02b73a0ae3047a893d010e40428890097eee79c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068899, "uuid": "2a81023f-1be5-4e00-ab54-501a95fee129", "comment": "Malware payload (Mirai)", "value": "9fb2f9742ffd3f8608dd52469574bdce56ae04fdddcfc8d58adac37c5430584ec1d669a6ef39bd4706e7d74f2ab0f89f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068899, "uuid": "cb174ed1-9826-4ec6-ad30-4d248196dcf8", "value": "T183633A95F9815A13C6C612B7FA6E428C3B2513E8D2DF7203DD216F217AC781B0DABE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068899, "uuid": "f75ada82-2800-4296-8b98-31f0e3ff01be", "value": "1536:qnyorX4GaLAFVhWXi8/CAkdf/aQJYrYuvyewbZnN:qnO2VhysAsf/ad3yewbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766068899, "uuid": "67e4df28-6dd4-48c3-985c-c97b8d9dcc30", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766068899, "uuid": "51593818-47cf-468f-9cea-794718ea899d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068899, "uuid": "ac012d64-8cdc-4b3c-8552-aa18a3dbb478", "value": "skid.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb60435c-dc33-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766077599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077599, "uuid": "bf33b8ab-c779-454a-94ac-a0fc6b28d63a", "comment": "Malware payload (Mirai)", "value": "4e1f10b456d8f5fa5a1ae9b44781ceb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077599, "uuid": "5888f02d-2640-4f3f-83f5-daac8502312a", "comment": "Malware payload (Mirai)", "value": "dbd0a83fd9c02f87e38f320be9fe7c80a71dc3cbfab365e016356cec6649d78a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077599, "uuid": "b73f7141-557e-419f-b7ae-510dfe4962a3", "comment": "Malware payload (Mirai)", "value": "8713a2164bfa9b3cc0b0fe37ce74d167eecd61d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766077599, "uuid": "3e894a7c-7819-4186-ba77-75bdd5f3b7d3", "comment": "Malware payload (Mirai)", "value": "9bff4edb07d13e92fbd964d009ce129b993827a3c4fa6932a739800e8ddc80125536ff2cfcedda8109e9df34c373f546", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077599, "uuid": "af7bed52-8821-4b3b-a80b-1e593ab08fa8", "value": "T183434B2179763D17C4D4B8BE21F34764F2A65B0E26A8C65DBC721E8EFF1068061136F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077599, "uuid": "866003ef-7217-4e43-b078-d7fe0e396333", "value": "768:7zo8/q95h/SF2voExb+ufVVW+djLtcPO+sdUJ/8jHjI:7zlS5FSF2v1xb+ufVVW+d/tssdUeHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766077599, "uuid": "2b111337-b08b-4d6c-b4ea-91c4ea9bb86e", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766077599, "uuid": "2c7affd4-d0ea-4d73-bbe9-11e6b35457c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766077599, "uuid": "5badf9aa-0424-42b8-a15a-4cb53a420c5d", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66ab34a-dc34-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766078021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078021, "uuid": "f7b1986e-0866-4975-bbb4-0166966a94dc", "comment": "Malware payload", "value": "94714ceaf9f13dcb4173271afcc2c785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078021, "uuid": "953dcd0e-693f-4ea4-b54d-caafce73dce2", "comment": "Malware payload", "value": "dc1895c849163f0705b3e6eba2baa2bd60c4a96b26b2d519a99c67725d55499e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078021, "uuid": "c0031185-a815-4aac-85f7-825eed253223", "comment": "Malware payload", "value": "e3eeb6cb0ae6c4d14ca7cbedb9b11450ace8dfb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766078021, "uuid": "2b209665-34cf-4614-8743-3584a0bb8e00", "comment": "Malware payload", "value": "03c7ea2711b06a9cb5e9151068a998ca3f8f9d00d02399386331ed33a1d96d5cea886d348de2518d519ea01a3e215ece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078021, "uuid": "aea0927b-a46d-4ac8-8d3d-88b66a03ae46", "value": "T19328338D81464732C8ECAF7D633FADAA06DF67EB1BC45F93DBB9528452792326B11040", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078021, "uuid": "9053f882-83cd-4e2b-858d-19f907a5e4b6", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078021, "uuid": "58ddbdb0-7b90-4556-9021-d5fc174fefcb", "value": "1572864:zQwH6rFRf3BTYg0JovWLA5L9UZlMa6kiU63qh1HqOzcsRLJvoRLpmh+yfd1+w:zQA6TWO+LAh9u6Wfh1KOzHRl5h+6dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766078021, "uuid": "bb6231b3-9b45-4dea-b14d-fae40da9e977", "value": 94630200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766078021, "uuid": "4c214769-a109-490a-b949-2db729f94e27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766078021, "uuid": "61fedc69-a5c1-4612-868b-5e0237d25d46", "value": "VanillaMods Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd81a32-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092586, "uuid": "5b55f210-1085-4090-991b-009e1cff1f27", "comment": "Malware payload (Mirai)", "value": "b02baabe1417fa22a5e7adfc8a7f21d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092586, "uuid": "08795915-a6cf-4dc0-b05e-2fb0dcdade70", "comment": "Malware payload (Mirai)", "value": "dd53f9343d5e21074a24b18ff59ab1a23e7f57ce97d1acd6a61f810f585b7abd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092586, "uuid": "d0c24a24-0cfd-499f-86ac-8394d2e9ceb4", "comment": "Malware payload (Mirai)", "value": "1324f5928f96c1e7bb709e2f4a57735ddebe7c49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092586, "uuid": "a73704c1-d623-4a4d-9831-b6db0ef68700", "comment": "Malware payload (Mirai)", "value": "9949638188577ba1af355aafce59b133fba393fd64b68eb5fff3f7679ec4d75e93a16de17cf8a718a1a3cd1365a9738a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092586, "uuid": "19f0027a-9c4d-4633-a8d2-3717fc44415d", "value": "T143633A81BD815A53C6D112BBFB6E01CE372613A8E3EE72079D266F21378781B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092586, "uuid": "323cdae6-defd-4c05-bf33-cb6b4787f98f", "value": "1536:g1NnhydU0LklPVXTMt+Zo82Op3GlO9NUVyZvXo:g1N0Yit+yHc74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092586, "uuid": "0d07c18c-7bdc-4a2e-bde4-55773179f892", "value": 73348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092586, "uuid": "7f9c2c12-89e0-4fd6-b351-e097f1582026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092586, "uuid": "1429df69-92e7-4251-9c19-184af9e39de2", "value": "xparm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecd04ea-dba5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766016241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766016241, "uuid": "8d5e98a9-07fd-4edf-b7a6-e21729b14576", "comment": "Malware payload (Mirai)", "value": "5531d58321f9f3e1aa4378bc2e1364f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766016241, "uuid": "8edeaff1-d49a-418c-8256-d422e9d81a54", "comment": "Malware payload (Mirai)", "value": "e2c78028c0378205d80f20efd6fe47aa6f9c5d0c47dba05f7d84e9bd1afda15a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766016241, "uuid": "5557362b-474b-4c50-869e-8b3d54ab2772", "comment": "Malware payload (Mirai)", "value": "c35132bb30ac38f6975388771d24b041f23e468b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766016241, "uuid": "fd99b173-e764-4b49-9702-53eb84566a5c", "comment": "Malware payload (Mirai)", "value": "a3fb8cec45b467237400adc125d4f867e3303769b6d6d21695280c46d7cd543cef132fd3ebebef1b04b7da8e328fb5ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766016241, "uuid": "53f768db-c5f2-4b76-9ec5-2ab764122196", "value": "T13FF031DF225201595184B90FB9F34C78B01AA6D928C5CB4CF94D1C75328D91CF415FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766016241, "uuid": "b7b22c80-7f1c-4a64-b67e-f2aff9515667", "value": "12:t9SKOoZD8KOhHWLKLLy8KLLhHWLKEzv8KEzMHWLKYIjD8KYIMHWLKiaD8KirHWq:t9S5oZw5RWLoLoVWLZz0ZzGWLfnfhWLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766016241, "uuid": "7ba38f91-76b8-4a33-ac56-c5c6095428d3", "value": 637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766016241, "uuid": "aeeca9c1-f794-4dcb-855f-9d03a8668702", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766016241, "uuid": "5da842a6-dd0e-42ff-8651-f45d4ea34778", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce98c7a-dc08-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766059053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059053, "uuid": "b3a1216c-4823-4574-b4f0-0766481feea2", "comment": "Malware payload", "value": "5614c1be4813aa8c6eb4e7dfea210144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059053, "uuid": "a1156be8-733d-456a-8437-19ec364a5123", "comment": "Malware payload", "value": "e45a26bc3bc049aba3993488843e2fa11e9a6588f37a3ad17370f1e8ac6a2529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059053, "uuid": "34bc065d-d953-4fd6-a915-b63c2a68a4a0", "comment": "Malware payload", "value": "ef46d71ab3393a862bcafc8fc2548ddf8f7ba7d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766059053, "uuid": "5bc62825-f575-456c-a7c6-78048fd7f80c", "comment": "Malware payload", "value": "b4d00f63385b2609e29a1e088f95020d3a08a0a1566cba1a3a7b394943eb6088c47bd86f4a2d4e0cf0b767d7be6d8153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059053, "uuid": "a76575c7-dfb7-482d-a6c4-c0b6375ab2f4", "value": "T1D7D623E359E831DDD4D38A70A38F13CD60F2A4664DA6B92D3BC61C039F34E53D146A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059053, "uuid": "f127e90c-f05a-49c8-89b1-e6198d727cc8", "value": "34cffe24d38c3e07ad65b8e816150564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059053, "uuid": "be9b0b7e-f09a-453f-baa7-9e7e2ffcf7ff", "value": "393216:3sKzAfufGCjSX+S3/l3+j5+YPSjOy17H:35kfMXPS+5cjOyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766059053, "uuid": "dd9a778b-302f-4be3-a4b3-b99d69ebe8c5", "value": 13645312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766059053, "uuid": "db824a82-b540-4219-bcc0-256bf90bc0a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766059053, "uuid": "7d2bc40f-1131-472a-b5b5-bd7bf24b5785", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0e4a27-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766052399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052399, "uuid": "19c312c1-c423-4365-b689-72ba3802656e", "comment": "Malware payload", "value": "cf0832ddd1cd3963ae2d4178314d1aa1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052399, "uuid": "aef7c928-d446-477b-81ee-9e79a1b12b1a", "comment": "Malware payload", "value": "e5171c6620010481f268677b95f28c24e3bcbffe9903a6e32078371972789dd8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052399, "uuid": "85454452-6fad-4b44-8392-a1325a44b290", "comment": "Malware payload", "value": "0bd36ff184b1190dafd949097848be292851fcec", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052399, "uuid": "99bd61d6-df49-4d0a-8ab8-4054b33aaa47", "comment": "Malware payload", "value": "8b61266d474d6d957a6a44c9b4079529aed4a3eb5a632dd286b3ad8c4669a73319866221e409048412f027b06b3f0cd2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052399, "uuid": "4c438712-23c7-45ed-aa50-6289bf486bcf", "value": "T19EF4DC259398179058DE53D5C3589A26ABBD322F4C353C3CA8DD0D86EC3BB858B72B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052399, "uuid": "b6b58b74-e05d-4fa4-88f3-e7693db414b7", "value": "96:xAn+TjSsn0EWh9nJHUDgulSIA49aw2YwRJcqOzTg0AUAQ5eO7dySlxgymY+EXn:m6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052399, "uuid": "1b4209f5-eae2-44d1-9e06-71aae1b5d704", "value": 754495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052399, "uuid": "559f1180-05e5-4f2d-b00e-a378ece1ed67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052399, "uuid": "6056639e-ba66-407c-b20d-e10cc29e4f8d", "value": "PRO251105-9704 TONG HSING.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4711ac-dc03-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1766056666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766056666, "uuid": "8686ce34-3d07-42d6-b174-434420c5b29f", "comment": "Malware payload (GuLoader)", "value": "9af64b588e684eabc7688ebd18c6c952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766056666, "uuid": "52cdb50b-7b4c-4313-82d4-ca64151e4e7d", "comment": "Malware payload (GuLoader)", "value": "e5ea032d4d5c0ca8ec5ab01e9adf47ded5b2c2ce78a1587ac4160afcc1fb02f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766056666, "uuid": "e0d639b1-65cf-49cb-8bc2-829e6bacae3f", "comment": "Malware payload (GuLoader)", "value": "adcdd42236f81c9751c3a8daf147f1b4927b7207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766056666, "uuid": "7f4c85bc-dd1a-46ad-a638-21d34c2e6293", "comment": "Malware payload (GuLoader)", "value": "ac8adf0a3147857d41f54e18f26803e566eb857710522904db4e7f6370bd78a992c9322f25c03371b962657b928cfed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766056666, "uuid": "ed026107-14a9-47e8-b390-940e7b62b6ac", "value": "T1B284F160B780D09AFAA147719E5BEFA612987E353C60868773D0BFDD3AFD221A501307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766056666, "uuid": "df2673ec-9f32-4fdb-9acf-c2664e78b733", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766056666, "uuid": "db77dcb6-fcca-49ba-b156-d8bae22f2474", "value": "6144:Z4t6Ls84Wwhvn3yRH1YnCdIkbuLws9r8Y5pajMnGayzUuJrxxLu6g:ZkRW2n3iHAC3iLwKAY5cWGaydfuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766056666, "uuid": "447fc192-20cd-4e65-ac24-e69fb1c54c5a", "value": 403424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766056666, "uuid": "214b11f5-82a2-458f-bd11-f55a2390523c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766056666, "uuid": "ce17d790-5e83-49b0-8a4e-819fe043ce35", "value": "Zam\u00f3wienie nr 001632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52343f38-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041694, "uuid": "05976f82-6d44-48a8-b80f-da3bd18f7a5e", "comment": "Malware payload (Mirai)", "value": "84dca034a3cddeee342c8c0047a776ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041694, "uuid": "94d553c2-ed72-4bed-9bd4-7698258cf886", "comment": "Malware payload (Mirai)", "value": "e889d3720572f0fa06350ddf60f4b6d227f89325cea8c801bfe5ebd687f3e8cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041694, "uuid": "72e42e3d-54e4-461e-9000-e4058f609121", "comment": "Malware payload (Mirai)", "value": "8e1811ba6658a266218b9542b04bbc79dcbc8307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041694, "uuid": "177e7764-425d-412b-896f-65bb5cf29343", "comment": "Malware payload (Mirai)", "value": "ad0776ac1a28674016eec67f4522d5888c21d4a070a1d661f0d54f95b5115ce73f2a4aa612cc4f76a902054cfa3349e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041694, "uuid": "8383ce15-f0e3-42f1-97af-2ccd15b1797e", "value": "T15523A419BF654FB7DCAFDC3309AA1B0124CDA51B25A93B357D74D828B20B24F05E3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041694, "uuid": "5f904775-78d0-405c-afa7-c5a8aa85bc86", "value": "768:RIA9NQowiYjgiAJYASP5Ane05ZHe+egceawEtQiVOXiGw+e6om1vI+:RIArJw5CQ5o3v7FcpxtJGeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041694, "uuid": "fccf8534-a864-4597-9324-a8a1a6f3b4b3", "value": 48908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041694, "uuid": "c1828d9f-610e-4913-ab3c-50772f9bd45f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041694, "uuid": "e5ad0713-73be-49b8-bd79-db7fb880303d", "value": "kvariant.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746ab2f0-dbef-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1766048194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048194, "uuid": "4cf19571-2861-4762-9d6a-c8e42c4c7eb5", "comment": "Malware payload (Amadey)", "value": "b8856ad35346120c9961a4a49f0c46d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048194, "uuid": "6822cbd6-9539-4a65-b5f9-99bb6c4ceffa", "comment": "Malware payload (Amadey)", "value": "e9b7e356de34d2478436920772e301162e025b93ca7326a9934ce2a965357091", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048194, "uuid": "7cd20b10-0089-4f74-9745-dc910e538395", "comment": "Malware payload (Amadey)", "value": "889e570e85d3b1db0ea039c171b69d9f87a76777", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048194, "uuid": "61a4a010-1443-4a15-8bcd-aa26ab07f5d9", "comment": "Malware payload (Amadey)", "value": "3f1d6b6d7e56608bc462da846b94d4414b11ba2f5d37d1004e7f879fe703bdcc53734272e027710aa3a305b84293be75", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048194, "uuid": "c90c79ca-9e40-43eb-bd8a-ea6213f05867", "value": "T10FB4D049376410B8E4678238C9579A0AF7F27866077097CF13A483BE6F677D19A3D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048194, "uuid": "3f0fac43-c8da-46b9-b7ff-c3f6e234429e", "value": "a1b7e9db6a3681d8b4e75fe6a58cec23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048194, "uuid": "4410e311-4d29-4dfd-acfb-e2c071022625", "value": "6144:HeynuG7MCVB+nRVjnT2XvZgXXvWsIvWX+qY0X46odgaKnIz+QfUdAiIEwc/5f3n+:HeyB7MCVAzVaWX+CYg7ni+PdA7xb7PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766048194, "uuid": "1def716b-0f59-492c-b534-85dcaeefad3d", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766048194, "uuid": "6b367d00-3743-41ff-968a-0f1a55cba7a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048194, "uuid": "cbf1a262-81cc-407e-bbf6-c6ec9ab7b721", "value": "b8856ad35346120c9961a4a49f0c46d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5cc8f9-dbf9-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1766052393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052393, "uuid": "4d5b72e3-b97f-48c3-8573-54062689d902", "comment": "Malware payload (MassLogger)", "value": "3673bd0262c21548c2d4769bd8b9ff59", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052393, "uuid": "f6706d2f-5496-4445-93e3-c1e5b938ff56", "comment": "Malware payload (MassLogger)", "value": "ea408f9698d88fbdb0073db26463a33d2ffef2d241126a918cf2184eeb1c76a8", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052393, "uuid": "390d917c-694a-4da6-97a2-2c1f0f75ad1c", "comment": "Malware payload (MassLogger)", "value": "0946448075e970cf4c6d0274afc7f3dab0862b01", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052393, "uuid": "04f85d13-4f7c-4a7b-afcd-ed6da173430c", "comment": "Malware payload (MassLogger)", "value": "85068209b566e8385f4e0fb6b56955ca27cae1f31a2aa5da149531b8470e012a0ec89d2f81eee850e02691785a49be06", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052393, "uuid": "98b4c7a7-5f6f-4746-a714-8e958da2cedb", "value": "T12B55E45E4421ADD3A054FDF0F540EFA78CDB5794122B47121FE5A8AD2212887FFAB2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052393, "uuid": "826097b9-ac7e-49bb-94db-3022c8bc26c3", "value": "6144:8tjUdl11LqcccV8cVwgLy3tBOf/0CnDnNGqyykyAXJpUD7FVJtpH8kFzlR3LAtcC:ESDNl5l067cfI8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052393, "uuid": "29f40d69-7e5e-4066-b169-8fd2d37bc230", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052393, "uuid": "faf9558e-0201-48c6-8b44-f28c1a103849", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052393, "uuid": "5b208262-3536-4ddf-82f6-236cbb61d661", "value": "dekont.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7379fcd2-dc3d-11f0-a129-42010a9c0007", "comment": "Malware payload (BazaLoader)", "timestamp": 1766081693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766081693, "uuid": "fe5cc7ef-3651-4dab-bb1e-62c845bd1c74", "comment": "Malware payload (BazaLoader)", "value": "aa73093aca9d140176c7c00855bea2a2", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766081693, "uuid": "cd62527d-c7c4-4f18-8881-d218f82b614c", "comment": "Malware payload (BazaLoader)", "value": "ea9616a3d06e0ca514ef51b73f2fe10f3ffc819af391878e9a35879b40ad8ad4", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766081693, "uuid": "83037452-0915-457b-8890-56a5d52dad21", "comment": "Malware payload (BazaLoader)", "value": "5312fef166303fdfe5cc1b69d96429730f18c96d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766081693, "uuid": "f5b8eb4f-881d-4b85-b0e3-fc3a3d298e4b", "comment": "Malware payload (BazaLoader)", "value": "204d682c35d3ddeebeac3dbb1e9fb95689ee871dcdc045e8e3a464ff69ff9f191f60cc35c9c9ee746f2e66c91da2896a", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766081693, "uuid": "5cb63a74-e1c0-480f-98cd-b4eac8493704", "value": "T118665D92ADA04AA9D5ABF238EDB1529173307C04477126D36F923AB50DB77C4133BB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766081693, "uuid": "ce16516b-1aaa-47b6-be2a-cc495a430438", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766081693, "uuid": "a265dfb3-8194-40ab-9386-188cd63ba946", "value": "49152:ZU2PI3+40D+anb+13qbhfoU0BTY/Kd8ZtzujIe77BR3c/P8xp2meha8:Z/4DBRXp0a8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766081693, "uuid": "27479819-481a-4fbb-b54d-888651ded12a", "value": 6802696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766081693, "uuid": "7b956ed3-6ed7-45d5-a76f-dc52f3ee3bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766081693, "uuid": "864b9a8e-dd93-41b1-9554-cf83d2cc700f", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7aaa2e-dc6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766100873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100873, "uuid": "eb60e9ca-1443-40c2-a8b4-a8b3accda9bd", "comment": "Malware payload (Mirai)", "value": "1eed6fc6c8057b05248a9ea4ca429ae4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100873, "uuid": "a3b1bcd1-d4e7-4bc5-80ba-75ae56814d9a", "comment": "Malware payload (Mirai)", "value": "eba7f55fd909e5a43c09765848af3e7516844a3921641a96be6caa32f74bd2b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100873, "uuid": "daf790bd-f9e5-4380-8266-75abd7306574", "comment": "Malware payload (Mirai)", "value": "37075bed47de5b993353879ee31ede46725bf59a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766100873, "uuid": "06614b65-dde6-4071-99be-ed723857470f", "comment": "Malware payload (Mirai)", "value": "802682550d5c51f5fed451a46cfffc7087f340e04a6ca9091c71502f3b18e47e9e5048bbad3a2c02c45c0c55b4a7eab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100873, "uuid": "e970edf2-3f4c-43a6-b27c-2e7497eff5af", "value": "T181E3AFDFB22399A4C42187F42BEB57AD26B733255E1FD8F36C0E923B18264C74921752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100873, "uuid": "c886bf93-a643-4e60-9ee7-4579a85a4a38", "value": "3072:avTqk99CsQGQmwQJu5B5Thf4mOQriebS/g6qdY6:yisQGQmzA5ThfpI7qdY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766100873, "uuid": "aca10fce-f17e-49a0-8057-87785821e82a", "value": 152876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766100873, "uuid": "009d00d5-0c23-499b-a36e-596509009130", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766100873, "uuid": "af3d2c2c-cd4d-442c-b83b-1f6de95742ff", "value": "rondo.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847be3eb-dc1e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766068407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068407, "uuid": "571c8ffb-c2e8-4e09-b80c-c38dfdf52a4e", "comment": "Malware payload", "value": "5650afae8c1c887218fcd880edcccf75", "object_relation": "md5", "Tag": [ { "name": "151-243-218-164", "colour": "#7D68E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newkget-com", "colour": "#8EF944", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068407, "uuid": "9f4016a7-aa2a-4ad0-9604-9117a3fc9d2e", "comment": "Malware payload", "value": "ec831b1de5e2d9c38a3ebd096ef9af1425abc2a866cb042a31600d98c64b5740", "object_relation": "sha256", "Tag": [ { "name": "151-243-218-164", "colour": "#7D68E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newkget-com", "colour": "#8EF944", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068407, "uuid": "a1f42e9a-082d-4a8f-a138-bb12647b422c", "comment": "Malware payload", "value": "4c1b38910420472435161a88a94b75032ed0dcc7", "object_relation": "sha1", "Tag": [ { "name": "151-243-218-164", "colour": "#7D68E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newkget-com", "colour": "#8EF944", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766068407, "uuid": "b3c3f1dd-fde7-4830-964a-82d460ec4362", "comment": "Malware payload", "value": "4f3c6b2cab09bc282ad886d3c0c3d28dc7442467a3e3e03fe43e5ca332565a7b7bdd14c1a704c49ea89aafd6d882171d", "object_relation": "sha3-384", "Tag": [ { "name": "151-243-218-164", "colour": "#7D68E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newkget-com", "colour": "#8EF944", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068407, "uuid": "aa17fa3f-5f60-42e0-991d-e4dc9e3d64c9", "value": "T1B9855CD632D84518ECAA5F3906308E651BB7BE69BC38F50D7E41B26D0B777C0985072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068407, "uuid": "ce1fc698-9b0b-4a76-b854-51863b20097b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068407, "uuid": "98bc6698-97d3-414d-9363-378832142727", "value": "12288:ejWZ0Lpr9YtQZZzdCJvkx4uDsBVzlaDSNd7GPbv1b9iTQgm2CapDv1apDWOkWOw6:wdZZzdCJvkYzllNkPbdb9tV2CJl6WA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766068407, "uuid": "9f96dda0-3bb5-4257-a9ab-07efbb74168e", "value": 1834352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766068407, "uuid": "d17b13f0-62da-49a8-a09c-1ac64005b9cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766068407, "uuid": "2a133b87-59a4-4eef-a741-30a75a9afdda", "value": "novos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e9c2b1-dc64-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766098469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098469, "uuid": "92fce914-37d3-4c0b-b0d3-3d371eaee850", "comment": "Malware payload (Mirai)", "value": "0e843fb3a6dc2218da4d50da1562653c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098469, "uuid": "62025277-9760-4619-86a5-97b62be2bb34", "comment": "Malware payload (Mirai)", "value": "ecc177e3fb1ecc1c03df421e43e3131f3b818a85a0751638ed7a00304ebdd049", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098469, "uuid": "3aa0c1bd-1abb-45b9-b4f8-92f31cc94732", "comment": "Malware payload (Mirai)", "value": "54d1b576b017711a8b2b1406e543e4fc1cd99658", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766098469, "uuid": "3a467d37-fdf1-4069-abd3-f3578b762616", "comment": "Malware payload (Mirai)", "value": "299a1dc1fd75d6ac159d640630f86c349629cb13b610058b00bbe7ad73a7559e8462f731ac795c3970af25ceadb65b9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766098469, "uuid": "5d455f93-39e3-4d90-a2df-e65aff665673", "value": "T14D244C02771C0A57D1632EF0263F27E183BED5E120F4BA89295F5B5A4276E372486ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766098469, "uuid": "5d947ecf-12a7-40ab-ac54-49093356ea84", "value": "3072:1Lp5GwTJZpJ5Q+XXT/Fo4gUNejScK/oHXWIYnxK0clUjAkz:bU2JxXjNo4gUNejtK/Mm9nxKVUHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766098469, "uuid": "0b53e7b8-b9ff-46b2-b880-5bdd7f874af9", "value": 228180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766098469, "uuid": "3fe735dd-df2a-4d38-ab09-ccd81c55d24f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766098469, "uuid": "5106eed1-f79c-43b2-ba51-82d515e58af7", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d132fa84-dc56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766092588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092588, "uuid": "350f7d98-7063-4fcf-9133-db6fc750e4fe", "comment": "Malware payload (Mirai)", "value": "5e384f12a25b66fa6b3418339a4e7075", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092588, "uuid": "950ac49b-ffb0-4fd5-bbfd-43011d6ab39a", "comment": "Malware payload (Mirai)", "value": "edab2b41df11182519bb978ffdfa0bf4bf3e81b5aa92cc844140f706c2c70f77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092588, "uuid": "395d63c5-98bc-4ba0-8806-b5dc732aacb6", "comment": "Malware payload (Mirai)", "value": "cab5a695aa0b1001a83eb729ebb7d4e7e3b2e883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766092588, "uuid": "d021e205-7158-4c7b-9892-015ea966287e", "comment": "Malware payload (Mirai)", "value": "305ebbdbaac01a7417b1a0c48893135e5ea2dd149a48200406787ae9daa2fbaf3b962324acb50efc79206031ec1812c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092588, "uuid": "0dce5d13-6790-4593-bd57-07f2edf7acd4", "value": "T138E32A46E7408A13C0D6177AB6EF42453323AB64D3DB73059928BFB43F8679E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092588, "uuid": "4660c87e-ce70-41e6-b69a-e1e5fb96a778", "value": "3072:TVu+Je4XalHzbx8PogNLCz7QHE8E1LNJmM/9KIS:TVu0XalHzbx8PBNQ7sEH1LNMM/9nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766092588, "uuid": "6573ec2d-e258-4333-91a6-376266c5b2d5", "value": 154279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766092588, "uuid": "af4aa658-adc3-47fa-bd61-96ec03c10135", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766092588, "uuid": "6843cd40-7d78-453b-82d2-ac1008069c5d", "value": "xparm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908ff5ec-dc67-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766099781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766099781, "uuid": "9e49e8c4-227a-4d97-be4c-d901557bd741", "comment": "Malware payload (Mirai)", "value": "0c16fdb7bc441c92c39f17db26db42e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766099781, "uuid": "a1a3c681-7422-4aa7-82f9-54e866005750", "comment": "Malware payload (Mirai)", "value": "ee076847adf595bc1b194b3d7bb83ee618cd6221464d16affc856cbf27ff1046", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766099781, "uuid": "39f63e7b-5ca3-49a6-96c4-7b893abac11a", "comment": "Malware payload (Mirai)", "value": "fe3bc8df713bb0bb25c489e93c6524bb4ea9d08b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766099781, "uuid": "d2cde143-b3d8-4c6e-884e-08c85216f5ef", "comment": "Malware payload (Mirai)", "value": "cdd201268d60eab6b3e291cb250e3722729ffb22a2104ee924c5569c94d2b62c96672271aadfb2a633268c9fa743c23c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766099781, "uuid": "ab3a7f02-16bf-4dee-a7a2-53f73e26534c", "value": "T13C346D97F802DDBDF80AE67A44170D09F530F7A511931B3A6297FD67ED360990A23E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766099781, "uuid": "c3a3dba6-a0eb-426c-92a2-c46b4fef6de9", "value": "6144:99MVR3zAlKXzYHddxy7ppEQpdLn7aJLi86K:z2/zYCp9RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766099781, "uuid": "62c1700d-3d7c-4f80-8e4e-cffd2bf144f4", "value": 248292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766099781, "uuid": "ac4483a0-e3ad-422d-9766-abdf2b0313be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766099781, "uuid": "d79ac993-f9bd-42bb-b13f-665f6e9b522f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94be4bb-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041894, "uuid": "e7061bff-78c9-4187-9996-5abc6fc77d93", "comment": "Malware payload (Mirai)", "value": "172ecd583f2b295b1b9aca1415bdfbb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041894, "uuid": "b2ad63da-e035-48bb-9d45-022600771826", "comment": "Malware payload (Mirai)", "value": "eef98953e2ef738921a49e335e39b95e42a184adde53611d0e2e4647d8859f7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041894, "uuid": "f2ac1f4a-87e8-4ffb-97bd-ca931c27eebf", "comment": "Malware payload (Mirai)", "value": "edd167b8bf90e5ce58f9223114b5225958e82ff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041894, "uuid": "89d46283-6ec6-4ab0-8260-8b5155680af1", "comment": "Malware payload (Mirai)", "value": "37b440c086f38d31171b2f895e75e86a5d8e9afb3a5079e17c82ba6cebb47a8b8ce0f98c4749da55c362643c1b684f99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041894, "uuid": "1ffc9580-9174-4004-82f9-d4cbf6246e48", "value": "T18803F895B8819A03C9E45377FA5E42CD37266398E2DE33039D222F513B9A82F0D7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041894, "uuid": "2fc2cdfa-9f4f-4864-9606-eecb91ecffa9", "value": "768:Zc36BjgxwdTeUYWiVHuhH0blDQV96RN+QE8Zx71v:cAMSTdsBQVSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041894, "uuid": "f56b135d-66f7-47e4-929d-e0cad815f934", "value": 37704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041894, "uuid": "c26d8022-4304-44ca-b25e-a0e6ecd953e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041894, "uuid": "eb374c83-f419-47d7-857e-7f678167dc05", "value": "arm5.b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033d30ff-dbf0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766048434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048434, "uuid": "4bf358b6-ba8c-4018-8e47-b20ada91f36d", "comment": "Malware payload", "value": "9bebd443673bdd3ff71c1a18646a1662", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048434, "uuid": "53130c69-f7fa-4ac6-8889-e0e3422b7fd2", "comment": "Malware payload", "value": "ef82f249630ddcecd7a7251bc29b7457214e59dab67951b1d85d7c392b0043e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048434, "uuid": "1a6410b7-1b8f-43f9-b2c6-0e77e31bdc01", "comment": "Malware payload", "value": "4a2b5981340b458b94933e5d3bb4d61f1bfc62f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766048434, "uuid": "86eb52af-edde-4c7b-a066-ec22a89e1a1c", "comment": "Malware payload", "value": "0dd881d5675149e5fd20c28aa0dc53a46dfea57a6cb089a358d84d443e93ddd359db172e723fbf5bb0af99646cf55549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048434, "uuid": "2cbddc35-c824-4084-a094-b921cf4d0f66", "value": "T1AB07335A665308DCF9EA1536E6F1C012AEF2688E47B1D39F17B825200E773F19D39B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048434, "uuid": "c97a36d9-240a-4762-b1c3-611e16535b7a", "value": "456e8615ad4320c9f54e50319a19df9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048434, "uuid": "0be18f02-056a-4781-82c0-b326bf63c649", "value": "393216:Xl82DmdYT1+TtIiFmY9Z8D8CclFhCW8SAxGtCQMnSOX5+XpZ:1PeYT1QtIXa8DZcYW8SAYtaFp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766048434, "uuid": "d36a9008-4e74-4537-8b0f-33bc17e97c57", "value": 17566487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766048434, "uuid": "c000666a-12b2-44fa-a9ed-079e816c3a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766048434, "uuid": "215562f6-b21e-4857-a98b-5458f884b691", "value": "main1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b27731-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085274, "uuid": "75085ebf-00b0-4deb-8c34-e95c647af084", "comment": "Malware payload (Mirai)", "value": "088ed098c3fe625f63555d5fea9af230", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085274, "uuid": "e61f27eb-32fe-4ca8-9cd3-ebff6dd67e29", "comment": "Malware payload (Mirai)", "value": "f2a7e0a01405e768ed2ae07cd70efed2bda22d909a10a9daf8987f634d697f96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085274, "uuid": "5a0d49b4-c645-4c19-a418-6d4737ce2de4", "comment": "Malware payload (Mirai)", "value": "19b8d6c7700b58aa0843488197c01bfd6a676c69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085274, "uuid": "3c493c06-26e8-48ae-8897-7de3de641c4c", "comment": "Malware payload (Mirai)", "value": "9a2b6ea6b39729c946ad8bacdeec386207db396e04e7116e157e9d642ebd5d785ad5bb9a8f29ac6f52398357ed80224f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085274, "uuid": "024b5c1b-f73f-497d-ba17-4bfb914fafaa", "value": "T1E553F1C06B0864EFD538E8B617B41BA04D514B95964EDC64942AFE8DDCAB2F3319BBC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085274, "uuid": "c275b197-d160-42ee-8fee-81157b79323e", "value": "1536:/uHppmxrmQoERcFFF6oOMovBZHaXJ6qbgjz8ATDpVJuv:/uHppMqQoL01TPqbgX8AnpVQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085274, "uuid": "527c2b9d-b193-483a-a34a-865bf1721215", "value": 60992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085274, "uuid": "3114a1af-5340-4784-a299-61580fc26b09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085274, "uuid": "ce06b1fc-baaf-47d6-9f32-c3accfd5c906", "value": "byte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f291de-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1766052859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052859, "uuid": "e000bd86-5574-4882-822a-65f5429ae566", "comment": "Malware payload (GuLoader)", "value": "19ddcab4e91746ff74cdd3b817129ab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052859, "uuid": "b00dbc4f-fb42-481e-85a3-860290a9f39a", "comment": "Malware payload (GuLoader)", "value": "f4d013a38523b5b730362b377143a66c1f6ed8fe37c704c0ae7a6db505d1e71b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052859, "uuid": "9de8760f-a2ae-493e-8dc0-84f365651ede", "comment": "Malware payload (GuLoader)", "value": "535ada3e9c3eef730b81bc1f6f4979735fa02e06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766052859, "uuid": "4c19d7fd-83a4-4ba8-b489-595f103143a2", "comment": "Malware payload (GuLoader)", "value": "4ecfb38011151e693311ce423a59ae028fbaf9a247ac25b56dea14e9db4957059161c11e909b66a2d1c8227bbeba76eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052859, "uuid": "5e9b2773-28c8-4c4e-9427-fc2c1ff3bd17", "value": "T1F99402A17B50C09EFAC147369E57EB622698BE393954868333D1FFDD39BD2106A4130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052859, "uuid": "784e8037-c1c5-4d86-9e0a-0390b55a8a4d", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052859, "uuid": "7ab0ef89-a561-4a97-a6bf-c7a7e3fad33a", "value": "6144:/4t6Ls84Wwhvn3yRH1YnCdIkbu1dsYO3TFhuYnuRPuDOi9Xu6c:/kRW2n3iHAC3i1dXO35fuRPuZXun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766052859, "uuid": "f0880b6c-111a-4b45-86b1-c3152c1c9755", "value": 429712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766052859, "uuid": "e6fb5946-df89-4564-9f5d-0ab983fd5741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766052859, "uuid": "135c87d7-1959-4b29-ba09-aab027d288e6", "value": "Stomatitis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83b40a9-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085271, "uuid": "5faae94d-acdf-4b5e-b85b-9ecfa199f505", "comment": "Malware payload (Mirai)", "value": "8548fe73617a4ec5fe699b6a4865e899", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085271, "uuid": "6c60c355-440a-4a80-84ad-2f25e2e58144", "comment": "Malware payload (Mirai)", "value": "f61eae9c2b702164b6a2808c35a37e8d8b9e92abebdbe82ec5a9816e7037b56e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085271, "uuid": "be5631c0-0e24-4775-a0b0-d6e222627706", "comment": "Malware payload (Mirai)", "value": "2373762721b349e40df21642157294a63d744f25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085271, "uuid": "d220f5f5-7374-40a3-92ee-658a0e3fb873", "comment": "Malware payload (Mirai)", "value": "57150451df1e51cd1d97a89c75b843800556187a8a8fbe090420209fd4ddded0a28c4c5e4ec3514606ee62646401d823", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085271, "uuid": "16f3dbb5-4ab4-43f9-a8c9-aebc2e6f7b8e", "value": "T1EDA2D178B64EEE61E7704832AE358953B34647ACD1E931120DA48956FDE1C842BFC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085271, "uuid": "b873fcae-8b42-4462-977b-4dd85b1dfd04", "value": "384:Cme0h5w8/PKNpsh3Sn7DM43i5+K2hXf6X/y6By5NO+hymdGUop5h/f:vFHw8UU3SvMwhP6amy55s3Uoztf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085271, "uuid": "f7d9a760-5173-4c83-b4fe-9465bfb42e19", "value": 22896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085271, "uuid": "86749218-1508-4391-9bb5-f1a038a7039a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085271, "uuid": "cd89a4dd-45f3-4dcc-8a90-53967f4a835b", "value": "byte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee239199-dc45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766085335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085335, "uuid": "ddbb5547-fbc3-4c98-9754-f78909c2026c", "comment": "Malware payload (Mirai)", "value": "af4e3e2b96d21e86bf09da2c4344aeef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085335, "uuid": "3efd65e4-e92f-4b85-bf71-f3fb6569743e", "comment": "Malware payload (Mirai)", "value": "f65ca0ed5ca61c25041d4afe1a516e8df06b6959f0de9ae9c3a8df028c8dc2d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085335, "uuid": "b025242d-1a2c-4b34-93a6-f1e833ee9d96", "comment": "Malware payload (Mirai)", "value": "6d31ff86850698745d8aaa9e30e772c684d951e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085335, "uuid": "67ed3f03-b840-4ae6-ba8c-a40261c30bbf", "comment": "Malware payload (Mirai)", "value": "cd47b9ff5c14f8310ad66d5e308adf14a8c81101c89093fbb7b5ed02040447ca3e6f212aa837ece88e61067b09a8b358", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085335, "uuid": "6c076be0-9ca2-490a-97b0-0cecd14b135e", "value": "T1AAF33A56B6408A13C0D6177AFADF424533229B64D3EB73068928AFF43F8779E4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085335, "uuid": "0f9ed00b-727c-4d1e-a301-d7bdf34bdcf9", "value": "3072:vXyVVupqGmH0DJSAaR5L8cXgvBNPyY2tA4PzgkCobGM/9zy5vt:6VVupfVUAaR5L8cwvbyBtpzgkCoSM/9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085335, "uuid": "e5ab5658-8a93-4ea4-9433-41666b46be46", "value": 162391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085335, "uuid": "eda2567d-a86d-4b87-b285-06e70875cc85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085335, "uuid": "32b7d65a-f32f-48ba-9f66-027aac5b345a", "value": "byte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9aef112-dc00-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766055612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766055612, "uuid": "1ed21c53-574a-45bb-90d2-a1a6cd033ffa", "comment": "Malware payload (PureLogsStealer)", "value": "5246292dc8fc55edeff56fbe8982dd9f", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766055612, "uuid": "64ba4831-a9d7-4049-b87c-009ffa5a2fc8", "comment": "Malware payload (PureLogsStealer)", "value": "f747cc1882b314b04eacca126867ae58da4ea7a76a877835a2eafb86260903b5", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766055612, "uuid": "603755ed-a139-4fa3-a094-a473abd9d5cd", "comment": "Malware payload (PureLogsStealer)", "value": "82358fe4b2d0adb3fa88e1451b4ee8139a102405", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766055612, "uuid": "10aa7890-7752-4776-931b-81fe74aebc06", "comment": "Malware payload (PureLogsStealer)", "value": "d2c1ba9b99c194599c4ab2a20cdceec4e2a7c87ebb0b2fe95d015f2a14a640cf89413a21db3f8fc7ce06d27d8c425167", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766055612, "uuid": "db9bf0ac-f7de-4c50-b645-d21a0cd7db03", "value": "T196E49244DA078658D749A235C640EE6C7FDE4469E7E4816A1FAC13EF6FF1420DB2EA0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766055612, "uuid": "cab42a19-9daf-4e83-9a9f-2fd51129c0f9", "value": "192:6y1NIEd8WEjisx/3SRA6y+QNAk4daYDjR6Uedx1oGfOvero+bOs1LF4ZdkCsgslK:9Ic7uiY0ZfWoEooLF8dkC9cn7an", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766055612, "uuid": "6579febf-a20e-4565-9f5e-53efbd4b4343", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766055612, "uuid": "10c1047b-81ef-4073-94b3-05ca88dd4122", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766055612, "uuid": "042f26c5-ec15-489a-8cce-440e071a3713", "value": "nINVIO_DOC__FAT.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f0987d-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041695, "uuid": "35605409-1000-40ee-8783-ce44916c66bd", "comment": "Malware payload (Mirai)", "value": "bfd90ce5ae7482d7c682d54759226e60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041695, "uuid": "1b86b9ec-6c5d-486d-a979-2c19e3725395", "comment": "Malware payload (Mirai)", "value": "fa67e2b47ca0fae63c34d3cf9d10368eb122faba050444fafba8fa6028736a90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041695, "uuid": "62ef6226-8605-441c-a5c5-4dcc8c89d753", "comment": "Malware payload (Mirai)", "value": "92d5b13b34200574be061fbd43a8ead26fd2ede9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041695, "uuid": "7bd522aa-9c86-49a2-be5a-873e7ca85ba4", "comment": "Malware payload (Mirai)", "value": "9885e620819f13dbd476d47aa104c9abb2e63c1d086317f3c143511bd7c5befb3882677a19ca8210804c2cea0a5c76b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041695, "uuid": "846b226e-16a8-4cce-836b-733dcba25ad1", "value": "T145E25CA2C47D7E88D22C4B3869219EB42753E50AD3B71EFA174587728047EACF61D3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041695, "uuid": "fce2a20f-448d-4d19-b541-a3446f5c6bcd", "value": "768:0aIO64HzwtRYEco2qdtW8aCco2VUQCTc1vF:0aI0TwtndtW8aoGUQCTYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041695, "uuid": "40d2352a-bbd4-4745-8fd2-26860eac03b7", "value": 33604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041695, "uuid": "33a0bb07-32cc-4721-9468-bf90cfaa6f6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041695, "uuid": "55f3d1d4-08bf-48e6-abfb-01d12ebab80c", "value": "kvariant.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f47d88-dbfa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766053022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053022, "uuid": "785b59e5-f8c9-4aea-9c58-95b422099725", "comment": "Malware payload", "value": "5d97413bf847a4f338007d6959703dd6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053022, "uuid": "faf27f9b-5129-49d4-bda9-90920e5ef84d", "comment": "Malware payload", "value": "facb54a3d9d8e155fc0c564c423f2ac27cce8888dd95727348869d2957b8d999", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053022, "uuid": "6faf1457-f9d4-45eb-be7e-101ec3c0e373", "comment": "Malware payload", "value": "c026578c77732389f51f3a3a1b9d761d1164bcda", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766053022, "uuid": "8a87c76a-079e-4590-a812-d0e04e557605", "comment": "Malware payload", "value": "76e0fa83e5af866d64db31335dd2be41d7e0c05013c627703832834165114de246e7b5aa1aea2661a8e9dc995bae049e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053022, "uuid": "b62c4798-5573-4ba1-9e34-9ba035d29eb7", "value": "T10053CDC93AD2B4A0536270B32D2BB06BF6BF1C88750D40D5D766A8C4F96C318D5F2B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053022, "uuid": "1b05cb04-1381-490e-99dd-3c751b3eafa4", "value": "1536:IfQ9iK7zvSntuHjuP4O7dIrNxWGMMdgM8n08MjkEoVYPvs6rEJevIkspK:QAfHdbdgM80dKysreAksK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766053022, "uuid": "aa949675-f271-4e1d-88cb-b7a6162c8b9f", "value": 63692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766053022, "uuid": "ab9dfce1-f111-44fb-9885-e2300f4f3220", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766053022, "uuid": "39e735e1-d632-49de-8fde-39fa28dbc2a8", "value": "PO_P250GH, C22.8, ASME A105.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f97908-dc46-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766085477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085477, "uuid": "e92e49dc-172d-4a79-a0f5-e16d613e9b99", "comment": "Malware payload", "value": "083181897d6dad6d2b2fa7304b906c56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085477, "uuid": "fade071c-6c2f-4ba7-97d8-fd3dc5859f67", "comment": "Malware payload", "value": "facbd6f5a13edfa3fb1686f6716871cea8d0ad42f3e7bb0d07e9fcb0a92d0647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085477, "uuid": "d829e9fd-6463-4f8d-a318-555fc00c1da2", "comment": "Malware payload", "value": "74588e545b07f2a8aace84fcb7712020ff1ffcd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766085477, "uuid": "57af97ec-db55-4aea-bac6-1f6927b10d8b", "comment": "Malware payload", "value": "18b0605773fee7541f97fa482993069022dae1e490a39f201fdb819a96820593a89f269a0a4365a09c2621852b929ab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085477, "uuid": "9fd04d5f-6d25-48a7-a1d8-c34b46a9802d", "value": "T12DE6F51021D96607FD7ADFFD85DC77440F79B2E53723EA689B424EE90BD1B08C8429A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085477, "uuid": "76b195e7-4fa6-4af7-bef9-bddebe90878f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085477, "uuid": "a534fe96-9a94-4c5d-82f6-371e38141bf7", "value": "196608:/YogYvcemy+XuihCzAAYcvwq3+MoxF3xL:wFeJTzFol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766085477, "uuid": "d9c1a07c-d70b-4ce3-9222-2e7f8007ff4b", "value": 14476288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766085477, "uuid": "1360a1f4-7dc1-42a4-bd0b-5bc3f5d80425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766085477, "uuid": "aaa6b1e9-614e-4340-8d5b-3b65f7973212", "value": "SecuriteInfo.com.Trojan.InjectNET.96.10192.27392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2328ca-dbe0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766041687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041687, "uuid": "eb834a0e-25a4-453c-9df1-5af94bee3f13", "comment": "Malware payload (Mirai)", "value": "cde47cf09372dbc790716d26ee93db27", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041687, "uuid": "284ff3f3-a4cf-474d-89ed-c11da39cf297", "comment": "Malware payload (Mirai)", "value": "fcb913d610f4684dc6c4810c851384b01730cbe0985c7ec28b87dd5b45b92d6a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041687, "uuid": "6855747f-ba70-4c5f-9f68-c4c6bb4978ca", "comment": "Malware payload (Mirai)", "value": "4b29d8ba3dfd16fb39ab8b5fc883d3cfeb7b88b3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766041687, "uuid": "a3f3a80a-710c-4672-83a2-2a51325cd878", "comment": "Malware payload (Mirai)", "value": "0038963e6433c57526a68cf48de8c958172c8ee5897d9ca22ce0e4bcd1dff964823a3e1e9ccd48be7891c67be5d948d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041687, "uuid": "ba32e67a-d2d3-4abb-85cb-b92e0451cb26", "value": "T18311BC8ED0145E023448DEC5E4AF48F0521F8EF993AC5ED8668F7F2FB7A95007826A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041687, "uuid": "fb7db1ec-a2b9-458e-95a5-10bba2ef8a1e", "value": "24:yaKoCa3atNIPa3KFWatarma7a3aKaCOa8ah:ynoCQrCRKImSWFExO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766041687, "uuid": "1774b417-dda5-4f27-b579-743a85f4339c", "value": 1022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766041687, "uuid": "4791e7b7-dc9c-4203-acf1-ed4a4998fff6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766041687, "uuid": "57ab8493-a56d-478e-9e52-586bbd560e77", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5620fd2d-dc2a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766073484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766073484, "uuid": "afe58274-1945-4a4d-8bfb-395873601e45", "comment": "Malware payload", "value": "80efc723e4a4dd437191bfe11086011c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766073484, "uuid": "332c6d93-7a20-4ba5-baff-28612791e6a6", "comment": "Malware payload", "value": "fd0908d341a2784ad4bef7522e1cba635ed6c0397c5b67276b19ca972dea5b60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766073484, "uuid": "159caa94-46de-4ce9-a5fa-29800ead8d90", "comment": "Malware payload", "value": "359519a99fedeeb73e11503e43bde868c35e156b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766073484, "uuid": "6c8f3109-7d31-4258-b0b7-52bb938f3abe", "comment": "Malware payload", "value": "0bcf830f978faaa8ce2ddff65ae7eb27651a9fa446dccde9f48dce5f59b9ca016c04a7022bacc2cd0c0f7d1ef670cd3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766073484, "uuid": "dda993e4-cb15-41f2-bdbc-52586fef54fb", "value": "T17255E81BEA7941E5C5BEC03CC642652FFCB134A68334A7C766995A471B23BF4A93E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766073484, "uuid": "10486246-8aec-4cc7-b15c-9cf8af842519", "value": "5f13b7d64bb07f1975d408d21f9e39cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766073484, "uuid": "c098a264-a147-4441-9fc3-44dcb359c022", "value": "12288:92UpEebnSWbFMSH7YLQ0aFz2HtUOJ8h8isfFyf5h3NnajbUOZJ6o:92UpEebnSWb2o7YLRN9J6J7T34j/ZJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766073484, "uuid": "ad32b032-5ed2-4475-8bf7-e7092308ede5", "value": 1369088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766073484, "uuid": "58e9e882-4985-4b82-9fbc-0f3e51a95fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766073484, "uuid": "9eab2e2e-556f-431d-822d-b9701267eca7", "value": "fd0908d341a2784ad4bef7522e1cba635ed6c0397c5b67276b19ca972dea5b60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }