{ "Event": { "published": true, "date": "2026-06-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-24", "timestamp": 1782345782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "aeaa72ee-9ec8-48fd-aff1-b41090694ea5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbddc8c5-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322858, "uuid": "fe75e497-560e-4d25-a176-395848de70dc", "comment": "Malware payload", "value": "69300c7ada04bfc3cf7bf693a32f61b7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322858, "uuid": "45e2ed6d-de9d-47ab-a108-4df565a9b2ae", "comment": "Malware payload", "value": "01ffd5d2a96c9585ff3e1b7850b39f1304f1dcd0156f07b7d446854473bb6e8f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322858, "uuid": "f6256e5d-0d1d-48b0-98e5-1e451e7c7db0", "comment": "Malware payload", "value": "27cae34f6618979353a61e583d57a176ca9e2319", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322858, "uuid": "21f2c82e-1879-41db-928b-e773b7c6337b", "comment": "Malware payload", "value": "34b83c322593ce663d76720f50f9b3b7cd4ae0647cc004828598b5371196dc61e76bf7879b215b4c3b8974f56f21b0d8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322858, "uuid": "052967c2-c171-45e7-964a-f09cfa251ce5", "value": "T161C60143FB058A9AC0F783F24937176126270EB68B4397C76960797D3D736D06E8A98C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322858, "uuid": "a9ea3154-5c72-42a8-8926-e9483c05cf21", "value": "196608:CiNXNAJFgx4xf5G9198+5uHTgvOIdB4MK61HgCM3Rr8r26oG2trBGKInFlTHjsbE:VN9Ad158IHsvOIdwjCMhwr2Xjr0VlbYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322858, "uuid": "be8ac345-bf30-44a2-8754-825229bdfded", "value": 12280951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322858, "uuid": "f2379129-e884-4ac6-9af8-173e8a1c9fd6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322858, "uuid": "5d8a04e0-9f9e-47af-9d14-36a755b25d5d", "value": "watchdog.streamguard.shuffler.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43be4e17-7007-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782331192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331192, "uuid": "29a594ae-5eb9-4d2c-bc68-ac245bc03c3f", "comment": "Malware payload (Mirai)", "value": "c72135657e0355918cc2d3144204c0ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331192, "uuid": "c4a629b7-f2d0-4cd0-bf08-5fac6877515d", "comment": "Malware payload (Mirai)", "value": "042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331192, "uuid": "3c76a5b0-d3bf-42f4-9d75-4c638fdacb03", "comment": "Malware payload (Mirai)", "value": "73dadd2bf06ed596bee8696926399c0712067949", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331192, "uuid": "25540f82-cea0-476c-94ed-e9e8dd774251", "comment": "Malware payload (Mirai)", "value": "35b867bc9739bc64a3d84f9daceff0b3f67f0b3b22af4bef5e2664aec2c7d8db8d7bb3ba07a90129f2b91c89cfdc90d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782331192, "uuid": "3367006e-3a05-454a-bb83-f115dcf14f9c", "value": "T1D4E3185AB9519F12D5C321FAFB9F814933136FB8E3F93102DD206F60278A99B0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782331192, "uuid": "7a4b6177-2c8f-4ffc-a5cf-31bb036a6909", "value": "3072:KdqfO+OGhF+094Vnrykp7IPzauLhZ6tQC+KCUlEWU+oxFoAC2:KmjthF+0MOkKPzauLhZ6tQ1KCDW1+oAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782331192, "uuid": "22337697-5cd7-453e-a72c-e131cf42e13f", "value": 145252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782331192, "uuid": "76e3f19a-0f42-4788-ab4b-0c6f499d3060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782331192, "uuid": "cb100dfa-bb81-4ef0-a4d4-8924bad7b636", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6699d092-6ffb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782326097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326097, "uuid": "98942626-49f0-49dd-807d-bcf5ce2467b0", "comment": "Malware payload (Mirai)", "value": "b1e3138d66fa2672ec67412091c2b291", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326097, "uuid": "de6999dd-0f94-4416-8281-9a691d8a6073", "comment": "Malware payload (Mirai)", "value": "044f25e5c9eb287519556b0e7a67cdb4e94965dc0d39acd33d5fdcf2d428b612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326097, "uuid": "772377ce-00f0-47be-85f4-06677674c25f", "comment": "Malware payload (Mirai)", "value": "fcf68a2ac42e1508af5397a35093848383b423f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326097, "uuid": "b95d393d-4c8c-4081-9151-fb9930c7dc6e", "comment": "Malware payload (Mirai)", "value": "38774e847e46b6f6455ceb6dffcc9aa3b387727db8a64293212bfb397ac29d2b7e040c3fe308b260509eae06dc8a5819", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326097, "uuid": "5b647811-d309-4011-8f40-6e8a36db8b58", "value": "T15E737D0173180E53C5276A70683F2BC1C355EAA521B9DB456A0F7B4FC9B2D72C58AEEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326097, "uuid": "687ab4d5-14f6-49c9-bec5-a077ac1c4860", "value": "1536:l4un2nU/BV/J0JCs5Y9uH0e2J3fNdZKE0khMNo5uf6+qQ4/hIUK1cI:B9jKkma9X/hIF1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782326097, "uuid": "5c596cd3-f56b-4585-abb2-daa59ea71021", "value": 75556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782326097, "uuid": "8e69c332-c9f5-4ee3-9bb1-c25db9f615cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326097, "uuid": "1f5d82fc-7fae-427a-a004-2472342d25a9", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255d1368-7006-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782330712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330712, "uuid": "b3d2347a-9aaf-4060-88b4-d439ceea32c5", "comment": "Malware payload", "value": "133a5a93b5a00a4add88fd344ec023d4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330712, "uuid": "b0425eab-9ae5-4f9f-ba10-07d8cce39220", "comment": "Malware payload", "value": "04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330712, "uuid": "fe7a2ed7-a28c-4ec0-aabe-b398f7f8a044", "comment": "Malware payload", "value": "056231d3a34b95d81fdf45953bed23dfa2455344", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330712, "uuid": "d0c06255-7265-4246-9165-611cf7f00109", "comment": "Malware payload", "value": "d766818f323bd41a4198057c736d1446a2632ec09ab32422ba7b794f39115cc37a8d8e974c9fc2ae5d7b78d3d47f90e4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330712, "uuid": "efac93f1-136a-4393-b259-69fb9f216f01", "value": "T14EF0C247A497F036808038E4E76AF659FC21B8876262DE4CB940BF55DEE65347421184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330712, "uuid": "ce09383a-1998-4a58-88fc-724b48266700", "value": "12:Sy41c0PZ9tSjhh1OL9ephRjk4Y4bou7Co1VOq2xddNizdI/HXHQ:SyqPHtk1gYpTr8i3fOq2bf8IfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782330712, "uuid": "25dd6480-1409-43f8-9982-20455a1858ca", "value": 617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782330712, "uuid": "c9c80a70-34ff-4a67-b544-103850114632", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330712, "uuid": "b0525324-0d09-49d6-a55b-6c65ef38f52a", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c39933-6fc8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PhantomGate)", "timestamp": 1782304349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304349, "uuid": "1e752205-b3b7-4f51-908c-c6eb2a26fe4a", "comment": "Malware payload (PhantomGate)", "value": "484e99e010b9b1fd0d3da30c88627d53", "object_relation": "md5", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304349, "uuid": "f2125332-aeb6-4625-a73c-ad00557e90dd", "comment": "Malware payload (PhantomGate)", "value": "07618093cdd71ea23680fa50dbebd1b88ad7feb4ecfff70f49c44a1f0905f70e", "object_relation": "sha256", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304349, "uuid": "dc6b34ff-cf55-4ab0-b576-88e4b97fe18b", "comment": "Malware payload (PhantomGate)", "value": "aab15419329d22f4015ac68d31b8aa7db55a1e89", "object_relation": "sha1", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304349, "uuid": "2b79ff8e-5ceb-4ef1-b675-9828ac602b33", "comment": "Malware payload (PhantomGate)", "value": "f956c9e4f05f3a0b30bc7f0d7bffee2b84611393d956a335e1d0e32eae83b84b2426fffaa887ef11767ebc83286a6197", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304349, "uuid": "dc91039e-60af-4927-9589-5b7a28d79917", "value": "T16D82F623C908AFF4096D6292298B5C278A510352A674346EF88ED8DD3F3B320DFD49F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304349, "uuid": "c9568777-e502-454b-b210-e15ca32a9d1f", "value": "384:K/dHfTFtXlKwfVBYZqStE/hxQagDBFGB27A1:KlHf5NYwf/YZq/56rNFGD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782304349, "uuid": "fbc428a6-ec25-4063-afcb-a274a78c9131", "value": 19196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782304349, "uuid": "cc2331ad-d139-4b2c-a813-d058c44dbc86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304349, "uuid": "1e276276-418d-4fa6-8c07-b27df02007fa", "value": "Doc_Ref0000003_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f936cc-700e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782334281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334281, "uuid": "81802724-65c4-43fb-8685-161d3892141a", "comment": "Malware payload (Mirai)", "value": "ceea35adfe67b4361eaba0cd2b9a1246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334281, "uuid": "06d33213-1bf5-4418-a175-20d48edcb718", "comment": "Malware payload (Mirai)", "value": "07f1818fddf2e3fcde507aab8cded1356890eeabe10ea4b2941cc10df7e6e626", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334281, "uuid": "bf3b4356-7b2d-4bdd-bda9-9f3b725f7717", "comment": "Malware payload (Mirai)", "value": "09fe85f8a9daaf5ff97deb2965e9cf7a34662c14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334281, "uuid": "1b337035-0635-49b5-8041-aaae0fbea13a", "comment": "Malware payload (Mirai)", "value": "7676f41645249a6573d17eeea9016518747d68bb7e3907e0edb379bd932bff57250ee0b544e4f495655b1d61edb2969e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782334281, "uuid": "9dd200f6-6cd6-4de5-808b-1ee02a046596", "value": "T174E34B07FB418A53C4D22779BAEF9249332397A5D3D7330689189FF83F8369A0E66505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782334281, "uuid": "6c8dc778-7cda-42a9-90ff-8b2e465ead89", "value": "3072:rEJBrYirGaXhW/5bn5SD/sa/ZYPBH37/bM/9D66nPQL:YJBrYEGaXE/dn5SD/z/cBH3rbM/9DNYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782334281, "uuid": "d7b3c62d-fa9d-4f3f-a95d-4e5053a6a3ca", "value": 154901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782334281, "uuid": "ce229774-0273-4aaf-9924-44841e0e458c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782334281, "uuid": "a4ea5f74-2773-46df-b6bb-4353a04494cd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76639c7-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322877, "uuid": "143dd92f-cb82-4ac5-a663-eec96f055f44", "comment": "Malware payload", "value": "d314e18982e309cda297fbcf8226e40f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322877, "uuid": "8d22d790-f3b1-4fcd-b592-44996bc25420", "comment": "Malware payload", "value": "08f6c55dd50c9be03504c3c220728b9a141f711ff556191f2e35035caef7938d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322877, "uuid": "61c3bb10-8af0-4b39-9f62-e9bb5d6bcd7d", "comment": "Malware payload", "value": "e96cd5e41251682ed73f3653fa67912169624d50", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322877, "uuid": "d1f9bf67-6e28-4ea5-9fba-8963d1418b2e", "comment": "Malware payload", "value": "a4b8484bb4496fcd017eaeb1cc5efb9a8ba5d5bb0dd0dc307e622134d23bba45be8fc921f521c873425b15f26fe3b687", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322877, "uuid": "a1bcbfb9-5e17-40b3-ae21-a40ed903681c", "value": "T162C60147FB458A5AC0FB83F249371B5116270EA68B4397C76960397D3C736D06F8AA8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322877, "uuid": "b3e9146a-4d53-4950-8c18-56e37572bc89", "value": "196608:yWSPrNHv8e+T2sGBpjZ3RBKuZEFSjL8ehf+MDC0OY2b3R7BWyM3b:5qZoCsQptBBKQEQjL8eor072h7BWHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322877, "uuid": "735bfedf-849d-4927-b74f-a43dcb0ab698", "value": 12276579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322877, "uuid": "cdc2253d-64fc-4440-bf34-1888977d7f75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322877, "uuid": "7c63402f-b069-4538-96d5-03c277281b04", "value": "watcher.lords.upp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e120008a-6fc2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782301821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301821, "uuid": "cbcaee4b-e6b2-47d5-a3db-219e79d4039d", "comment": "Malware payload", "value": "61780d31e9bef02103a77f9a6a283b5c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301821, "uuid": "0029dacd-6c3e-4557-953e-0f58094e6cab", "comment": "Malware payload", "value": "0c0b11ee7dbb47097c677d5dac0c1030fd08b4bf9393fafb2e053af1ab4b8601", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301821, "uuid": "5a3cf98e-1e69-4ec3-bc8e-840ba3677afd", "comment": "Malware payload", "value": "74717281938cff26a94f865ade9d1b3ed8408dc9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301821, "uuid": "1cf7beec-fbcf-4430-852b-351f02ed77bf", "comment": "Malware payload", "value": "cffeb05c6bf36d5303cadd33c408bea1b49fce004f34904cde2dbafdc464f65fa2bb83719b402c234f3240635d639114", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301821, "uuid": "7768f418-4432-4ebd-b842-9a443ff185c6", "value": "T12F7390206DDB10D9F23B5BB157DCB9FB0AAAE8B4582DB1F431018A448771AD5CC72E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301821, "uuid": "bb26e136-cef2-4198-a918-f5fe72bbec71", "value": "768:sHqHGQs7o36Z963CtXWc+cz9TbxcMc+czpcdx6p8AocpcaDcBX1fCON3ONrXKNrb:MWzK9HRTQY66e7rKHj/nT/YNFfzTTut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782301821, "uuid": "835144bd-84c3-402a-ad29-4ea7814254e0", "value": 79109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782301821, "uuid": "d77fe2bb-5ccb-4af7-95bb-d2f9bd73cf2f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301821, "uuid": "6dc2ced6-3ff2-4722-9f46-d465262f8f0c", "value": "61780d31e9bef02103a77f9a6a283b5c.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78164dd-6fcf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782307442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307442, "uuid": "f63b4f23-0c12-4a98-9d29-4ea6489d47f2", "comment": "Malware payload (Formbook)", "value": "4293f53d73f2b4bea4c8ec3ce9871043", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307442, "uuid": "41a815e2-daa1-479b-8037-dd98ac819b0c", "comment": "Malware payload (Formbook)", "value": "0e44300f6f2d8f1d3907d25a8f99bd6236c540a5a65c5cf7af0d40c68f2d7387", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307442, "uuid": "b2e92a24-2481-47df-a049-10a7e9626320", "comment": "Malware payload (Formbook)", "value": "7d14cf64fc9e6ac4ed23de56ed89a6329875304d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307442, "uuid": "548b92ff-e148-4bd2-aeb4-32fa86638b46", "comment": "Malware payload (Formbook)", "value": "2bccb7c71a68cb0bb2f1f3e47cef3b068fb517b770949ddb123ca8133bb20002f2e7621f4b02f8635790f7d29652fe59", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307442, "uuid": "bdc36156-bfd1-4e79-b732-57b537c519d8", "value": "T145C572223EF2EAFFB524D2B2712068153F31FED9C5A87BED1B999994C8110B0C1D1997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307442, "uuid": "d17adf41-7b39-4269-8c72-eb62c0798fe2", "value": "6144:wRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNH:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782307442, "uuid": "d6e75c88-ed57-4684-99c7-cd7eda6b5532", "value": 2616249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782307442, "uuid": "43a99186-c1d1-4924-8147-29b70cb541a9", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307442, "uuid": "2c58f50f-c511-4bd1-b0b1-e73b602e2481", "value": "ProformaInvoice-5628.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744192cd-700e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782334280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334280, "uuid": "7280e189-32f5-40a0-aaa1-c8bc0f5d912d", "comment": "Malware payload (Mirai)", "value": "db9af0b0980155373edbdc1e7d2af87e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334280, "uuid": "1f1d7fdf-6baf-4716-ad6c-073453212777", "comment": "Malware payload (Mirai)", "value": "0e838c6a588d00c029ea5e469e55e121688df7a6e8af7b75e53504dc81631cb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334280, "uuid": "318b64a6-e0bf-4381-8432-7b9cb27be0ca", "comment": "Malware payload (Mirai)", "value": "f2ae2427e5b20d785a96f50bfe7f8a313a5b3bb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334280, "uuid": "493221fc-613f-455b-bc10-39077bede89c", "comment": "Malware payload (Mirai)", "value": "ec1530d41e6974635026afdbefee2b4d833900ea4f5a4836e3f93f9d12ad35caf6291f9575442d6eb49ff9a3d5507380", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782334280, "uuid": "03b712d4-27c2-44ac-8588-59ec26ae31ee", "value": "T18CB3E81ABF610EF7D86BCD3702A91B0534CC554B22A97B35B630C92CF54A24B59E3DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782334280, "uuid": "324d4c46-bd93-4115-af96-c14a7211e658", "value": "1536:t4zLwBdoO+LueQe4uyrdZEOegOG+l2A97vj9m0BCImg:qzLwBGOl5d0MA9779my", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782334280, "uuid": "12811036-798e-43b3-af0d-7abe94c12b55", "value": 113760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782334280, "uuid": "ea2d5f9a-8a3a-4b28-b892-0fdc054d0e55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782334280, "uuid": "5b4c697c-d153-45e4-a3f4-d5f8f089da72", "value": "ml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad2144c-6fce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782306938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306938, "uuid": "e088d528-c35d-4eb7-9446-d0fb9fd74300", "comment": "Malware payload (SilentNet)", "value": "ec28bf775dd0bb25e33e6de07e14a862", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306938, "uuid": "f9b6df77-e3f2-465a-9340-1e940cad7876", "comment": "Malware payload (SilentNet)", "value": "0f7e2b12775b824273cf1f7168a47c35c09f4696b299ff29aaf3f5a1079b5a9f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306938, "uuid": "fd756e5d-b9b1-41b6-9762-0fccb403cf8d", "comment": "Malware payload (SilentNet)", "value": "ba87297e1958aa4fc6c421f80896ac6549343b3e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306938, "uuid": "6e8be3c5-df63-4d83-8a2b-9535b403251e", "comment": "Malware payload (SilentNet)", "value": "8d8c4f91870bee6010f27624e2d917825b8579810e3fd360c0439c96b5a1f1d17825cac2971c7b657e2af534ecc58caf", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306938, "uuid": "8e7f8662-d128-474f-9661-42a3ad4a6f84", "value": "T165D412139A6CD0F0D7176335C48B8A51BA0F0A907947B43B6ABD19EF1D8E5BA4F0970E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306938, "uuid": "1f5e8c2c-f01a-44fa-83dd-223f8e815b12", "value": "12288:j1ZGVeY4pGikV91VfN8eVyiFMVs0QvJg+OM7kI/e5bepdE:jXGVeY6YfBVXFf0QvJg+O8NiCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306938, "uuid": "f18778cf-701a-48d4-ab10-51a87c5a119d", "value": 656375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306938, "uuid": "968bcb9e-c777-4b7c-9f52-25c3dae3970c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306938, "uuid": "756f8dc2-6d6f-4159-a202-111ce274bf7b", "value": "AstralClient-.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d3fc2a-6f99-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782284062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782284062, "uuid": "c4eb612b-1576-41c3-82c8-fb898044c535", "comment": "Malware payload (RemcosRAT)", "value": "84e3a2dcf5b37371bc5436633e74590c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782284062, "uuid": "2413714d-c09b-4ca3-ac4c-448a0907997f", "comment": "Malware payload (RemcosRAT)", "value": "11c56272015bf9670764d6c3b41b2f8a2a021f85b3a878d7a954c5a5c3b9efe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782284062, "uuid": "2c6d1372-ab8d-4c44-855b-26c444f0c92c", "comment": "Malware payload (RemcosRAT)", "value": "ad82a14e7acf544e769eeb7699a616d79e14e12d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782284062, "uuid": "f5be0217-85e9-4245-88a9-2af2fdd13c13", "comment": "Malware payload (RemcosRAT)", "value": "f4fe8492400898c88416e095bf172f881e99f23fef8f5b24832902b24696df492645c221ef16631b08688adb7210b2d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782284062, "uuid": "1b940312-00f7-472c-80f1-4d6b64df9241", "value": "T1D4551254324DE502E98D57B948B4E2F81B745E58A901D307DFEDEEFBB572B12AC08382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782284062, "uuid": "188673da-a5ba-4f4b-bd6a-403301ac0754", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782284062, "uuid": "00017e0e-d4a7-4c89-b5b9-088ac04d145c", "value": "24576:eGF3hytuZvWDhi7eZ8cKUjNuxiyFsYhK9J+z9VxDpc+LX:e1utATFbjNE5PhK3I7lpc+LX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782284062, "uuid": "2e4c5a0d-afde-4d5d-b3c6-1faf304de7ed", "value": 1385472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782284062, "uuid": "49e54a56-422d-4de9-a8d3-e21abcaca062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782284062, "uuid": "b38ac445-7c27-4e26-ba69-7950acc35490", "value": "\u921e\u6797\u5831\u95dc Invoice JL-260603 & \u921e\u6797\u5831\u95dc Packing List JL-260603.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8e1c10-6f7e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1782272635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272635, "uuid": "2638b597-078c-4306-aead-da1d2fdf0a95", "comment": "Malware payload (Joker)", "value": "35f7de6e75bc3b7b9bbebe5ed68a203d", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272635, "uuid": "fa46597e-2170-4948-9ef5-fe328d86f665", "comment": "Malware payload (Joker)", "value": "131d73baac6511df4290684e7a935aa72627ec459b07b2c2fcbb3eda06e48b5b", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272635, "uuid": "6c6ec6fe-fbe6-40b5-8a7f-98c5e4848c65", "comment": "Malware payload (Joker)", "value": "ea6d1a9b5c53f4477a6d50747d6075b7647f2a62", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272635, "uuid": "2615050c-c114-4e32-b436-fa383fb11e92", "comment": "Malware payload (Joker)", "value": "f99f0a2aecc79625c9e7570c4d25a23930d97ac2327a92249ae8d859298a3abddde6342b5679b63163826f6c422988a9", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272635, "uuid": "de1cfae6-527f-4abf-b9a0-791678bcaf38", "value": "T10AF7E00C872CAB36FDDA647D5D656ADEF13D64704272C096D829E804F78E5E883B2783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272635, "uuid": "929ffab5-17b0-4316-9e9c-2c3785d18b2a", "value": "786432:0BkQUwSA2goIxKY02Am7dDaOcoLlyUj6adXsjvbt6Q8QRMKUK+4/i2510ZKpZ:MkJxS1KgBtZcAEOdXsL2QRHN+GDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782272635, "uuid": "e44d205a-ea88-42eb-bdd4-b3887954b99d", "value": 72390422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782272635, "uuid": "d675f211-18c1-4889-9c1f-53a9f0346fc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272635, "uuid": "a5fd80f0-c88a-48ee-98d7-14c1f8e904d1", "value": "com.hdwall.coolwall.background_3.7.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7440d8e1-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322684, "uuid": "4699b124-9d1c-45c9-adb0-1508499fe4d8", "comment": "Malware payload", "value": "8833824ba0a0417fc5e1014363154cbf", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322684, "uuid": "8ce3c8e4-a5f8-44da-ba52-3cb92d6c093b", "comment": "Malware payload", "value": "1353050f3ca901d67d1957feaeef6e9425e33d92f343ef69e36f66e4116b7563", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322684, "uuid": "bf5164b9-6b86-4429-bfef-6a4f3669ccc1", "comment": "Malware payload", "value": "9431f06bb6573a3d22245242ff2a6d16eb2f7e0a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322684, "uuid": "5dd3ee85-4a5d-4295-8262-f159d601fffd", "comment": "Malware payload", "value": "a35ee366b4b352eb4b8cb8af22e37b2d76d5ef4208068af6ea74b808c3e560ac169ff539c50dc20a05c6719447288c4e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322684, "uuid": "71a6dac1-0f92-482d-a3fd-0fa57a1b7cb0", "value": "T119E62352BB821628E8F387324A76239123364DB38B5367477EB23D7CBC737E09691954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322684, "uuid": "4865f4ec-3c50-4587-bd21-385dfbf2fa7c", "value": "393216:eWPc91W+Gxj1YHdkbVTbxeCAphiTdI75MCEVrhDkr1:eOuGfYHdsRImI7aJrK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322684, "uuid": "b4c26766-e745-4038-a2ed-4ee1e750d20f", "value": 14394126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322684, "uuid": "fac9954c-c974-4b88-8d09-1ffa9855e8b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322684, "uuid": "2c05090f-fd81-4622-bd85-d372c3d6f342", "value": "decoder.detector.service.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1c78d5-6fcb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782305519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305519, "uuid": "5cc499c7-6435-406d-9ce2-53111f13d92d", "comment": "Malware payload (Mirai)", "value": "e6ba9070db21c7d9efc673c01e28adf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305519, "uuid": "80d0dbdf-fae2-4c07-b216-b6dfba16f91f", "comment": "Malware payload (Mirai)", "value": "13b7ca871f8ccdadcd5664f7434de18ea36bbff93a551f1061e215bbf7104947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305519, "uuid": "c0ff9439-343e-4d8a-9da1-d68616f46d87", "comment": "Malware payload (Mirai)", "value": "0706983caea00c2063d86bc7781dc16147fa016b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305519, "uuid": "41b860a0-bab9-4a2c-94e1-1d9d6df409d9", "comment": "Malware payload (Mirai)", "value": "143daccbaf6b59a1c4b7807fbd6b6ac5dc65033353abfdcc435ff359d8f43be9f6079785f502c6586c829c7070f7208b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305519, "uuid": "d9934fa0-789b-4a0c-9bfe-1990ee51975e", "value": "T17F945A52F1A228FCD952C931825E6123E63874594322ADFB27C8EF753D16AD06F3EB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305519, "uuid": "2bfbb40d-6dbb-4760-bdc8-08fb0619028f", "value": "12288:2cRc/IklhdD0xINttedt7jAcuHii1nLOdmdwUJh:/HUgxI1QfAc8ii1duUJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782305519, "uuid": "30598ef7-a4ce-4c95-8713-e6eabf175025", "value": 420096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782305519, "uuid": "edf95332-59a6-42c5-bf66-53d9d036391b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305519, "uuid": "56e32bdb-234a-4e7c-ba61-378f13207799", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5975b07c-6ff7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782324357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324357, "uuid": "272180df-b11a-4d27-a44c-410c16de1fc0", "comment": "Malware payload (Mirai)", "value": "2052759947415b997a2dd310935006f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324357, "uuid": "d080889b-c8b0-461b-bb17-64659e49b822", "comment": "Malware payload (Mirai)", "value": "13f7ccac229f5aeada38ace5adcc4dd048b69abc7243509be408e7f7eb5587c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324357, "uuid": "1d905e4a-fa2b-4296-b98c-5e1dda765541", "comment": "Malware payload (Mirai)", "value": "a130e975153a840f792c41abef5264fe9cdc0b42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324357, "uuid": "e94ad6b8-e9ae-4e49-85a8-c76fcbf0780b", "comment": "Malware payload (Mirai)", "value": "91221183b022732d21b8ae2a4de778d1df030ab19fef704eac8357eab97793ac16f81c8dc5639ff40dbcbfcf9c902cdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324357, "uuid": "5e697c9d-2a5c-4c99-a150-dc994681e0d1", "value": "T18B537C84BB83D8B6FD8701B6657BA7624336D43D1019DB46D32EA83ADC63910D71B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324357, "uuid": "e9321fc9-cab9-49f0-82b0-5275d734683d", "value": "768:q+J2PJvxISh/HukqslcTqPZvgCvmk8PbAXk8lFh4fT55SeohA6w3zJI0J:MPJ+SVHAsiOZ8cXRLQl5StUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782324357, "uuid": "4d423dd8-c64a-4fba-8a56-61d13ceba099", "value": 63400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782324357, "uuid": "133225c9-2a32-45bb-8e9d-43dcac0938fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324357, "uuid": "ac17403c-3a21-4fc6-b271-0abffcc7e89f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51989673-6f67-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782262496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262496, "uuid": "5619e6f1-031c-4195-832c-3c795aa1f2f4", "comment": "Malware payload", "value": "fc2ffbeba8ef2ce253b406725a2c945e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262496, "uuid": "7f92b46f-9982-4e0d-aa8e-3619f4a716c4", "comment": "Malware payload", "value": "14c28a21dc6c756cbf84a5e250b590f9b12883293c66b1298c27e633f270421b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262496, "uuid": "e264374a-9f58-4a72-8e41-7ecac6b9da60", "comment": "Malware payload", "value": "0be6583653621fcf0e6cb60af7ca02b288eaf62a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262496, "uuid": "d1d357a3-5407-4fd7-bdc8-7c857e109a10", "comment": "Malware payload", "value": "3e12b8f190f3fec756734a6c0f30946a1fe6e31d06b743fb5e9dee1b271b5ad766bb7fd13fc41b3fe4314ca56c666efd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262496, "uuid": "969efcbd-b978-4ff4-8fc0-4dc16d61a851", "value": "T1C4138D6966857C24AE9988371C7E2F0CB9A983E1310451EDBFCB3CF58C19ADCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262496, "uuid": "c96913a6-5832-4b20-b64a-d919f7e1a4db", "value": "768:uE+q9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:b+/co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782262496, "uuid": "4a1dc996-9ea2-42eb-a982-adbb29e2fc4f", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782262496, "uuid": "53759cc4-c051-4327-8349-53e6573a9132", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262496, "uuid": "17d0efaf-86f0-46a8-941a-2dc98e3df4ae", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edf2117-6f7d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782272021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272021, "uuid": "6eeb3df4-59ea-4f31-bb63-a513364608a1", "comment": "Malware payload (ValleyRAT)", "value": "bcadcac14962ec276a96c5d172158e4e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272021, "uuid": "01b24d0e-e892-4ada-a712-b9b4dd6ed034", "comment": "Malware payload (ValleyRAT)", "value": "1516ab566efef411a809b5220ef748c79ee0199e2340b3576168204b59443bae", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272021, "uuid": "0a174293-e9da-4cd4-8fb4-380c01d4ca45", "comment": "Malware payload (ValleyRAT)", "value": "ebb64f7657d820fc2fd85f55e10565ad3e646cf1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272021, "uuid": "3714ed7c-c0ff-4fbc-aa38-8fa901222e99", "comment": "Malware payload (ValleyRAT)", "value": "fca6a15a7718943d3155af08a5f651a7857aac2b4932e7e74d9b53ebc02abcd2370a2f167d6a7a84e25da7347731bed5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272021, "uuid": "0094794e-a5d8-47a4-8984-1f0a3b5e9850", "value": "T13866335679C75A34C04ECB71511A717E712D3FE2CE748D2263E8371C6E3292CA9BA362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272021, "uuid": "13713d92-d7d3-47e2-b7b3-3567b2975736", "value": "196608:ECHwLtZ++7CBWgyVo5wYCtj39iWtw9FkO4ByadB:ECHP4+5MtbcWt0P43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782272021, "uuid": "7ecb0eb8-dc55-4229-8857-6f9391f60f52", "value": 6696960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782272021, "uuid": "600c1504-11ba-481c-b4bd-877f2b8e3856", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272021, "uuid": "cbe6c7c4-c2fb-4f41-bffa-7df4e4828c0b", "value": "a-software85659001.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf20bfd7-6f6a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782263995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782263995, "uuid": "b4105e93-7685-4563-8642-7254b44c2448", "comment": "Malware payload (Mirai)", "value": "4299d55019ea2f9418df9c46631effbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782263995, "uuid": "0abcca61-9a47-4c5e-acf7-fec25b877ecd", "comment": "Malware payload (Mirai)", "value": "16c0a0857c5fdb37fa92edc3ab802e6581875bdd24cb1a29b2004a9f67b79b38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782263995, "uuid": "a5a2dc62-2f86-4440-8d81-0d322955e193", "comment": "Malware payload (Mirai)", "value": "a1a2cb10e81207bb29dbaa1b7d71fc0503670587", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782263995, "uuid": "ef320d69-8ff7-4893-b454-c7149fe99f21", "comment": "Malware payload (Mirai)", "value": "ef5b79859a1f564749de91c023c3446d4c5c81ee81a79a247861982d0a3db39a5cffc03b71a157b8f9278c1c5e4cdec3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782263995, "uuid": "f5b25027-8cc3-4af4-b09a-20428c4dc5b5", "value": "T12634C51F6E228F6EF269C73447F78D35976C23D622E1D685D2ACC2105E6038E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782263995, "uuid": "ffe60a03-3223-4c3c-9ff1-c78c043d4ec5", "value": "3072:KKIjEWQezL9UzvcICyDTAUCBdP6BNYEB5T+aApoawco0:KKIY9OL9UDc1TCBz5bApf40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782263995, "uuid": "3ad8b8b3-83c7-4c71-aa76-f62e88754b58", "value": 241476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782263995, "uuid": "6a9d64fb-5ea5-42d9-b0f9-b01eb98365c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782263995, "uuid": "b3b25478-bc61-458a-9174-c84e6c18d3ba", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8235fced-6fde-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782313688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313688, "uuid": "b3f24145-8e3c-46e7-ac31-938dedecb3fc", "comment": "Malware payload (RemusStealer)", "value": "96cf80505a1d0487d44813b3992cf5ad", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313688, "uuid": "a3e9237b-f9ea-4d86-be4f-fcd676aa4146", "comment": "Malware payload (RemusStealer)", "value": "171ff07d334a93105add23e6993e7efdf04010b42a31acae8d254472b1a2f6e5", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313688, "uuid": "faba47ad-ee99-4525-8ed8-f7389794424a", "comment": "Malware payload (RemusStealer)", "value": "ddb6dd4cb8d515d326f804eaa61d9520154675f9", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313688, "uuid": "0c11204c-1584-41bd-9f8f-45e139da9636", "comment": "Malware payload (RemusStealer)", "value": "52d3d086df9d333011b054e645d938e6b27f44e1f2d8dc8901e423c67efd3ca17efc20f534956f7c216c2a8c216fce75", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313688, "uuid": "4d400887-aea5-46ce-8354-a990bc3acb4e", "value": "T17EB56C07BCD009EAD4AAA33289B662927B70BC050F3167D32E90B7782F767D19D76744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313688, "uuid": "9ff7ead0-7ed1-4267-9270-a6772eaeffbc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313688, "uuid": "fcace06c-2bba-46c9-a1c5-1ccc0cdfe1b1", "value": "24576:G6wqehwN19u63ezqQG10RB8ZXbmQI2isaU0MldJBeletr92xMNg1rB+5U+LNcbqR:G6wqgwb9teOQW0PuXPDxReH+cbqyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782313688, "uuid": "5958aa60-7b45-4ea0-ac05-ef909f6b26b9", "value": 2278400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782313688, "uuid": "e6550919-b0bc-4431-83a3-0b044aeab424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313688, "uuid": "a462cb42-290e-4b56-bfcf-3629e7ba4904", "value": "RStartecqX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12100c13-7006-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782330680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330680, "uuid": "d0d93518-c28a-4a0d-b01f-64da04ce0b86", "comment": "Malware payload", "value": "00b984f712d36a8761adeb4ac5cc7d48", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330680, "uuid": "09270202-df35-4b58-a3ca-77a6fb7c20c2", "comment": "Malware payload", "value": "1737369bee038e31b39e2cb66b9dd18ecbec92a7be1324adc16060682141f2fd", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330680, "uuid": "123e41b8-d968-428b-9a40-fea087f404e8", "comment": "Malware payload", "value": "09d2c4bd431a4e5c9087b1926123b9ad03911d73", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330680, "uuid": "f8a477c8-fce8-45fa-a953-13e71b071512", "comment": "Malware payload", "value": "4f8e2770f2a0ef22efafe7614f60c0ee4680b0b0911f3eb3e79e0d68e95d7dfe727cd8d58894db893b7aeeb8921cf5b2", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330680, "uuid": "e7d0dbfe-610b-4471-8e6d-d731cf9afd38", "value": "T1D885231033FA90A0F0B54B799CF3415B2A717EA31A35A1DF239866AE1F335C1E936761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330680, "uuid": "11547652-a0f7-4718-ab83-3dc18368683d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330680, "uuid": "88894558-f160-414d-800e-9a4c66343297", "value": "49152:lHtF7b5usfJVCCEmPoYCa5rlRaj6q40I07E3tt+TeJH:179uCVfEKp/ajp7ittr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782330680, "uuid": "027394e7-5d48-47d3-84ef-7066b424a811", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782330680, "uuid": "fbec3b22-31ac-4773-8905-f8016a46799d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330680, "uuid": "44e51a89-2a0e-44c1-a696-cbb07ea23795", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83c714b-6f96-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782282908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282908, "uuid": "0c594585-993f-4714-bb97-40fce613c503", "comment": "Malware payload (NanoCore)", "value": "2a5a906be1184d34d8f342d33a27966f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282908, "uuid": "8a2e926a-bbac-4766-96b1-0fcb8186f7b2", "comment": "Malware payload (NanoCore)", "value": "1b0929f74cbccc7bc9a4aca3f67bf0341dd05c4c15f70ed52a959e0d57c07e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282908, "uuid": "9533baf0-4289-4060-8558-073507bc75ab", "comment": "Malware payload (NanoCore)", "value": "d759051416659c4935ba9a16d969f8ab927e3530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282908, "uuid": "1c96fe82-4888-4380-a9c7-0b0bfc367bbf", "comment": "Malware payload (NanoCore)", "value": "c6d630569f65ebf049f80151bfe8ea07674f34509e0b511890858c7623a283f8522a4ccd4530302767dcf826d8f348d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282908, "uuid": "a89dc7b5-8e93-4fc7-81c1-5e384bd15030", "value": "T16014CF6537E4492FE3DE8678701242028379C2E398D3F3EE28D461B69F667E44A471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282908, "uuid": "aaba0ef4-9929-4b06-bcbc-d2d4f4b67ecd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282908, "uuid": "8b0f4cf9-4970-478a-bdb8-ca5faba0a327", "value": "6144:MLV6Bta6dtJmakIM556fA+eXcTTacsRy3Cj+o:MLV6BtpmkAuA+eXsaDCU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782282908, "uuid": "dcc96fc0-9257-4860-91ce-2261b76a365c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782282908, "uuid": "d2b5dbe5-d23c-40a8-8728-c3f47c93830d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282908, "uuid": "7513aaab-e90b-4af6-b187-63236d959911", "value": "u888phz.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd2cd6d-6fce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782306946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306946, "uuid": "0aa8dba2-523c-4192-aba8-c8f4e024f02a", "comment": "Malware payload (SilentNet)", "value": "e41486ce2ab66657248145e9bc0a5539", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306946, "uuid": "7e8c3a49-1ae6-4f61-85ed-5fe8b195044a", "comment": "Malware payload (SilentNet)", "value": "1b18889b0424d921c8efd86de37d5f71d78259332a3f9a1c35132fb19754522a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306946, "uuid": "ee33448c-986d-4820-aa0f-006740bd35ec", "comment": "Malware payload (SilentNet)", "value": "3c9b8068eec5e37aa694100caf1c236bf9aa94de", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306946, "uuid": "069113a5-952a-42a0-a18f-ec976b331abc", "comment": "Malware payload (SilentNet)", "value": "95893e760eaf89cc7220425758f29865e9448b5bc2d5c933d9d6eb626d40b6ba0b52527ee4b70b1246cc67427937ba01", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306946, "uuid": "4378bc58-84e7-4957-8d20-233a54b9dd68", "value": "T168C412B29AA49470E817B6F894205F65B41C12CCE40B78275AF1E88B0D858BF1F9779F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306946, "uuid": "ab10c746-f6b2-40de-ba1e-7e2f2bac5592", "value": "12288:PQfuvWKDm072vP3gI4lI226o/WS7Ttl/wjvmc25BcohSuriLKoOc+R7D9kxulqzy:42eKa0ePXH2mWS2mckBc9zLg7DEulx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306946, "uuid": "8c63ff71-9f64-471b-8f34-29d365c553d4", "value": 555438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306946, "uuid": "b9a2c880-6108-4dd4-a111-3821a2f1642c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306946, "uuid": "f6d7f89f-309b-4575-91df-f283fd02d90d", "value": "Thorium.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148e0efb-6fa9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782290741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782290741, "uuid": "816f13b4-5d17-4808-8d26-54fdc104ac9b", "comment": "Malware payload (PureLogsStealer)", "value": "03e51d96e71a86501b9e28d41bde7ed5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782290741, "uuid": "65598a47-daaf-44ab-a841-8858c02666f5", "comment": "Malware payload (PureLogsStealer)", "value": "1c4a7c2235c522107a2934f5fcc0d9dea43dd9343c3864d73c456a00116c0fe6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782290741, "uuid": "0a8ec5fe-bae8-4d91-90ab-58d030108ae2", "comment": "Malware payload (PureLogsStealer)", "value": "f09c3ab40eeb096642bc10311c056126e9a7efa6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782290741, "uuid": "6fc45966-639b-4e3d-bd22-5d83e82f4680", "comment": "Malware payload (PureLogsStealer)", "value": "ed8bd330331b4c809d92ac6c12e9fa4890f0eb73392d4b2d9836667735cfa7adad97b863586d07751a3429df02f16a2d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782290741, "uuid": "56d8a8d3-cffa-41f1-bd4c-81e72b49273d", "value": "T18175BF68CCFF406852B396E9CB85CBEFA86FB933531EB04154524756805F084ABC7E7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782290741, "uuid": "986fcbf7-31e8-4856-afeb-1eb0debe2370", "value": "3072:CMRHIGf/MJ7Nk0nwpoL0LWDnBlXInQASizvPlDweNHWp/SQOMgctBPMM4+ro2OE1:aN8o1FatO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782290741, "uuid": "5518b616-0eac-4e0c-bde5-f9116440de8f", "value": 1551162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782290741, "uuid": "409973c7-26f6-4dc7-8969-0701edf159ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782290741, "uuid": "57651b93-77b9-4641-95bd-d10022c05636", "value": "Enquiry_RFQ_M&R_TRADING_20260624.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085f5f83-7005-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782330234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330234, "uuid": "db18a10d-4f03-495f-821e-4d6758188c2e", "comment": "Malware payload", "value": "2896e7e266794b33d83c1ca454bedd83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330234, "uuid": "f21adad6-e764-45db-a81b-a491f219a842", "comment": "Malware payload", "value": "1ca3b901935fead67478eae99eaf7061c871fc0fcea3403086a0c5cc154c1f3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330234, "uuid": "e41abc05-e7c7-4482-90f2-ad15b9d793ef", "comment": "Malware payload", "value": "c4af1b575649dd4c20b17d406a3f05d1114817f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330234, "uuid": "6f9792c9-20c3-4adf-9c70-c51d4a5dedb6", "comment": "Malware payload", "value": "1acb630ad3ce29ec3e117ba941603908dd05ca9c36571baa679d5a00465b96ec8c61725414651ea6fef129de853b4cf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330234, "uuid": "aa2f346c-8bdf-4d43-8c02-ef28d38e8f8c", "value": "T1B1A3C4097F710EF7D8ABCD3755F84702219C9A0622A97BB67C74D518FB4B54B0AE3828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330234, "uuid": "6bdf5896-a2df-40b6-9450-f5654a4f233a", "value": "1536:XEM/I9v9OFg5DSQpd02/6J5I6lbpmFoH+pzxog64NnZAF5x1d:XxItUqWQT02YbpmOfgRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782330234, "uuid": "48876b00-6bff-47fd-9b7d-a7eb2a1e974a", "value": 105200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782330234, "uuid": "4fc90be1-4cd4-4f10-b6b5-be2addcf9cd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330234, "uuid": "e00aa35f-4eb7-4f3c-a339-f2760e59efd5", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4a1131-6ff8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782324739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324739, "uuid": "c1c6e860-9913-4fc9-8112-eb3899f48677", "comment": "Malware payload", "value": "aeee39349eea3c3e68be7a2acf882952", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SLocker", "colour": "#7533E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324739, "uuid": "a2639b5a-3578-4e16-bde9-4a08164344ce", "comment": "Malware payload", "value": "1cdb114f0cc895f1f6ce5d5b5321a0c1783cffda1019d88bd599a82a6b3a6241", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SLocker", "colour": "#7533E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324739, "uuid": "18c4a4ac-5c0e-445c-84bd-f9eaf648682c", "comment": "Malware payload", "value": "0cdb9708e76bef7c69748ed1f000df201b498fea", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SLocker", "colour": "#7533E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324739, "uuid": "84fb9268-2a29-4af0-a567-eef390086631", "comment": "Malware payload", "value": "4687b359353805bc006b0ba56439a3f5e1bf460e8f05f46a1582dbbc378dd1753160151f840afa66f6f1cdbbad06bc81", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SLocker", "colour": "#7533E2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324739, "uuid": "5fa7eb6e-944c-45fd-9f38-5728b4f47fc0", "value": "T166A7330D7DD33D62D69864BB3FFA98147D385248919B8B13CB0589D9E4F0FDB7A01A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324739, "uuid": "3afa5842-3ae1-4bba-9e71-1abc843f74cb", "value": "786432:qpYKAPvCfxM3Dvk0HE5RpYKAPvCfxM3Dvk0HE5ZpYKAPvCfxM3Dvk0HE5V:q4PvCEDcC44PvCEDcCi4PvCEDcC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782324739, "uuid": "a4f94e82-49c2-4418-857e-06bf1c7964bd", "value": 45761705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782324739, "uuid": "bc5d2f54-abbd-40ee-8dd6-5bef3aa48bdb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324739, "uuid": "f4024e06-5908-4aaa-a6e8-2c73025971fb", "value": "InjStandoff.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2800e4-6fca-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782305091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305091, "uuid": "9e98ea7d-f2b7-40bb-981e-4e6aac462b9a", "comment": "Malware payload", "value": "0dec1aa311ed89b48049e624d1b3419e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305091, "uuid": "0f77b1ec-747d-4e02-8e64-30f4577f2768", "comment": "Malware payload", "value": "1d97caba750a7cc60dcd39e23b78d147970c6286296d6c14a3ad1e519653a849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305091, "uuid": "dc921ecc-569b-4a1c-9563-9da8de941a96", "comment": "Malware payload", "value": "a680b8cd6239e92e1ad1d3079eb9df5c30f3531d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305091, "uuid": "9a445b72-6e85-46e2-b601-16ed828cb090", "comment": "Malware payload", "value": "4f7f981c698c4d0d4d284739ee0dbe64eadc12bd2fde32039d0d5536cf3b5fe4eb9eef932645850d694859ef7867b533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305091, "uuid": "40681b45-a00d-4086-89b8-a3e887e14789", "value": "T109566D42EB820A17EB03FAFFD46D95EAD3D7ED51D252406B18A88E93B9B21C4045DF0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305091, "uuid": "fdab1d7a-eb21-49c1-a126-6049a75649be", "value": "d9cdd14f1e51bf231e8fd705275c2c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305091, "uuid": "4e7d91ab-0055-44c7-927a-7a9adcebe336", "value": "24576:BDTx2nwIEyQ83eu/zjfXbYmlJtVc4+bT3JnWxYN86kQsjSGT+MuIlcm5PvdU:F1jyQWbjnGHZnm5QkNXlc6n2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782305091, "uuid": "be4fa4d2-c241-4768-beb7-7bfb99d4c819", "value": 5945160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782305091, "uuid": "1e0ce7f4-c7d2-482d-9132-3f76040b97bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305091, "uuid": "999a3a75-8ce3-48c2-9611-456e6ad1970a", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fe9d47-6fde-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782313540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313540, "uuid": "4e19763b-24b0-4998-b5a8-cb0b548c827b", "comment": "Malware payload", "value": "4dc4679383d81ac7073a8cffd3b7fecb", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313540, "uuid": "c451666e-5d9d-43e6-b635-222cf12c1d84", "comment": "Malware payload", "value": "1eb89fbbdeaca143288cd71e73304fedf5abbeb093bfe64bce48ccb4e5158be9", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313540, "uuid": "ab67aa9c-6a96-4213-82c6-d78a1ddb8ef2", "comment": "Malware payload", "value": "896f0928907c8f0bdf292431b4c2dd1b13cdfffe", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313540, "uuid": "e76c9658-c1ef-42d1-87b7-5ca856a7baa1", "comment": "Malware payload", "value": "0c8884f0f51c801f4de884fc08882ac369885ea45dffcb9a749375b59f3d3fc4419b12fcc279ae62802b360caa78210e", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313540, "uuid": "bad0732f-381a-4e70-bee2-7af660be3e47", "value": "T19914DDE6AF0A0F7513F5D8A752E881918E9188E4FE7E8706F4CFC851584C895F2936CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313540, "uuid": "47f835ab-d9ac-48c3-ab5f-c77d27108e9a", "value": "1536:KfLj8DX3C18c4nrNwRzw87GxPn3efq1POHRLtECVFsGp:Kfv8c4rNw9w8i2UPCFFsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782313540, "uuid": "1b6975d5-2777-414e-9948-8d5cc307bd65", "value": 205281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782313540, "uuid": "9b680909-3e71-44bb-a60c-200ffe6bf512", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313540, "uuid": "9d9b6fb1-17de-4f61-b62a-97cd7b82edbc", "value": "fort", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18718b80-6fd6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782310074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310074, "uuid": "d589e7f1-0b63-4edf-8456-741dc520c1d2", "comment": "Malware payload (Mirai)", "value": "eb57ed84ff874a03a308213b509f09a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310074, "uuid": "f243d4e4-70bd-4368-8124-6af90012fe2d", "comment": "Malware payload (Mirai)", "value": "1ef8848fac533ec93db7276a474fdf0b3ef78b66a9c66d35264bf63cf1fbb04d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310074, "uuid": "185b2bb4-4413-49b1-8fcb-01359e0cd282", "comment": "Malware payload (Mirai)", "value": "54e0e0d01275409ce0d1506686f8e810a5a7ad0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310074, "uuid": "b676ad3e-40c2-4454-800d-384dfc4a17e6", "comment": "Malware payload (Mirai)", "value": "03da95e158ff1a1035b08c7c652bf04a57ed68d855e2a4e0117d2c93ee0c0a1d5d97294afc681ee0376fbc23c7246df9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310074, "uuid": "4b021c7e-ac1b-4978-ab43-71400ffaf50a", "value": "T129E32A1669528B12D5C311BAFF9E914D33132FB8E3EE32129D246F60678B8DB0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310074, "uuid": "45db06ef-3015-41ed-99a6-77cf3924b701", "value": "3072:GT/Dnqehkb2PTssvNb98BXSauayN+ExrRD7+a2nhfHPy0dDHxg0NBfK:GXnqEkb2PTsaNh8BPExVDqa0hJdD+0NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782310074, "uuid": "27c48c31-2c0e-459d-b1d9-8375905bc48a", "value": 152004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782310074, "uuid": "b3583a01-2462-4655-9cc6-68f956f874b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310074, "uuid": "9f4d83f3-5da8-4f01-b50f-f163a19543c2", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2089ee-6fc9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782304710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304710, "uuid": "ecc2e109-7cf0-4216-ad73-da633c2a9171", "comment": "Malware payload", "value": "03c4d419a3fe76d0e977fd82903f4acf", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304710, "uuid": "6aa9303c-94aa-4e36-80da-86eea300458e", "comment": "Malware payload", "value": "2117f4f448674fb5fafa5dd581777d35255253a4b82c9d0be2aac917efec8ae8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304710, "uuid": "0eac9267-da5d-4220-8a42-2dced7e4f7fd", "comment": "Malware payload", "value": "de509a027c3af1e850aba6877e9fd1044ad856be", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304710, "uuid": "2b4d459b-751f-42f0-a47f-d901347c3723", "comment": "Malware payload", "value": "7db1eaa28c98e9c0caad34de22eafa69185f9919f507ebd78d35e23137534505b4cd4bd84770fcb83932da7b2e4e05f7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304710, "uuid": "17724a43-5eac-4c81-9287-05edea46f20c", "value": "T1C1662386FF05D93ED4B3853B0D52073222669D1ECA87D30785EC7628687BAD80FD9AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304710, "uuid": "052eec26-661e-438d-b00a-dc38004c229b", "value": "98304:vmmR+BqxuGboFx5JDl8XvtBZBeAaXEbD1+FVzNsj8Jcfv3DNTDMr3WTGn15G:+mnxuGbexDluZ0ANf1wxsj6cy3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782304710, "uuid": "fd0859a5-7840-460a-9dc7-acd2e3eda647", "value": 6741550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782304710, "uuid": "cdb02856-cba0-4e53-9c36-d42030c232dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304710, "uuid": "a9f851f8-3292-4107-b2f6-3e0040ff1ef8", "value": "T!kT0k181782121968113.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c919b2f3-700d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782333993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333993, "uuid": "e3895dff-1ff9-4f4d-8b28-ca1835521104", "comment": "Malware payload (Mirai)", "value": "8bae7f28442ff5af0fc1e06e1fe70d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333993, "uuid": "566615e5-cb6f-4b60-b15e-2a2fb731743f", "comment": "Malware payload (Mirai)", "value": "2122acaa42afef0b94d57ae665aad3e63bab5a28c07d03378feab8a4001312f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333993, "uuid": "38cf4d53-b6d4-4aa6-9dd7-26515cb31693", "comment": "Malware payload (Mirai)", "value": "922e0caed7c90afc75e2b409906c773bc9255203", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333993, "uuid": "2620665c-0727-44a4-8a29-f6cc4041902d", "comment": "Malware payload (Mirai)", "value": "323ded8ca77adcc04e7b2ca787eee5035e4cc4c0042bd16d414899e71ce0210092da7e5bd5334afe73d829f92d44d471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333993, "uuid": "5a87b0cf-fc22-41f4-bda6-091e77d8cf8a", "value": "T12DC30B52BD429F13C6C321F6FBAE42993B136778D7EA3102AD247F5127878DA0E36511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333993, "uuid": "27802462-7fff-4e85-bdd2-34c6e05a6a95", "value": "1536:esUdW9C6Oh8ODJu6WvewdQbLPp5AuBfRY//OuwvmdZmuNvd3VyAPrFG8OYc9WarZ:IdKNS/uXKS/O7mTDxd3gWKNTxfI9Ik6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782333993, "uuid": "af701811-7bff-4bec-9403-49130fbd2328", "value": 120608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782333993, "uuid": "e0a85434-f63b-43ed-9696-08e380368662", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333993, "uuid": "5ca1cad7-251d-415c-b661-c833633e2f8c", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700072e5-6fc3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782302061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302061, "uuid": "199df3e0-26fe-44b6-a7a7-f346c09c1429", "comment": "Malware payload", "value": "8b18d45188728b6bb652b0a7bd2f3cf5", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302061, "uuid": "2b0f86a2-500e-4974-943f-e34ffb72aada", "comment": "Malware payload", "value": "2638a263f9bc829ac5e112fb7e2cbad9152eda4bb89dfa1ab22f64fcff744ce8", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302061, "uuid": "af39426c-c198-47ad-b9a3-9f8969b69d91", "comment": "Malware payload", "value": "2af640b52aff3b85e56bc7e0cde586aaa80d11a8", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302061, "uuid": "439a6381-d87b-4d1d-befa-e1252c5c2288", "comment": "Malware payload", "value": "d62a2611ea9fb97f79cde1109da9f5f8a13046b8e55e8fbd95cd2162ecc2d5d769fcbb47027449c6f7bd1a2e137862ff", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302061, "uuid": "10fc11d9-acad-4269-8e91-0aecfc5e85fc", "value": "T1D5B53350B3E9C1B9E1803571418E17D118FFEB990F2356CB6FB84E1B4BB42D2E876896", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302061, "uuid": "bd09c4f8-6688-4547-895c-b1af5bb6688e", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302061, "uuid": "732bce48-43a2-45d0-97b2-020816778320", "value": "49152:IgwRlsU7nll3OiS62MFe9PUsut7+GqN9AalTdbpqRq+vNyVpBTHKZ:IgwRlDldON62MWcrRwNKWxbpqRJvupBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782302061, "uuid": "acc7e31f-909a-463f-81c4-398c6e8fef67", "value": 2337424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782302061, "uuid": "f8ac0b21-cf95-4da6-acd8-7e23ac3e7182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302061, "uuid": "e34051e2-d69b-4646-81a4-147edfd472eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccaadc3-6f98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782283614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283614, "uuid": "f0710322-bae1-47a7-b5f7-c0ee780a6592", "comment": "Malware payload (Mirai)", "value": "5056f201f4d27945e887b07f47282709", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283614, "uuid": "4076a5f6-d480-4e1b-b94e-aa57ace9d5b5", "comment": "Malware payload (Mirai)", "value": "26a25ba691ee0574279f887b61765fadccdb75a78d847f95520f4c90dc2cf458", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283614, "uuid": "21ce56f5-f6e9-4212-b2e7-c6c53180c413", "comment": "Malware payload (Mirai)", "value": "0e9d3da0d7de1b2109d81a614b6ae65a187df92d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283614, "uuid": "9c0928bb-fb70-4c7f-96dc-edbf00c0f79d", "comment": "Malware payload (Mirai)", "value": "6ac03d00753c9d464bdc8627d6202695b123af7dbda9a74da6711b5afb52e9d9aa11e77fd21a599e210eae0a27b38197", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283614, "uuid": "f4b623cb-4895-41fe-a80a-47feae1a01a9", "value": "T1D83165C922B017FBCD94DC523922ACAE6059C9C7AB4785EC284C48F36F85E55FC18A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283614, "uuid": "6c4b0270-6885-43d3-88d5-b258996e2d35", "value": "24:sBSHBqL5vFBMWqBCxBwBWBdT/qBxqBnMB+LBcf3By4rgByfBM33BOSN:gShed7MfCH0Gdj6x6AaMyRypmxJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782283614, "uuid": "655ddb2e-8378-4efe-8c68-28c28b87ee98", "value": 1520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782283614, "uuid": "bc7b408c-2193-45a4-aa46-6cc5e8de8391", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283614, "uuid": "484b612e-b5a4-4c28-afa2-89278ec53431", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c51756-6ff8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782324913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324913, "uuid": "6e0a165b-e8e4-45ef-b727-0f33ccba1dfd", "comment": "Malware payload (Mirai)", "value": "506cdc7a4e85ea21f0acefbb029a5383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324913, "uuid": "a7476446-5276-4446-ab48-be13e699dbeb", "comment": "Malware payload (Mirai)", "value": "275888c797b3b35381780c251c8687e0ac978e52d5339d208df7696dd9f1aa6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324913, "uuid": "02d91b6c-4af9-4139-9aa3-49da44603c02", "comment": "Malware payload (Mirai)", "value": "89cd6f3fbe14af15e46f4dc6f7ae344d34bc269e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324913, "uuid": "258f40dc-eb8d-4477-9dbf-648a97259608", "comment": "Malware payload (Mirai)", "value": "61ff63c3b786c7805b6d9d6db1c1c4f7754e9422818245138d68aa2285c983acfc7d26f93fe644af99aa06f4e344cd5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324913, "uuid": "1a2d24e5-66fe-4169-bd3b-07f4673f395b", "value": "T1FAC32802770D0F43D1232CF02B7B1BE18799BEA619F4E684B51EBEC652759B62146ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324913, "uuid": "1646f32f-417f-4228-a485-8022e20292e9", "value": "3072:0f47FF6zJ3YjxfWRThpvO41rKinCHuMoi:O4S1IjoR1BOWrvCOMoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782324913, "uuid": "a29c9a2c-73c4-4341-b38e-3e528077b421", "value": 124644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782324913, "uuid": "e4dffd23-f3f7-402f-bebe-889abe02ca08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324913, "uuid": "b62952f1-e3fe-4be0-a7ec-76b7e95d32e2", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2e2807-6f95-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782282222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282222, "uuid": "9353bf7b-2df4-405b-8cde-25e68c2b62f7", "comment": "Malware payload (Formbook)", "value": "4faa3ebf05884948c5e1b7c8cd55048d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282222, "uuid": "fd0090b6-f151-41bf-a05f-0d0183000f01", "comment": "Malware payload (Formbook)", "value": "2882e8c9aba470c81dee9b361b5cbbf9a56819774682c68a5c78af90f1bd23e1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282222, "uuid": "7467c644-a1bb-4163-a2f3-6665ce38523b", "comment": "Malware payload (Formbook)", "value": "ba07bf1892fc9ae15d4650b165cd6e3c375aa2e6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282222, "uuid": "a1c095cb-b608-4ec2-8b30-7372f1b94538", "comment": "Malware payload (Formbook)", "value": "e9edc69aebb70cdaad8ee1c50d8180c990d38e19c03c60f1445cc15712bb8c6081ec8c43e51103f0ab71eb3b304bbe2f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282222, "uuid": "af686b39-6068-44b2-b605-07824971df3c", "value": "T13F75F76DF4BC42B5D296F2E381C9F597D771F23602395D8030E35B8668212A3B592B2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282222, "uuid": "fb4b6016-4bae-4c0c-aebb-8656768761bd", "value": "3072:KKu/3gwUmCkvxb8LXI3A3x/CS4LNvn2L/tmJBb6qLPLBZoxjwDjJtTfPbIWT2iYJ:lFZZHUsH4LBSx+TDNT/MGNNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782282222, "uuid": "acfdf3f5-7eb3-4886-889c-7c830503cf9a", "value": 1594564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782282222, "uuid": "db8352f4-33c4-4017-b4bc-ef85148789a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282222, "uuid": "f4b5ebd3-a951-49a0-bac8-394ddaf6dd9d", "value": "Payment_Invoice_Swift_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738846c2-6fc3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782302067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302067, "uuid": "6cd2b0f2-29e3-4de0-a669-745a94e5d420", "comment": "Malware payload (SilentNet)", "value": "90aec77c472ee9359531593ef331330f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302067, "uuid": "4a83c817-c467-47dd-b9ad-5bf21ba1257a", "comment": "Malware payload (SilentNet)", "value": "290c3fc88cf265bd05e4a84c58ffc7b2d02700e5b2b1fbff67634885f4b11fe0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302067, "uuid": "f6724f85-35bd-4a61-947f-0b0e38955ed2", "comment": "Malware payload (SilentNet)", "value": "bcfa9c40ca9beb7a162c042cb0c380822a0dd40f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302067, "uuid": "368bc661-d19e-4e64-9b5e-6a760f1d5798", "comment": "Malware payload (SilentNet)", "value": "f88cf500981ce615272b652847389cb92a49fdcac887f5ca2add09aec1f2de661fbd3d2a5f6c482e835192ceade44b6a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302067, "uuid": "59e8cecb-4e78-4f04-8968-282b312f8b1c", "value": "T1B08312971446DEF3CB3145F6842CF9AF66A309C8C9CB950F752C094CD422AE68F40EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302067, "uuid": "37854d8c-8e91-480d-9184-8e10c80256a1", "value": "1536:bEhri1bySCyPTxF7cRtmJnEPqsvAyya4t+RDxDh51PNCVbR+s4np34h182O1:ari1byjkTX7c+ESsviXoRDH51QN+z14c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782302067, "uuid": "f7f27f0a-4971-43b8-aa0b-61ff3ffb231a", "value": 88760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782302067, "uuid": "e19b0ffc-9d86-46a5-8fc9-bc9fbf017727", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302067, "uuid": "9ef1f73c-7b38-49af-a837-d9e29a3076ea", "value": "GrownKelpfinder.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e776fb-6fc2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782301740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301740, "uuid": "3d445ea8-756f-454c-93f6-e370b1f27279", "comment": "Malware payload (Vidar)", "value": "ffba0d0ec1848f799a0ab489affb8ab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301740, "uuid": "0fb9f638-be0f-4a36-bd8b-8b0773767ed5", "comment": "Malware payload (Vidar)", "value": "294ae135fa8ca524f5a78f8a12e2ed99c535bc58c86333dba3759ab738e971c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301740, "uuid": "ed0f2144-12c4-4544-a145-a2fb1d000763", "comment": "Malware payload (Vidar)", "value": "745a2a45f00937bba7636414b4d9109620e10ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301740, "uuid": "d1b37090-33da-40e5-80f0-d6cdbb301518", "comment": "Malware payload (Vidar)", "value": "f0042c1e899e457bd040e2be67d44a624e4a379fad3aeffa702a089aeb6b4679edc99ab1151769692adb88a2a61c57b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301740, "uuid": "67cda7e1-7282-407e-ba69-feaab0555c4e", "value": "T15E069D06BDD28DE9C0E8A371447642907739F818573627D72EA0A5743F3B6C1AEB7B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301740, "uuid": "24727104-0d89-4f4c-9ae0-b97c59b2e2ea", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301740, "uuid": "519aadb4-0e03-49d5-a782-d7813d76c2f3", "value": "49152:IFuSVzdUBfivQvO2kX3E3AiCz2JMTB3+LCG1wSm8BO2pzY:IvPoG2KYAtOMt3+LCG1/mkOAzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782301740, "uuid": "bd6c9d48-c0c7-40ff-98b5-642d6addef1e", "value": 3749168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782301740, "uuid": "9938036f-1ac9-4b94-94bd-63f71d3374de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301740, "uuid": "45f6a770-6170-422d-bcfc-b18ae727fef1", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfddce83-700b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782333145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333145, "uuid": "78c3b5bb-133a-40b8-89b5-4387fc146cdd", "comment": "Malware payload", "value": "41f9450bba235c37d40cd0315c1013cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333145, "uuid": "c8a5aeb6-02c7-4724-ad9d-b1dc59e5da13", "comment": "Malware payload", "value": "2ec5ae79d9e5f7a8a0026fb8f4e6a4fa059991884bbae53c91e5753ee139ac4a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333145, "uuid": "f4f03b23-14ef-4542-90d6-2204c013d686", "comment": "Malware payload", "value": "9a1436ca008d59c518ea83aec40d9b655a840c81", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333145, "uuid": "24f10790-575f-483d-b3c3-85d293f4e193", "comment": "Malware payload", "value": "612888535271b7efc52a797da62214029ca2dade97f8c61c8a47b74eead2ac717e36c954d84f6a21077697e2788d93f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333145, "uuid": "17b7d01a-91ae-4ae7-8145-fe156be6e526", "value": "T1BE44AFC1A592D4B7EAFE1474905CC53DC77D2E00ABB0CE7B2789DDA91923B11C26933A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333145, "uuid": "4815f8ef-523d-4ad1-acd5-8a288d3bdaa8", "value": "85e7a31dd6c0ac31fb68b80e0eef7ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333145, "uuid": "b35bf358-3491-47d4-a0b5-6a16f18bd7da", "value": "6144:E/S+yzOfgo/7YLkMYQwk5lIwJ5qPInKlp/1/2qinkJVJZHW:Ea+yzb5LkMKk5lVJg5R1s2lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782333145, "uuid": "16f3bf3c-6b9c-43b9-bc7b-9a97d6fcbf0e", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782333145, "uuid": "15823f82-0926-485c-8caa-685f49bf5d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333145, "uuid": "fcd7b3ea-0384-482f-8dcd-b75c4a906f24", "value": "Canon.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cd7587-6fc0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782300858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300858, "uuid": "c4b316f8-ace0-4263-9f8f-8dcb6fc8be8e", "comment": "Malware payload (Vidar)", "value": "3b39953c24882ef34dc75ef5badb0ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300858, "uuid": "907ef3a2-9c06-4fa4-b0df-5780bb51a201", "comment": "Malware payload (Vidar)", "value": "2f5a0566c5576efac2c72cdd0270840e4171c5b72e0fd7058b70e0f0c49d8f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300858, "uuid": "334db1d5-ae39-4f87-9083-cd9f06593a72", "comment": "Malware payload (Vidar)", "value": "18e09a5a3ab1a020b0e5db61e0639587daacda53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300858, "uuid": "bce9dcae-6f08-491e-87d2-c31f37834222", "comment": "Malware payload (Vidar)", "value": "2dea682cb4641806d6ede6fd2cd78e8f9aaf091c4120689c0a8b6803cf92d48362d3d890f1b550532792bb6c911b3e45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300858, "uuid": "884e8841-9abc-42cf-92dc-976df216dad7", "value": "T162068D07ADD18DA9C0E5737188B25191F77EB808173A63C72D50A6B92F3B6C19DB3B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300858, "uuid": "2ff692e1-d574-450c-9a77-c355b3e4eb52", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300858, "uuid": "fdac4436-fc65-48b5-8479-36b4a5739287", "value": "49152:vNzmLX/NNm3WruhWDfGLeV6tIPRs90tss8xG:vNwprEcsectuC97/xG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782300858, "uuid": "e9795565-b2ec-4318-9a9a-62c0e0364ff3", "value": 3747888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782300858, "uuid": "3c5c1b6b-dc40-4f2f-827a-e50065a2febb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300858, "uuid": "11c75adf-5a08-464b-88bd-47d0aadffe13", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d5c8a1-6fd7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782310548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310548, "uuid": "df4349af-339c-4b9c-8af3-ebb248d51bde", "comment": "Malware payload (PureLogsStealer)", "value": "ac2e5028951326102d88501ee16058e5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310548, "uuid": "67f4926e-6c75-4f1e-812c-11a9c3e9aab4", "comment": "Malware payload (PureLogsStealer)", "value": "2faad6e0520d00ac4a54204ec6be6767946d72b7a36bf3e4156cc445216105fc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310548, "uuid": "83fa3dff-9431-49a4-b6e5-fa13390a2730", "comment": "Malware payload (PureLogsStealer)", "value": "e8ddc0fc06d6a8cdbe1e5fc29f1de2979c706f87", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310548, "uuid": "01b41bb4-5516-46dc-8038-a644e265bbe8", "comment": "Malware payload (PureLogsStealer)", "value": "05a1fad3a8caacc219931e5d09eae649744ee44bc038a0c1cbcf1a628ec24a30b5b2032594df15997c7d3b6c5c0ef2ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310548, "uuid": "21aacb12-b3c6-425f-88ba-96fd6171b94a", "value": "T16685B3088BCA11DCB1338217A9AB4B98A56DC0272BCF7DCB61B51FCE57061536F712AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310548, "uuid": "e5eb6095-1bfb-4613-8e07-fd450ce334c0", "value": "3072:lLCpAfcCz2cazL3OvfDGIJMoI4I2mBcBmzsIdOxnNK5pSXg9Xlgsk1RiJw6wKWJE:eANpyB7/Fuj0GEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782310548, "uuid": "63732d95-66cf-4022-b882-3410a58f8728", "value": 1789120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782310548, "uuid": "a1f04dc5-80cd-444f-b3e3-fd7f0810486f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310548, "uuid": "d6e53f72-101f-45ee-8c95-f816e4d76c32", "value": "output_9pfabif3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f190fc86-6fd6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782310439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310439, "uuid": "5b779287-117b-4059-b908-630606619503", "comment": "Malware payload (RemcosRAT)", "value": "4ec9b540f58366b8eedfa56dc557c107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310439, "uuid": "67d13963-416f-47c8-954f-537ee00f45e7", "comment": "Malware payload (RemcosRAT)", "value": "3061e2a6b00e4874345eb1e9dcab0e2390e0073608b31e5925e27af462ccff1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310439, "uuid": "4a7fcb21-ed64-431a-b757-0a8f2a7c9a46", "comment": "Malware payload (RemcosRAT)", "value": "62c60053dbd53105aaf095ffa205e32b28df2f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310439, "uuid": "ce1d33c7-3664-4d7c-a02d-7b44cb8f244f", "comment": "Malware payload (RemcosRAT)", "value": "3a25bbecf92dd8adb690fe1d3d17a55c358555727be3085b2483b59ad77286803dbcdae5cf661b9a8973d0f9d8651a03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310439, "uuid": "3e377e86-1396-4555-9c46-379a1be16604", "value": "T118341244BE7AEC1DF4480AF25511DCB5A5A88C261A797E4B8BE4FF17F92AD40E983031", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310439, "uuid": "dea62817-04b5-46fc-83c8-5c0c04bf3ece", "value": "6a3440265081bfa8a648c7e70dd3777a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310439, "uuid": "e747aeac-c5d0-4666-acb6-21673f19a72a", "value": "3072:h9iRWw7aM+jTj/asbwHaZc+5TQgzQJsQwgoUVD5gpKJNkUka4SrwgcUSatS6MSHG:hMWRLzPRwtufhU154gL1CX4MOaYyRYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782310439, "uuid": "5613c814-5bc0-44d5-a48a-6f83116c8395", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782310439, "uuid": "de8b1df7-d1cf-4473-80a2-b3b38fd317e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310439, "uuid": "95f26eb3-baf7-4518-8eb8-dc4dfa8d8ccc", "value": "RCFB88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae18eb9-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322641, "uuid": "94f694f7-f169-484e-97be-d892b875a280", "comment": "Malware payload", "value": "559e592cc2e73e7800004b6e5ad2f821", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322641, "uuid": "114e68e6-0b30-4ef2-b129-edbad437af07", "comment": "Malware payload", "value": "310ee72debb75cef10f93e7a482873da09ac82814a293a1b9f311b2b656527f3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322641, "uuid": "fd815468-64b7-4551-a079-6358bd3c76be", "comment": "Malware payload", "value": "e1f736c4a49952609ac0b66b9ac4bf3d4fb52b9f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322641, "uuid": "4c0b6118-2003-44e2-9e96-f4fee8dae4d2", "comment": "Malware payload", "value": "d8cce84d7daf2293b139991e7e4b83275e7392d81b9da89e585a9838d69dbd61f99b77e43b9dd91ccb5537a28c87bc7a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322641, "uuid": "32b2ad8e-89c0-4372-a1af-495f27a9e6ea", "value": "T171C60143FB418A5AC0F787F24933576026270EA68B5397C76960397D3D736D06E8AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322641, "uuid": "77b0991c-279a-4fad-b935-f372c7f9f422", "value": "196608:7RAW6L0F0CNPLSPQFlQb8pE1Nqj35SQkJRRNmNwCbsgY1h9YNEAKuG:7RKsNOPQLssj3EJAeGhE94/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322641, "uuid": "4516402b-316b-47a3-a7d0-5e83c4860fc4", "value": 12300940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322641, "uuid": "031adc5d-54b6-40bd-86af-2e1b5b895620", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322641, "uuid": "df91f360-51d5-475d-9414-e6bfb164e576", "value": "activator.facilitator.subsystem.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80d17fa-7003-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782329643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329643, "uuid": "dfc35b87-bdc5-4396-b342-18ccef56a310", "comment": "Malware payload", "value": "122b1825c4c0ceb3537a0986300c1019", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329643, "uuid": "213f1729-baeb-4edd-9e84-db4b0b85d181", "comment": "Malware payload", "value": "34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329643, "uuid": "be100474-6581-49f9-baf7-d108cb4c3f57", "comment": "Malware payload", "value": "62787eb954262bd7cd8ae01df8c95de54eb51671", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329643, "uuid": "914ca04e-d200-4611-84aa-0d1330af858a", "comment": "Malware payload", "value": "5a0eec3b7b98f3ae827212b8a43d12dd1d66358dd2b88afa2cd60e805c69f3b22211ad8582ba15526cdeeb856899a353", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329643, "uuid": "8f23d6a5-964e-40c4-a115-014ce8016e47", "value": "T17B415EF1E8B49833B86FCA18F11CD0A45EF76E3F156B3588B472996D6D1E408271D722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329643, "uuid": "3bf5ecd1-60a0-4327-ad06-7cc71d3d02f5", "value": "24:jx/1aMvM5MCYhuIhLxMlvheNbt0f/NQ6SCLIeB:jx/1aMvM5MCKuIhLxMl5Obt0f/NQ6lk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782329643, "uuid": "9c28cfb0-d07a-4009-bb72-d267f6507fc7", "value": 2110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782329643, "uuid": "4848a440-1108-4ece-b34e-de05fd4afaa5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329643, "uuid": "2709ad28-3a18-44e2-8cbc-8a1da9f13aab", "value": "dropper_34d2e47f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75791739-700b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782332994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332994, "uuid": "4bb9d45a-2579-42ba-b2bb-4a2c857d2ac3", "comment": "Malware payload (Mirai)", "value": "f0363b7a63bae9c7f49fe8b741a12eff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332994, "uuid": "057df317-a151-45de-a761-99e6e6a386ac", "comment": "Malware payload (Mirai)", "value": "34feec85340a025234d379a0095489f526181765b6bee67cbb4d3e07000f7086", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332994, "uuid": "006dbd07-8f2e-4d46-a5a0-37c688aa9573", "comment": "Malware payload (Mirai)", "value": "129bbbf4536e3d9d8e4c3b9a9fe2fbf146ab4efd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332994, "uuid": "0e0ec903-4dfe-465e-a2bc-adeeaf1382bb", "comment": "Malware payload (Mirai)", "value": "36a5f220fc5b24d800e59c480eaf132f33883a28762ae6949a1343d9525c4df15da609603ee4b7ac307c523866d5744a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332994, "uuid": "b7aeac1e-11ca-47d1-a2b6-1076363a1bde", "value": "T135E47E9DFE4E3C42E3C7E2789A4D87E1722B71E0D32391637982034CD5D69D98BB1A25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332994, "uuid": "b54b43bf-b437-4ea7-ac66-a2f6ea85cb11", "value": "12288:9/Nemn4Bm5I//nJMYmT+vyFHLj7FyxWpNsStrBms5d+E2gww5X4t7q:9Vem+3//nXWHLj7FyeZFcvH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782332994, "uuid": "88b8fd47-194a-4771-a36e-fd4c7da9f5bf", "value": 700368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782332994, "uuid": "c3eb5ab5-d390-4636-8e94-13014baec68c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332994, "uuid": "d32fdbf2-12c3-4184-8001-dad3fcd4b57c", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9992457a-6fbd-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782299554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299554, "uuid": "b40409a8-a996-4f56-b137-fe264b88491e", "comment": "Malware payload", "value": "d3f801fe534fa70a5f37881ef6cf0c78", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299554, "uuid": "de5131e7-5215-47c0-992d-39a96f146517", "comment": "Malware payload", "value": "364983d2dbff85f4b9b2bac2beba40ad29ac85f2a16bdbc8fd65896ef03cddb2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299554, "uuid": "1869d481-41d7-4b84-b1b8-a7c2af1872d3", "comment": "Malware payload", "value": "83c39eedb91f01a627ab96eaba558c9352a18b03", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299554, "uuid": "3f238ac7-b433-4c4d-97fa-a61849d35af9", "comment": "Malware payload", "value": "fd29993f574f370700f27867e7778460c0ae2d75d3083be7ded9be41ac62b621153d5522bfa26b124e2c8074e30b8e6b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299554, "uuid": "2606a976-028a-4485-a580-d8e90d9c6af9", "value": "T121252399B709C311D57B52728912A7826637EF848E12275B7842FBBCBAF37D40F05B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299554, "uuid": "155a0206-0203-4e26-a9bf-c050de4b9c6f", "value": "12288:6UHy4Se6peGb3drg6xHWjeTBBmbP7juu8dHItG+Vh2D2QdGYUkMm8mYUX8kO:6UZKp9bN86feTjuJ1Jd0nlm8mYUX8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782299554, "uuid": "e72da9e8-057d-4b48-b037-a6e5da011a27", "value": 1020713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782299554, "uuid": "4f46d35e-35e3-41ab-bd55-78b2ae9f0453", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299554, "uuid": "4557077b-09dc-4a8d-8f83-74f01dea644d", "value": "ca8818e7_RT0-eChallan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3033372-700c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782333580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333580, "uuid": "3fc709b8-4006-4662-9050-caa06f652100", "comment": "Malware payload", "value": "a6d2d0c5fee3c41f30b51b8331fe2b49", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333580, "uuid": "2c3ff510-fddb-4cf1-a2f5-109be6a338fa", "comment": "Malware payload", "value": "38653b45cc1ad44b143751d4cf64d1924b4b22bef833b8c8e341b2ba4b5e1470", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333580, "uuid": "21500012-774a-4cdf-9f62-8a02c4664c32", "comment": "Malware payload", "value": "57bf46e51aab794c56990db32ef3748c2effd507", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782333580, "uuid": "dc7f96da-3d83-4fb5-93a3-75dbc114597c", "comment": "Malware payload", "value": "af0b68bcc930f8375320d4dfe42047d02997f116866c9c32d1b7d160adc3d76df7038dc3171705ff502ccc0fbcfa47a6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333580, "uuid": "2c3a2eed-a98f-4c6a-ab04-8e16322d64c9", "value": "T1EDA62312B7C3D176DFA219F3D5BAAA36193DBC380B2888CBA380742DD5715C16B36716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333580, "uuid": "9ebbf82a-bd9b-4226-9c3f-3773705325f9", "value": "fb40ad72cb65f1767a2e06fa73fcbc83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333580, "uuid": "e46a9201-4c14-4f0b-b4f8-d5734833d485", "value": "196608:p4EdgaXCU8UNWIR/l7BqK8I7V37tnTyMXpau9gxGtbzCSGoYTFK9AlGiJxVqfX95:p4EgantWIRtEK8IpLx+MRtbBNYTFuMGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782333580, "uuid": "3704754a-1b97-479b-bfad-804b18660e5b", "value": 9543168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782333580, "uuid": "21fe698f-c2dd-4aa7-afb2-b1ec1f10fa07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782333580, "uuid": "c3db4b93-87a2-40fb-872b-11755207d08d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5a90dd-6fbf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1782300312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300312, "uuid": "33ec6ad4-783e-493c-a070-b578a179df95", "comment": "Malware payload (NetSupport)", "value": "ef971f0eb6dd2810eae97b269e175de5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300312, "uuid": "468adfb1-0deb-4062-9445-03b5df18d42e", "comment": "Malware payload (NetSupport)", "value": "38ed065bb739e205b2bcc551b3d6b6e739c8c8f01bcb41684647c1578099cfaf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300312, "uuid": "3e9ede5f-54e1-4074-bb23-1df0e136d5d5", "comment": "Malware payload (NetSupport)", "value": "29966e6a643694af74bd2b5de019c6fdb9e4eab1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300312, "uuid": "448fbbcf-7c9d-41f9-b646-44dfddc85e8c", "comment": "Malware payload (NetSupport)", "value": "2a843d504cd66cfbb00f2eff7ba3d39adbd12a4718b4fab992a4fbd02e104fb5a48b207b455f95679fd4f4319391a716", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300312, "uuid": "dc0a6fdd-8daf-4ae3-af5f-65f292ce2a46", "value": "T179E5338AB88CCBEFD24713B5B1D0E91904559E99741940ACA7B5FF2C6D30B14EA33DE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300312, "uuid": "f3a02367-b065-4913-b8e2-ca25d3f10366", "value": "49152:DZFix3vZ5b+HLZ7J4PENo4dbK8derUKtsZKSdXe3xUu5YHNo7eqFrO5IUYZWfWD9:DeVZ5gt447p2uBe3xUu5YqZONYofX7Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782300312, "uuid": "d5a9c815-6b23-4e6e-9ef4-5353e5011eb2", "value": 3096576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782300312, "uuid": "95d252c8-3e34-4b8b-8d86-c45de4a87509", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300312, "uuid": "8a8df469-99c5-4ae9-a202-6a701d9a39b0", "value": "Mono_Neutral9.07.4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c03a0b0-6fbe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782299799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299799, "uuid": "8dd91b10-0a0a-4dca-9e05-719a6d97d8c5", "comment": "Malware payload (Vidar)", "value": "838690a59454ceca4ead19bb6182cce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299799, "uuid": "ba737742-b0ce-470e-a0f0-cf76c9baa1f6", "comment": "Malware payload (Vidar)", "value": "3cbb2b2f06b3a55dafc4f53f0babb163668ecd5832363d69b5d96c378f6c7f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299799, "uuid": "77b81f8b-6262-4a4e-a565-95751e0b2160", "comment": "Malware payload (Vidar)", "value": "a6169d5698999d2f95250fd6ebd5b1caf321d7cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299799, "uuid": "2fc8166a-4b3a-44a9-ac98-ac6ad88e5ce1", "comment": "Malware payload (Vidar)", "value": "be6879877d5daea1da642f68abba839d4af53820c6ec66b7f81ddcd59a18607c396066c2baa92f74fd17c7ae8424c681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299799, "uuid": "7fe143e0-5a5d-4588-970e-7ae2f9442f74", "value": "T14BD59E077CE148F9C4A9A33289BA12927B71BC091B3263C72D957B782F327C0AD79755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299799, "uuid": "6942bb4e-54bb-4bab-b750-d06c67d965af", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299799, "uuid": "54275056-16f9-4c70-8cd0-5b255e6c3260", "value": "24576:ygUHJHJMKeVkOyYS3y5tGdMH+dQkcfEYGclQcPImDna/tQDZ7tQPLGOQi7IjUtxT:ygUHTMXVrSC5tCU+dQkcTjIqgs24FrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782299799, "uuid": "768b5208-1e16-4188-82bd-4f0ee8ead74a", "value": 2997624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782299799, "uuid": "027da6f3-1f21-4fb0-9cec-f40faa9ebf74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299799, "uuid": "0ad80af4-ddff-4dbb-ae63-f931bb119692", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3376328-6fce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782306925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306925, "uuid": "984e87c3-6b6e-4b55-902d-16c167abd1ea", "comment": "Malware payload (SilentNet)", "value": "40431f6150ea29a6528856580f7d9d09", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306925, "uuid": "9eee4d28-91a5-4bfd-a052-421cbdd933cb", "comment": "Malware payload (SilentNet)", "value": "3d0ca60502609f3fcd9614c6831b5ea202061881fe8f2efdc57df5e7b0b5877e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306925, "uuid": "0b4e7fc4-47e7-446f-9d9a-7be70af3490e", "comment": "Malware payload (SilentNet)", "value": "a5a9259322fb9a02b4ce4b95cefa38279713b2f2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306925, "uuid": "27a70ab6-e050-47ec-941a-36cfaff13a35", "comment": "Malware payload (SilentNet)", "value": "4f370031891eb06bf08040eca5b815b0cf88c2b93786ec480cbf5e27b07de9747fb61d6d2737ab2041183b2905ef86e4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306925, "uuid": "64ece13c-2e7f-44f1-b41d-c082c4857b54", "value": "T15983026889407964E533AAFE114DCC94EF1B8FF942CA6A6E0BDF5BC147E29352C0452B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306925, "uuid": "ce76a48c-c424-4604-bb1d-0049afc941c5", "value": "1536:CzDajRrYpLeAw1x2nUUYhKzUiyMd7Qb9rYkBZEvleeQB40voGoQhQ4rbKBpBMdT:0al6LZwSVzUiyMd7QVYUEdBQB5pXrbQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306925, "uuid": "a5359dd9-0c2d-466b-9f4e-9da11d6a6ba1", "value": 88054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306925, "uuid": "f4f4213f-b391-47ed-b6a2-264a65482ce5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306925, "uuid": "34db0492-72e3-44c5-b0ba-370b16b24f7b", "value": "GambleRiggMod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678d1cef-6fc3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782302047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302047, "uuid": "39e7a6e3-186c-460a-9bd3-17576d63e8ef", "comment": "Malware payload (SilentNet)", "value": "d8e49cc4ff57d89dc59330b6440af43b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302047, "uuid": "54f11420-a74c-4e5b-9cfc-fdf15ecc4f41", "comment": "Malware payload (SilentNet)", "value": "3e3c610b9e8f5f89f4a907c0fe1d8a8285d801b6c4624758061799c0d111888e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302047, "uuid": "d455b806-7c0a-4807-82e4-d5aafc8b5bc3", "comment": "Malware payload (SilentNet)", "value": "cc5ea48864464bd0cb683a277c213149e9b19cb9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302047, "uuid": "50523382-259c-49c6-8cb2-44baf5485117", "comment": "Malware payload (SilentNet)", "value": "31ebc177cf395c43109b4edcad2cad33262914f10ece9a6bd416d0fb85c58f1e9a8160cb68852a9c3e6ac0a13b61afb4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302047, "uuid": "b01457fb-8088-46a9-bcfb-12df784700fd", "value": "T196B53374E5A8702EE043B7F79E890E13E627EB41F70429B65AF0E59E0C558185B39F0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302047, "uuid": "3bef6cd9-bbd6-47bd-8c1a-f8f178184948", "value": "49152:G3GwdNkns9I8cpVy42WdUmxHZmWLcgEdcb3KWdr95NC8kC0ljOUIZ:GWY6naI8cpVy5UNxHwpzU3KqrVC60Yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782302047, "uuid": "3ca3ee4b-7247-4cd4-9ee0-48f3d74a5711", "value": 2449347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782302047, "uuid": "23f60bdc-87c3-457b-b6cf-e5fc2d4ddd7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302047, "uuid": "8efdabda-5a55-4834-854a-50615706bb18", "value": "BadOptimizations-2.4.1-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842d2128-6ff8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782324858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324858, "uuid": "13107090-b68a-45bf-a238-9f1551f51431", "comment": "Malware payload (Mirai)", "value": "4a6a0ad5d5dc3f4c55114fb81ccfe02d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324858, "uuid": "c900485e-9ed2-43bf-b219-fea3bd1af379", "comment": "Malware payload (Mirai)", "value": "3f387aece33e0614bbd42c04b6e4934c8fa081e10ca07d8aaf1f8c3c750d748a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324858, "uuid": "76699f75-b00a-4b7f-aebc-ec36466e2e3e", "comment": "Malware payload (Mirai)", "value": "27fd6b3959f94c8139fa1b5be115f4ad8ae39e41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324858, "uuid": "d071cc99-9f74-4bba-a95f-4eb82560d5d3", "comment": "Malware payload (Mirai)", "value": "d329a8f9e1ba5a147f06e46ac545a3267af4c009e00d3aeb4edb350c956d2f82eb633f6b93b20ecf61dc9caca65ef8d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324858, "uuid": "c64c95bc-b806-48ab-96ac-ba4a19f473d5", "value": "T1A1B3F945F8508B17C6C661BBFF4E438D7B261758D3EE32029D25AF60379B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324858, "uuid": "f96304b7-cf29-46eb-b353-29ee8b16c3d0", "value": "1536:JUNmnXmIcJOrL4V/++7LlmmngdEOv3t3X6n9JZl3awyw0WUR3aFc5su0BDvFT:6wn2Ic44rtmlzHcnDPBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782324858, "uuid": "1e6b7bce-0fe5-4b94-b5e8-39ed068d6fa7", "value": 108908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782324858, "uuid": "4f3049e3-764f-4566-bc6b-64f517cd3925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324858, "uuid": "f306835c-9740-4e87-beeb-c7391611f0d2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945a58a2-6fe8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782318013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318013, "uuid": "03e32416-96eb-4b3c-91db-e6ec70f3c1d1", "comment": "Malware payload (ValleyRAT)", "value": "2d5a252882100e09cff0abef3b2be423", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318013, "uuid": "2785b71e-2dcf-4f46-b96c-fbc141d1061a", "comment": "Malware payload (ValleyRAT)", "value": "3f72211404ff5670355048653520db21461daab20f4b7e09aeb1fd987ae1b939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318013, "uuid": "01ee7c21-cf32-496b-904f-7da1ffba5523", "comment": "Malware payload (ValleyRAT)", "value": "cdc69278dff419a85afdae80131281e1adb90de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318013, "uuid": "dbfdb47e-7f7a-469b-aced-ff89b4b233bb", "comment": "Malware payload (ValleyRAT)", "value": "b7c9908df5d4f17acf0f104e3aecf93248911c59b1b7ddf3e279ccb2622a6017bd076c4beba05e63f35407069ae402d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318013, "uuid": "c4f0415d-1b7a-45e5-8a09-25b047fc4a06", "value": "T1BF183320D7C415FAC88392B808666547EF6ABC6527B4D15F03240AB71F97E329AFE743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318013, "uuid": "1b1365d1-29af-48fd-943b-9e4e36f3d059", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318013, "uuid": "0e096cab-46ed-4ef8-9462-0cd2f5b65787", "value": "1572864:BHY8AiKV5uQNkXgVivlnv8pX3pGCNIi+R98THfWJbvZLMlxj5bJcOzTdaH:BSi2/NUJNvSHpGCNIRMsvZIlxlbJhBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782318013, "uuid": "ee840e27-04bc-4838-bad9-623163bf9e57", "value": 90936332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782318013, "uuid": "d6029183-dea3-4bc3-9f62-4c81f0dc552d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318013, "uuid": "10ccc21f-b981-4f8c-957b-5b21f977b7b5", "value": "2d5a252882100e09cff0abef3b2be423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2fa8be-6fc5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782303106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303106, "uuid": "140276f3-3091-42a3-939a-c5eb4dc91db0", "comment": "Malware payload (PhantomStealer)", "value": "891f242e43b6aa231c213f1235e5434f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303106, "uuid": "8c58e619-6c7d-48a1-b17c-c0c830ac60ff", "comment": "Malware payload (PhantomStealer)", "value": "400638c4134845c1e470e119c474231023218a04a0d86f965b54bebde026c9a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303106, "uuid": "a5fb6d3b-43f4-4842-a68e-0e7ae7ce8c67", "comment": "Malware payload (PhantomStealer)", "value": "e99fe86e6f21c4b2f335db075bb78d5c1ef1f0cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303106, "uuid": "5edf9a06-1e48-4fbd-8853-1616d64019f1", "comment": "Malware payload (PhantomStealer)", "value": "793f5c912ae04419b94488edd57586d2fb457248e3128442401706f355fde20549f45b61a31b156cfe5d2c64b70a41b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303106, "uuid": "a0bc2ca0-11e0-43b1-ad7a-df61a2608b11", "value": "T1FB751285239DE606E4994AF55870F2B802B47D64F511C3079FF6BCFB7936B992828383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303106, "uuid": "380ec697-1d9a-49e2-a755-28a1031bc425", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303106, "uuid": "25ed2fc1-fc58-4e45-a728-40abd9b5428a", "value": "24576:gs33hytuTlujG1Pl5JmWnUc7TOcuPXShVENzsmdkPHG5vBRJrG7BWM1S+5qd:OuTlQGVJLRiXwENzsO7btG9WSSDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782303106, "uuid": "fef47d61-2a35-493b-8094-ba49498f7bf9", "value": 1594880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782303106, "uuid": "75cd463b-442b-42a8-8b2c-4ccf8953d0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303106, "uuid": "5cd5f0d9-2c28-48ba-b23f-81b8eb2886c0", "value": "20260624_937887293882.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67c290f-7003-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782329640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329640, "uuid": "c84ccaea-f82f-4b3c-aaaa-2f9f93ebf590", "comment": "Malware payload (Mirai)", "value": "2314aeaed29c72a1fed332f0099987dc", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329640, "uuid": "c498b34a-f031-4f7f-8d71-43e3730bfe83", "comment": "Malware payload (Mirai)", "value": "404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329640, "uuid": "b4978ed5-1e0f-467a-a952-3589222d3a2a", "comment": "Malware payload (Mirai)", "value": "1f1e0bc92fb6569dafd1507d5123e0332632beeb", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329640, "uuid": "f626e675-3295-44e9-ac6b-9caaa7a67d66", "comment": "Malware payload (Mirai)", "value": "cd54eb42d36f54e147e1d313dec0d634712e4d1da82f8a6fda0f0c63c8ac24b442bb7c98105150a4dce63c901c74efae", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329640, "uuid": "f4382479-d050-4dcc-af8b-0c2bc21ac2e0", "value": "T1EC762852F98B08F6E9031D3215BFA26F27311D064B24DBC7EA407F2AF97B5D52936209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329640, "uuid": "180c934c-2b3a-46e1-a5f2-f02781d38113", "value": "98304:TqzbMh9JqocHABOCLzUc7P2thQYVSnt7E1IDNp2XeyTjKPZO4YA+9d2o5tWBptqw:TIMzjeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782329640, "uuid": "0cba2466-80b5-4cd5-9c57-fa459ae157be", "value": 7143586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782329640, "uuid": "107b264c-63a2-4a34-b15c-6690fd94bfef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329640, "uuid": "907175fa-1704-4c21-a1b4-f7763595cb3d", "value": "bot_404df61a.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6deac39-6fa4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782288919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288919, "uuid": "38480077-a922-4186-a79e-b26137fa39ca", "comment": "Malware payload (WannaCry)", "value": "efe15b38d9da7770f3a382f754627cbf", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288919, "uuid": "7131597f-7ae3-4b49-9748-746d36ec9f9b", "comment": "Malware payload (WannaCry)", "value": "405eeccd5e87474bdb7422b85efac075000e203b7df0a535b6e3074c7c6d2eb0", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288919, "uuid": "b9296e70-4431-4b17-9ee0-1fc59e6232ae", "comment": "Malware payload (WannaCry)", "value": "7edfa72bbab7416c8a2b6d9e5e4abc20d0037486", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288919, "uuid": "2b0445ba-64bc-4805-82e7-dfa88001bfc1", "comment": "Malware payload (WannaCry)", "value": "df5bd4d9026deac14bbfc60760e57884d749d3db54ed29076c21db43c0ebffa2006a541fc5e749d43e2cf40933786a4f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288919, "uuid": "20e35ca0-18cb-47d0-b14f-e2af8b05a2d3", "value": "T16E26235A7179C5FCC106157884F79D23E2B3BCA662F95A0F8B404F7B1D23B49ABA0742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288919, "uuid": "a42f2530-4d37-4be6-ada9-a401d275d8d4", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288919, "uuid": "ec04c0ce-139b-43f2-9c0a-67f311740b7c", "value": "49152:jnRnFQqMSPbcBVQeK1INR9SqTdX1HkQo6SAARdhnv:D1eqPoBhK1aR9SUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782288919, "uuid": "842afe20-cde8-4b8b-be97-144ac2a932a2", "value": 4564992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782288919, "uuid": "0394baac-e718-4c58-b384-ee791c0a97fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288919, "uuid": "e3fb528d-8a44-4df7-9465-0ab6ae8a21cb", "value": "405eeccd5e87474bdb7422b85efac075000e203b7df0a535b6e3074c7c6d2eb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25eb598-6fe1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782315138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315138, "uuid": "9d2568be-540d-4e18-b048-94f9134d2492", "comment": "Malware payload", "value": "b5c59ba2e136ad8ebc57111564391adb", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315138, "uuid": "5c1a82f0-7f6f-4af3-a50a-da03855783fa", "comment": "Malware payload", "value": "40c8808c2837eb60f43ff9ea081fd516f555f33fcccd0b9bb65465aedc61e5b8", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315138, "uuid": "e8bb370f-65b6-43fc-bf2b-ce983b01c32c", "comment": "Malware payload", "value": "afdcd9e635cf37a3464d928cdb00a09a82ca103f", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315138, "uuid": "e4450720-9137-43fb-ae83-5c05e179c006", "comment": "Malware payload", "value": "73cd1f1f31a13c123bb99abe2e3a305fba5d1688d36b4ba741850fcb24bd4e2af9eb47a5f670023a8d895096a709509f", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782315138, "uuid": "5a3feda5-c607-4c0c-95ea-77b7f1e919a3", "value": "T118812B263991726C3B8EF554956D4D6993703AB3F0D095C8321FB0C19F57346C688FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782315138, "uuid": "ba724771-1dbe-46fb-b333-e31eed1b6181", "value": "96:fN+bY2cee519rErWGMTwVxvtS1NjYSoPbwNrWRpLEb4LyUPnfxf:fN+bY25MBQJgwntYtpvBCLEb4W89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782315138, "uuid": "2709373c-eaf8-46e8-a1ce-f87c9175a358", "value": 3869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782315138, "uuid": "7bc744cf-5290-4c2e-8cc3-7c95a8bb3197", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782315138, "uuid": "157d53e7-c718-4572-8975-c2923d7a5b2e", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4306e6cc-6fbf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782300267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300267, "uuid": "a57eaafa-1c53-4815-8796-959f60431db0", "comment": "Malware payload (Vidar)", "value": "1056d0afee214f439f0b8f9a94144cb6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300267, "uuid": "7c03514d-d415-4fe7-9024-f01fb21ec549", "comment": "Malware payload (Vidar)", "value": "4109c17426627535aa43650672e76150d73150bb5358222d01ac4af02f6aec9f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300267, "uuid": "d7f4044f-a467-4cb4-8214-0b23439cfb96", "comment": "Malware payload (Vidar)", "value": "2143eb651300fee9742ee3a7f74d7ae2918b1735", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300267, "uuid": "a82596e9-8271-4d11-a428-decacd0f47c3", "comment": "Malware payload (Vidar)", "value": "8551b8facfe600ab5eceef62fb0f2c489e9a0a65b3d305e8bbb67835c6cf63aced89b34a2ba1657b9037bc05e9f6e335", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300267, "uuid": "f47f4231-719e-460b-a4ef-e2237808b2a5", "value": "T1C0069D07AC904DA8C4D6773189B65291B73DB8081B3A67D32E60FAB53F367D16DB2B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300267, "uuid": "6b70e55e-ae6f-46c3-8630-e5b96bd41887", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300267, "uuid": "5839f265-3ffb-475d-b8e2-7517d223bb46", "value": "49152:BbDnqSAR+XKtHb378uz/r5QFtUovoz/4KnqpsTxt:BbmJ737rL9qy4KnY2xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782300267, "uuid": "ea786ea4-6638-4f33-9100-0c1e9bf20d91", "value": 3755152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782300267, "uuid": "50804930-c08d-414f-b297-c4cdbf0ec47b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300267, "uuid": "722f7122-a3bf-4af5-b172-3edb5b9e844c", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d143f1e1-6fce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782306949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306949, "uuid": "4958a972-9fa3-48f8-9a9a-b8d56e9c25b7", "comment": "Malware payload (SilentNet)", "value": "122705b0c0a3bb690f9118a215869f66", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306949, "uuid": "d8e9b087-3ca9-4d8d-b5c4-3088ef6abc4a", "comment": "Malware payload (SilentNet)", "value": "41dd1b52dec7b75d869af6ee6623c33a98d96ae7b285788a8014379c69076118", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306949, "uuid": "e723323a-ed3d-4756-a29e-97297bf67f27", "comment": "Malware payload (SilentNet)", "value": "cc1eefd0582fd4f2eae0a205f11831b6aafd8964", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306949, "uuid": "96fb1f51-b931-4b6a-9466-d8973c10a9f2", "comment": "Malware payload (SilentNet)", "value": "31f078f7bbd944f13f8a8f589aed56b3bf77fe1eeebf059c7d2637ee48f87aeb9fb03d88e03fcb812060d17d2e23cb7e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306949, "uuid": "2b48dbae-235b-4817-8616-d2bcd52ed5af", "value": "T1AA440213657C5B35DC0FAA72A653A462B47C65D0F80A301B46F0DC8A98839EF0F567EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306949, "uuid": "74e7415d-5003-48d9-9bb3-b66469dd0feb", "value": "6144:zbc8u2Mvh74CIYvlmqEIU4/Bd1MYBdbvRdSds:zA8u2MjIYvlmqVU6tRdYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306949, "uuid": "8fd77405-01a6-44f8-bb44-db5f59e6e6a9", "value": 267902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306949, "uuid": "e057810a-e22c-4f53-a9f3-472c3ba153de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306949, "uuid": "793fa236-06f8-41d3-a407-5f489fe6d599", "value": "calcium.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fd7f70-6fd9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782311553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311553, "uuid": "e53d561a-a47b-4363-90b8-e49d41654151", "comment": "Malware payload (MassLogger)", "value": "223d060f07c1b828627754aa399a8764", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311553, "uuid": "e9a9ca6e-a4da-4ab4-9b45-0337e28e042a", "comment": "Malware payload (MassLogger)", "value": "420b9bc8af5510f8e5a45d82f58676b51e41aa99ca9034513a63873d83d08142", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311553, "uuid": "2dc86f47-f13a-422c-81de-090bb7fdcbdb", "comment": "Malware payload (MassLogger)", "value": "de5e7b7194c1e981ce528540b24da136995e5e5e", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311553, "uuid": "fd75dfed-8133-4689-93c9-6fc4ab5f3d35", "comment": "Malware payload (MassLogger)", "value": "d1eff3d13e63e38948ae92893bffc44f2eb7840c4fa53e2f01909b48089b8cfbb581fec3c3e83b1a093e8f99481bd28c", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311553, "uuid": "fab07671-f364-45e9-8b58-d5bb23e57b68", "value": "T147850A3CADEA402A7273EE6A8ADC7497EA5FB763371E641A10D103464713942FEC163D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311553, "uuid": "9ba23fcc-db37-42ce-8506-6d43dc741537", "value": "12288:9S/UOsjxe/X0mgGq3FU/vvWg0be11prqbgJgvCRg/hNK77rgu832UQx7K50KJ7g1:9utvjYkEcy/wAdKF6SHMQ24dVoIl0WP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782311553, "uuid": "4fdb68f4-d96f-4808-8645-ba5f2fa99843", "value": 1846000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782311553, "uuid": "b027bf05-c2e3-4c0d-a37f-93d590a3f851", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311553, "uuid": "27ad2abb-a53e-4f04-b200-06b5cfda2029", "value": "MFESEK3180110RA - MFEQuotation Work request for NCSOCSO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b19f01-6f94-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782281913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281913, "uuid": "aef89653-cca1-4d67-8512-b886a92c32c3", "comment": "Malware payload (Mirai)", "value": "d80d6e3005f92c4724d1ff64987badb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281913, "uuid": "274f344a-e3ec-40e0-bca2-e9d7f05ea35c", "comment": "Malware payload (Mirai)", "value": "4357ce34cd58a25dcb21cfbd0dd87927672b84988e6cbe200a5cb499f8e8d28d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281913, "uuid": "1535aaaf-5a1c-4245-9461-782f02ebf86c", "comment": "Malware payload (Mirai)", "value": "0ab7917567e47362ac1f06ddca47721c5e5b66d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281913, "uuid": "ab55b0ae-3a07-4226-8c37-5db1b9bef92e", "comment": "Malware payload (Mirai)", "value": "d98240c0adf2521f0eaa6f9ec4a48bf9ea9c2b2fa0e3567ba216153b51469ee5db978f3aa9dcea3c0dd0f0634da02554", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281913, "uuid": "1f6c2abe-055e-41e5-b1d1-e73adcd22862", "value": "T11757CF7792067CEDE9B98DB4C41015816DA878874778E3C7BAC870E6A6EB6D08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281913, "uuid": "2cc06fa6-dd7a-4c38-b71e-54b99bfefd81", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQq:cqYUQuVDt0TZEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782281913, "uuid": "983fe3ea-757e-4020-b9f7-3c2c16dfaa44", "value": 29163520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782281913, "uuid": "6ed65b5e-7bda-40e8-ba36-d0acf470e486", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281913, "uuid": "afb58947-00bb-4c36-a84d-0793749f2833", "value": "4357ce34cd58a25dcb21cfbd0dd87927672b84988e6cbe200a5cb499f8e8d28d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a7ea87-6fa7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782289939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782289939, "uuid": "01d10903-e561-4491-b3ec-b24f7b7069b5", "comment": "Malware payload", "value": "9c4ecf10353b528170da200fa0944012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782289939, "uuid": "57bb9fb1-8b99-4f3a-aff1-24cd40149ecf", "comment": "Malware payload", "value": "460a21525472a9bfdfc9d82f10f8181cfedc1446ba6132cf4efb55b2d4a781dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782289939, "uuid": "a1107d94-0ed0-470e-a01c-5bea586becd9", "comment": "Malware payload", "value": "10e8c910c505077fd1a52917298277e768ddb376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782289939, "uuid": "289df402-9ada-4bfc-8b85-c953d1c79a1e", "comment": "Malware payload", "value": "b1c789415ca36fce38fd2df8f425eb313f72101580f1f92605a2f16b91144ba9952ed2ece1664aaa9fb7627f97ee9e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782289939, "uuid": "efa1cfee-9cf9-4f51-ac24-f5077ad79ca3", "value": "T1A2337D86F2A911F5D27A82F9C636091BD7B57C45231093CF13E085AA2F636E46D3F34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782289939, "uuid": "f99ea9a0-83b7-4e60-bf32-ca75e1b0dec5", "value": "ecaf782f9cf263271bc086ea2901c523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782289939, "uuid": "39ef8dbf-00b9-41be-93e2-58bb56e0e131", "value": "1536:gQUtxTtRs7vCeiSF4aVOTQeKhFzp5bXCYD:32ltRsD8CT5LPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782289939, "uuid": "a77e40a9-ffc2-4d68-9407-9f1211871680", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782289939, "uuid": "a510aae0-8db2-4405-9402-a46ef753123e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782289939, "uuid": "45bce287-a93f-4e30-8e70-7a65780a87cb", "value": "460a21525472a9bfdfc9d82f10f8181cfedc1446ba6132cf4efb55b2d4a781dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b085891-6fea-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782318857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318857, "uuid": "98258eb0-5abb-4f29-94b5-b5203560e7d4", "comment": "Malware payload", "value": "9a85f7bf647cec6c61a4c7fb33b87b34", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318857, "uuid": "e13f0c64-6b2e-4820-bbaa-1ed4d6d2daf6", "comment": "Malware payload", "value": "46e38f2839d615ab351b206b7571c1686f99f54470e48925ac62b2cf2d771adb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318857, "uuid": "d741e20b-87b9-41dc-a373-3a02c7b449ec", "comment": "Malware payload", "value": "e06f88056b9c0bf3c31bdc4b1a2414b5510f211a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318857, "uuid": "768fa9fc-1f77-4dd1-8c9e-1813682ce41a", "comment": "Malware payload", "value": "e26c80798f39ad17ec63eefd78e103a95ae9c4fad8a13016cf90ff5daf5ac7a0c0b6d36225d72869e5fbdc38ee978f21", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318857, "uuid": "5be1799b-06e8-41ac-b4b3-749bc91c8be2", "value": "T123D59D0A6CE449EAC8AA633189B652937B71FC0D0F3163D32E8076783F76AD14D76394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318857, "uuid": "8f76141a-1ebb-42f4-a61e-c40e31433060", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318857, "uuid": "5729c116-8001-4b81-9860-a488bb7cf22a", "value": "49152:C8dIWpBlIwDC6lg1oZuR1x1VdwBdsuCfFwuCzVK:C8mbnqwR7fqpPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782318857, "uuid": "0af8a0d0-a014-4d4d-9496-237c36c8463f", "value": 2993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782318857, "uuid": "f5f20139-d64f-412d-abc7-8c5a5ebc0610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318857, "uuid": "827c7107-bc0e-4868-bfa9-50064f38c73b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09253e23-7005-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782330235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330235, "uuid": "06fcaa6c-971b-4910-ab2b-2c58b8d6a21a", "comment": "Malware payload", "value": "dbf0f03147fd6077aeb202b68a5dc948", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330235, "uuid": "895a2f4b-76ee-451b-830a-8754dd6b2b4a", "comment": "Malware payload", "value": "4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330235, "uuid": "5f5a3d57-1ce0-4692-ab06-3bd3efd6ebce", "comment": "Malware payload", "value": "9b9bf391a24eee06b2268cc626ea0a71f0e39c02", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330235, "uuid": "7f8853c8-2a6e-4afb-9d43-ed8ebd8f3c51", "comment": "Malware payload", "value": "b630f53c5be26778f631fc43f861e5b6d21ccccf3f0ec6676d772223793b492555da575e6c7153921c083deb1e5d51e8", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330235, "uuid": "9da3356b-66f7-476b-a61e-39937d80f316", "value": "T1C1266C137348A03FE06B1A3A5C77D710593FB66029138E5FA7F48A5C8E763806E2E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330235, "uuid": "980ac3f1-1f66-4d00-aa25-27eaae05a1e1", "value": "278c5b3315d1bc544295d3240b704222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330235, "uuid": "79691090-037b-4169-b33f-398bb0132986", "value": "49152:HqJ8E8oLLASg5WbvKqegAitdBwQ+RyE/H5mKMQUzuoDFB:Hq63CSgAitdBwQ+RyhKMQSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782330235, "uuid": "25f35d4e-934f-4219-9951-f437636c941e", "value": 4781056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782330235, "uuid": "08d57c42-01dc-40c6-b555-b2a627c0dcde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330235, "uuid": "c5b9579a-db2d-4238-b4d2-09e6729f0465", "value": "4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70364105-6fc3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782302061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302061, "uuid": "cb75d245-ee61-4de5-9c2d-2b29391c9432", "comment": "Malware payload (SilentNet)", "value": "e96587cabb7e64e44c4e33e507e80d16", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302061, "uuid": "7aff0af3-780f-4cd2-bb10-d17a085e8ac6", "comment": "Malware payload (SilentNet)", "value": "47ec454e6fa0581fb81b200e09e75860ee88a2e63220f2acf16dfb2ecc52deb8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302061, "uuid": "c15b30b0-8a2f-4dda-a9ae-09d4fd11f33c", "comment": "Malware payload (SilentNet)", "value": "ede8b38247fb868486fc4b518ba052b7700dacaa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302061, "uuid": "1bab096e-ecc1-4923-93d6-7c5b7f0db546", "comment": "Malware payload (SilentNet)", "value": "388ece8982a5daed203838865549027841c64dc246d04ed530eb03f8978fd3b92cf6ae421d0894ad8ea84976faed4fcd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302061, "uuid": "df394ec3-806c-43a7-88c2-872f8f59ad1a", "value": "T157D63303FF297EBED13FB23750804FD2FA2C05D1C016616E37A1588E99C66A74B54A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302061, "uuid": "44d1af14-f8e2-46b6-b2f8-2b343275ef7f", "value": "393216:UvaDe2kSZV6sIWl8SPam58zrdecXmewRu7pr:0aBkSrIWlBP2vxmi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782302061, "uuid": "4bc31aef-e439-4327-84e6-6a77b22bb792", "value": 13746560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782302061, "uuid": "b0cf9bfc-46c8-4b18-a0d7-e6820cb4b001", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302061, "uuid": "2bd9e67f-6c0a-4f13-9598-1605af55a6a9", "value": "Wockyclient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72699bf3-6fc3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782302065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302065, "uuid": "81fb1e62-2c5c-49ce-bc9c-b19bc37e8bf1", "comment": "Malware payload (SilentNet)", "value": "e6cc16fefa4c8ad3ab03bcddf7ade415", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302065, "uuid": "d1d87c46-a576-4b0d-8083-d1876e018512", "comment": "Malware payload (SilentNet)", "value": "481a42819667e597007623f1840a692a0afce38a5fa7b32813da00a2d7757f29", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302065, "uuid": "03c57c5c-5a75-40c1-9fb1-4b9e50be6517", "comment": "Malware payload (SilentNet)", "value": "f8e87394fcaa21d9f3f047c33e62dd10d970aacd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302065, "uuid": "4b21bb79-b419-4011-b71a-10e63d9609e4", "comment": "Malware payload (SilentNet)", "value": "92244193fd468dbebc0e390af0514090b68d9e736a882c1a0d4ebcb5eea210e19acd751acf72c54d3048057f78018052", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302065, "uuid": "0ea5d9c9-e9c6-40d9-a91f-a31872e83115", "value": "T122B4F112E63C007EDE377336F906DA91BCA5D692E512B40A6A7C04CD098367B1F897DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302065, "uuid": "0aeeb99f-a3da-485f-ac38-4d20552fb231", "value": "12288:mRUr2dj4jFR0axG8jedr/I0+ILHOHbqCsD+5c:brC630uGCedrgXItCsD0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782302065, "uuid": "2065cd75-de4d-4f57-8bee-fb96bb298fd6", "value": 516277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782302065, "uuid": "f2ea27b0-76dc-41d2-a956-aee0fd5c773e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302065, "uuid": "cfe4643d-c80d-406f-ab9f-ae8549687bd6", "value": "UpdatedKelp.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe3e9d7-6f94-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782282002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282002, "uuid": "dfbfc0f4-a312-4140-aebc-b572f3019d51", "comment": "Malware payload (MassLogger)", "value": "91ab53b36c59644f4f39e96c04d69e5a", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282002, "uuid": "a76f45c4-9984-438e-8202-2d8874ceb639", "comment": "Malware payload (MassLogger)", "value": "4a52348c90a7f367ffc51a378523a079c5c114eeae12fa4a0e4eab841aefdf3c", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282002, "uuid": "44d1578b-8f6c-4f95-a23c-1ff341149bf2", "comment": "Malware payload (MassLogger)", "value": "4fda87f11a97a6e1e74c32c6497baebad21f9d1a", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282002, "uuid": "3344d082-8ada-4de4-ac14-c0150eea2fbb", "comment": "Malware payload (MassLogger)", "value": "175f5d70346765740e4adad5f114e2daa43be6db8b3df0b709de1c7661355db1d90d26f9cf51bbe632b3051b980451a4", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282002, "uuid": "0ab9da2e-98d8-4498-b6dc-877e6220ef57", "value": "T14A85F738ADEA403EF173EE598AD47D96E95FB663370E5859109103CA4733942EDC223E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282002, "uuid": "414df786-a4f1-42af-b776-8cf6e815626a", "value": "12288:LC3g7yWteM9j8XHd+AfgB2/8wMuclzzNgn7nZdC2Lgb0hFN55rttR6CTx3lE9uNr:G2WM1UH/x3D6iMsb1UM3Ps2buGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782282002, "uuid": "12a7862f-74c5-4a0b-91bc-551fcd789746", "value": 1805616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782282002, "uuid": "5926ddd4-e54c-4b30-af04-17b2288f6e88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282002, "uuid": "3bb305a7-bd73-48e4-82ae-b95e5a05cc10", "value": "orden de compras.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd709da4-6fde-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782313841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313841, "uuid": "64241539-1474-400d-a28f-4497af80ba6b", "comment": "Malware payload (RustyStealer)", "value": "cb980b731cd5dc476435750d758790bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313841, "uuid": "f36ccc45-3083-4276-aafc-ff1f080e38c0", "comment": "Malware payload (RustyStealer)", "value": "4c00b92ef3df4a61ebcb324afd3ea2ea42de162f5aaac2de84bd4bf73eef3982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313841, "uuid": "331651d9-0a56-44c6-bbbf-ce5739c9937c", "comment": "Malware payload (RustyStealer)", "value": "514bb78c4156b6beafc111d1617876c9a4e37fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313841, "uuid": "0ab2882d-a845-44f2-9077-1f648ec69865", "comment": "Malware payload (RustyStealer)", "value": "02e23b7d1a6ffd57ef3f5ffb42582989f8b7e8f095834ed174cd19e87338986e98e6fe9f609826b6b13f9c9b4ca8f9a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313841, "uuid": "39bc66ec-e6fa-44a5-8468-aa3bb7043527", "value": "T19247BFB876047DE6E66F577BDA96ADDC03B626338A8BA4CD406477C30963375FE02804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313841, "uuid": "6ef480e7-dc83-4adc-9f09-f92c185c5199", "value": "b65d5558061a171b1b78f5ee14b587b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313841, "uuid": "5cc82ef2-7b73-4da3-acf1-4d9272a2e835", "value": "24576:UyLFbRR1395n8bJsjYZqUAg0X0qsyoF7aHwQbIsppQEqj0gEdO1QCOVU3DpzKxd5:UoRVbnJSqUAzXrtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782313841, "uuid": "d33369ef-7e35-45a4-9dd6-5b3ab56d861f", "value": 24751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782313841, "uuid": "39d94273-e0a0-4e53-8ab5-ca76d11e0cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313841, "uuid": "8902a7e6-540a-4a10-8cee-bd2248bbd32b", "value": "\u76ee\u5f55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50db7c4-6fe4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782316431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782316431, "uuid": "5c102159-f008-4fdf-8449-c5cd76536e1b", "comment": "Malware payload (WannaCry)", "value": "abff406810ad2584ad14c68092983e9c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782316431, "uuid": "1b58e2db-1167-41d3-a4ab-4255368ebf01", "comment": "Malware payload (WannaCry)", "value": "4c0aad4c85da91d98dfd73d58f1d2cfb5bff74a8464115f8107751905f75ca03", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782316431, "uuid": "ef53d0f5-9843-44b9-b401-419005ebc652", "comment": "Malware payload (WannaCry)", "value": "dabcf014369a7f5017192e2a538358889ee850f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782316431, "uuid": "6f3de125-ee0b-4282-94f2-6c218f29c923", "comment": "Malware payload (WannaCry)", "value": "c9484a5dc022fb5cdf09afb489316e1cc2c887570fd6227792b6d675e352ff9bffc77ab807c3116e9fc8fc2a4e96d1d1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782316431, "uuid": "1a43b673-2a8f-452d-92fe-5612a6865165", "value": "T16136339A71BC81F8D205297484AB8E03F2B27C6A25FA6A0FDF4049752D53F56F790B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782316431, "uuid": "a4a33eb1-6537-4cee-ab7c-79a3ff579562", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782316431, "uuid": "ca9d9467-db12-4aad-9874-a76983bf6215", "value": "49152:RnOMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1OPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782316431, "uuid": "8885df12-84c2-45c5-a68a-b5df0317b7cb", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782316431, "uuid": "cbf5f222-0077-4c1a-9e3b-380d616a3eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782316431, "uuid": "9d3ef970-d883-469d-82f7-d261f51cb5f6", "value": "4c0aad4c85da91d98dfd73d58f1d2cfb5bff74a8464115f8107751905f75ca03.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a0ee67-6fc3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782301909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301909, "uuid": "4db38a6e-4e3a-49f3-8b9d-db5b5d034fbd", "comment": "Malware payload", "value": "8ae3eee8343d39619194e3b9db5ca9ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301909, "uuid": "43de4e82-4653-49e2-8e4f-97ffb328d422", "comment": "Malware payload", "value": "4d8138b2b181851ad74a5cb4f636bb58f1903c21db5236c7ebd6c61856770be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301909, "uuid": "ec7fe122-8c06-4276-ae40-0a480dfaa818", "comment": "Malware payload", "value": "53d28d504b6dae22fc3d2d909f02dd63d75b271e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301909, "uuid": "3296168f-0f22-4e41-99bb-9151254f5964", "comment": "Malware payload", "value": "a8443e9954fbf769a3d17d0ba4b6832a1539b8890e1012f65856fa8be62a2561a081ae4bcadfe521aec608b5b243a882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301909, "uuid": "a196162f-f3be-4c24-a7b9-41a3c7193761", "value": "T186577CD5F38816A8F116CB37C7419232D2B3B4570763AC8B0A99F6051E769939B3AF13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301909, "uuid": "48c39a40-4930-4c09-adac-703a10b3453a", "value": "9032cb35e0fbf561851a78bc86c51570", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301909, "uuid": "9fb13a35-bdbc-4bf3-9b26-bc51a7ffa387", "value": "24576:/JrPegNSaSLQub6Iyftmd6OSG/sbeVDq6hhsYR6g8PQTUcR0xgqAfA8GLZx:/JrPBSKIz6bG/QeYYR6g8PQTUuqypGNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782301909, "uuid": "0cd60eb7-1474-4bfe-a4f4-5a8d104816dd", "value": 28956160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782301909, "uuid": "b14e4f08-ec7b-4dd2-a6c0-02f4d935c796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301909, "uuid": "6a3c2c9d-49ce-4c49-80c5-ffeae18d0e8f", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61aef05-700a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782332700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332700, "uuid": "86a1d6af-125e-48e7-8032-f5f8db0428da", "comment": "Malware payload", "value": "022ae64057a8d6817c056537a33eb90a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332700, "uuid": "f85dbe2c-b564-4cf1-a853-b74cba610c35", "comment": "Malware payload", "value": "4d970ab8897787064a00c021896b429d2ee7d60cc1c3e3af34448c3692abb342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332700, "uuid": "863aafc7-28d9-42c5-8733-ecf633f49c59", "comment": "Malware payload", "value": "76909747fdd79f8592e1a2d0b2db545937ba8d75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332700, "uuid": "a3d1c5d6-9dc7-4af3-88bd-62492c23dbc7", "comment": "Malware payload", "value": "f55065e15367235ad738f8234aa22e6015fb39650ed97414c625e2a4d9f3824ac844fdb951f8208f14817c3821296307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332700, "uuid": "16e50c66-2619-4581-a482-21ded4127872", "value": "T1D6735A0678E2CA56C6D673BABA1E818C331113F4C2DB3603CD15AF797BC695A0E7B584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332700, "uuid": "fd7365ab-e5d3-4fa3-bf85-a46caec819c0", "value": "1536:5eypyAPWGDtvUQ3sjJg+SbGyGVVouH0Mutple/iRetsIF/atJbI7:5eypyAPWIj3+g+SChouUHple6ZIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782332700, "uuid": "925d4b1f-49a5-4e8e-9f1c-8335f1ffda01", "value": 74892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782332700, "uuid": "4da001b2-df45-4f5b-9148-d5e88a3a1686", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332700, "uuid": "54e71972-6495-44e2-a594-e69bedc1950b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f719f3-6f67-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1782262420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262420, "uuid": "f921f73e-47c6-4f15-a795-f28b77186245", "comment": "Malware payload (DarkTortilla)", "value": "4f5f377bf5f732ce5d389f98ad5829f9", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262420, "uuid": "ec1d60b5-b8d8-41be-8bf7-be92a11a8b43", "comment": "Malware payload (DarkTortilla)", "value": "4db8eb346541d4b4d9931c431eecc9034cd574317b61b058e9969ca538e1ebd5", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262420, "uuid": "6d0620b5-788b-47e8-b645-d9eec37a05e0", "comment": "Malware payload (DarkTortilla)", "value": "2e160a4a609cb19d4b35280fb4e83eeba05e72b5", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262420, "uuid": "8ae535f6-927e-48cb-b0b9-72935ee994ca", "comment": "Malware payload (DarkTortilla)", "value": "7019012a057e5cc2a84597e4777b1a2cb93a52a3e03ac88d217802aabd5ef682d16a319d3817c242d7d560839bf0cfbc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262420, "uuid": "5e0f9adc-d402-4062-b79b-8c346b78e7a5", "value": "T18B35026507E89324D5BEAB3DD1B8051047F2BE079A23E76E529497FD1E21792BA03333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262420, "uuid": "13aaab8b-ef94-44a5-bc5a-2ba52c21822a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262420, "uuid": "dd7b751b-ad4b-4c7d-a0bf-efdba700e66a", "value": "24576:RS+uWmtlObdkjbHoBLnOTmmYMmKjX0ZF:ECmmbdkj7eLnGmVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782262420, "uuid": "022a24ab-426b-4167-b853-1ac6c4c38c7e", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782262420, "uuid": "aabfee70-05e1-4c8d-b4ab-8daa3b8aa106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262420, "uuid": "7394a665-343b-4ddd-a374-a70132f44e54", "value": "New Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4c776f-6ff5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782323501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323501, "uuid": "a9c38209-8ac6-4767-8386-abeb7ec34f5c", "comment": "Malware payload", "value": "95baeb9033c86d4b8270f8a190a18283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323501, "uuid": "9b0d8ea8-98fa-4911-96cd-cbdf7c4bf345", "comment": "Malware payload", "value": "4ede67d8728623fad8c9a6af242693aa8e97160d9040a9c0c64c0d9dc6916a79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323501, "uuid": "6ef30870-50cc-4291-9228-55c42b8c59fb", "comment": "Malware payload", "value": "c3d4aadf9a5dbfa1b8e1a511f2bf709c83e7d86f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323501, "uuid": "060cff15-f1aa-430f-85f4-bd32c90d8afc", "comment": "Malware payload", "value": "3ac7c57b4467ef12afd5ae006a6f9630c3a889f618ad81d0b6b72185ed3dc837fe1545d0f23b0cca030c109f7c4bebf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782323501, "uuid": "e9d48362-0ccf-47fe-86c5-18d017a982b4", "value": "T13327339DB3F204FAD8E9413AA1E686926BD674E643B4C7C72FE108934E172E5DE34740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782323501, "uuid": "0269c95f-04e4-4017-964c-c7fa7e91c98b", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782323501, "uuid": "2d05f251-31b6-4ff7-b722-5e9f77908bae", "value": "393216:hY9udZVYtKXpW8uEBYFxVHFFL0M91+TtIiFRCuARuA3dS9QVdyKJdt9XEEWr3XEA:xcYW8dYFrHFFL0S1QtIcCuAHsMdyKNdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782323501, "uuid": "954cea66-68c6-4990-a018-a83701b49e2d", "value": 20906782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782323501, "uuid": "8b23054d-5510-4084-bd1e-72eb3c259e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782323501, "uuid": "b493fa5b-33e0-4444-b787-4b40b71dd89e", "value": "TgWsProxy_windows8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a621e6a5-6f99-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Sliver)", "timestamp": 1782284113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782284113, "uuid": "b5ddeae4-4830-4779-80e9-4c947a5bc94e", "comment": "Malware payload (Sliver)", "value": "598868ba67630605a9550b6448c80557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782284113, "uuid": "559ab0ff-a31d-4468-900e-4cd53c79059e", "comment": "Malware payload (Sliver)", "value": "4f26769eb38c2af04e725ee84ed49a3640f4de9d3983af49fbe46844b4de866c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782284113, "uuid": "778a91f9-5e7a-4ffd-a08c-467062208c5c", "comment": "Malware payload (Sliver)", "value": "a5b985980d58257c9f1cdde88369e91269d8da9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782284113, "uuid": "bfd56e7a-fd28-43f2-a947-915a8e179577", "comment": "Malware payload (Sliver)", "value": "e8c7fe961351fed27b92cef1cb5b38e160c624a6145854556079f36c8447f17afe45aa57c552b2b6e58eacc79680b0d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782284113, "uuid": "06af4816-b0a8-4bb5-90ce-07ca8423c4b2", "value": "T15D873A87F8E21DA4D4F9C571D165816BBA723C291B3823EB0690F7301F3ABD06A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782284113, "uuid": "5a9c5ce8-ebbe-4007-bff6-44a0d3383480", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782284113, "uuid": "72eb5aa0-cc05-400b-a555-503fdcdb0d35", "value": "196608:khxYiScanqN2iNlUrK0KnDkI+e8RnfkcIWMCZ/2W5o/ZHtdAPM:kucaC9lUriDEe8RfJIPj/ZHtdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782284113, "uuid": "35dada11-707b-4b30-b0da-db0b02d2d2e8", "value": 37583872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782284113, "uuid": "6d5077a7-674c-46e6-bcf0-cc73732418b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782284113, "uuid": "4b3fd5fe-ba56-4633-bda1-5ae06b995041", "value": "598868ba67630605a9550b6448c80557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deea274-6fde-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782313493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313493, "uuid": "62ce65c9-62ab-4a79-9b74-4a9c1075961d", "comment": "Malware payload (Mirai)", "value": "7d711ae790fa17abea4e23960fb98573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313493, "uuid": "4558aaf9-9009-44a0-a0bb-35360a524d6f", "comment": "Malware payload (Mirai)", "value": "506aad99500a0a06e74d460d41b2fff709580be95427ef0bc8b2365d768f95a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313493, "uuid": "116fd544-4433-4e97-b09c-d77ec2828b5f", "comment": "Malware payload (Mirai)", "value": "679c8cb0ea0b546dc9c305a58f57bb632c9e64da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313493, "uuid": "4a32ac05-540f-488a-8e7b-279547b993ef", "comment": "Malware payload (Mirai)", "value": "f0e21bcb03f6ff46cf33ff4b40675eddf4aa6c02639ba76673ecbd94a6d525a3f63643b2f08153cf489af4a5138ae32a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313493, "uuid": "cbb0f2bb-b29f-469e-9418-7c8b6eaf4bbf", "value": "T1A8945B52F2A22CFDD912C934825D6223E63874494312ADFB27C8DB753D16AD0AF3EB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313493, "uuid": "1e2dcfe9-2caa-4325-bd63-55e3eba5f32e", "value": "6144:HAVtfzNuKUe2vSI+9Q8xasZKj+skmzmFXDLtKBa6+jN0b/NE8LO3lXeQTHOMYHFb:HitYKUe0V+skmC1pW+jeLLO3xjpaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782313493, "uuid": "002878ee-5310-4a65-a1b7-a6918ccca193", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782313493, "uuid": "fbc7a5e3-6349-4c17-b2a9-15cf7a7ec04a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313493, "uuid": "5e2808d7-7e55-4e83-8fcf-51d0265fe0e2", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71607369-6fc3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782302063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302063, "uuid": "df3fb7ed-25f7-4d1c-b3aa-82b5346e55b3", "comment": "Malware payload (SilentNet)", "value": "c7471bdd6875b24ad8dd1d92ba9dfc6f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302063, "uuid": "8695ec9f-cef3-4da0-bb18-9ca487d8f0d3", "comment": "Malware payload (SilentNet)", "value": "50f898fa2cb00eb10f40e2b116c4d6e2f75e66d6de8c036d4f4ab708566d0ad6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302063, "uuid": "91eadd90-a570-451c-aa74-2fa91b9a682e", "comment": "Malware payload (SilentNet)", "value": "7af5d5f77bee9ac32ec5e224ea5f0cccf3c996ab", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302063, "uuid": "7e2ba825-0cc7-4bd4-b341-1e1dc5dc6456", "comment": "Malware payload (SilentNet)", "value": "a732aeb012c6e7121401e505d82e86b064d3a00f95157fef5ee8a641c037fbd22a86e31285a0ede0b223ee693ac9dab8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302063, "uuid": "fde1f04c-677f-41c6-9145-db37c3aeacec", "value": "T1533533EB7EC8C6358E76DD78E16DE021AE447E868B49CC54187CF72ECA050C78F29952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302063, "uuid": "3451da3e-3a70-4233-94a2-479ef8075a27", "value": "24576:mt++T7GT6bRZKqosQ4+Yt4pkycvW58FQkSj/RBy+wLH0/z80m94d:mL7JKq24Zapk3su+jZBy+wz0/w5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782302063, "uuid": "14e198e2-d2e0-43f2-be49-de45a6828ef0", "value": 1138892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782302063, "uuid": "bafec9c0-6cc0-47e6-96b3-d98cb3347992", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302063, "uuid": "b2855bfb-48fa-4623-bc5a-7e7cc5fe139b", "value": "Prestige-1.21.x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d3379b-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322661, "uuid": "e7f7989d-3500-49ff-8daf-d1059ba887a9", "comment": "Malware payload", "value": "f5b5999f313411405c810a221b08bbdd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322661, "uuid": "9b5eb8cf-c818-4b6c-90ed-9bde5ce6d8b9", "comment": "Malware payload", "value": "51e5372028f8a61922bcbc94f90fd1285e6895a4a7dffc93447b4bc6b17d045c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322661, "uuid": "91f66e78-af55-4c2b-afff-c82b296cf519", "comment": "Malware payload", "value": "33a00db45ca16cde19259a3fddc6c77b15c2015d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322661, "uuid": "23cb2909-d48d-4bd9-88f5-2bb5fb93813b", "comment": "Malware payload", "value": "61206043e2bcf3e28ef982cce4294c7e92880b4b3a961993447f2215a461592b864677a57c1f3ab287e838d6d22b7b74", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322661, "uuid": "17c38683-5c1d-431e-b2ea-8d0ff1229150", "value": "T19AE62342B7461518E5F38B324A36225567334CF34B23A3477AF27DBCAC72BD09B91A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322661, "uuid": "3378bd71-1a52-42bf-96e3-8ff001a64f8f", "value": "393216:GNt9gxgWbLJps9U93Rnee71LJHxWCP3/8SMRYAb:C2qWbLJplliMq7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322661, "uuid": "4ea9e7f9-f5de-4127-a9b4-d5661900b004", "value": 14403926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322661, "uuid": "2ce01ed4-c06d-49d2-b359-2772c9f2fef9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322661, "uuid": "b0262db0-e4c6-4ef0-a05d-502dc98ab958", "value": "atsiv.lance.app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a919644f-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322772, "uuid": "076626e0-d0b9-4c21-a00f-e3940850fbe4", "comment": "Malware payload", "value": "efd7f9f160e59667463a0553f0178331", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322772, "uuid": "8fec0797-258f-4037-b34e-0a1b481d0df5", "comment": "Malware payload", "value": "527dfcb599a8700cb6ee1e875ef2ee64fbd95d1d7a5dbd35e9093b266e53243e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322772, "uuid": "a184a592-e348-45a5-97b4-d8633907ce9f", "comment": "Malware payload", "value": "60335f1888cd9b0817e05a6c09648cda37b8e4e3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322772, "uuid": "70f40a4c-be10-406a-929a-c0064ec00442", "comment": "Malware payload", "value": "58da9bc7fc3e61062f5d62fc8f12910d565f6168b543b5a0f4577f0058b4c81d79bd434af76f224c8902fdc95baad977", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322772, "uuid": "e86d291e-bc5a-45bf-aad8-117f7a9e040d", "value": "T1B5E62342B7424519E8F78A334B33629123365CB38B5353477EB17DBCAC726E4EB81998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322772, "uuid": "2a616a3c-5b21-444a-9e43-6aa6709fcf9e", "value": "393216:dSCGi0VmgK6YFvcYBdoJcxLfSo0e6aJR9:dSCGiVgK6i3oJqLfSI6aJR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322772, "uuid": "8c79ce76-af6c-4a39-8b36-32d15380c216", "value": 14335509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322772, "uuid": "25c9f7e4-c187-4d04-902a-eb8485c59a00", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322772, "uuid": "a0595cd4-37df-4c6f-a415-3a8a9ab642e2", "value": "nors.tv.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a93edf-6fab-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782291677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782291677, "uuid": "3a880e46-98a4-4f83-b906-f62a4e741cbe", "comment": "Malware payload", "value": "ebd6a46d259a1e067f75a1b0ae87a236", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782291677, "uuid": "1bf7a58e-e626-44c9-9467-93259d8dd1e0", "comment": "Malware payload", "value": "530ec88c5da09375f53ee51cabedbc06a44495d1af22558a4c8083c8d26d00ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782291677, "uuid": "08427513-a33b-4fde-b938-a0469c9dbe19", "comment": "Malware payload", "value": "ee820c363c79fe2b3c8af0a322c2ca05a50643df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782291677, "uuid": "d871dcd6-dd4b-46b9-ad41-1aec770919f4", "comment": "Malware payload", "value": "99e39f93f5d3f81da484ba181dbe0305e11bc167c63223c8f68112e5a71f355a0259b9435f96e885181f0039797c1be7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782291677, "uuid": "f08dc433-17b3-4ddf-ab7b-fbd378a69891", "value": "T14016F833A59445E4C2EED574C6256213BEE0389B273423DB7BD0A6E10B76FD49AB8370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782291677, "uuid": "2309f654-7e97-481a-8361-ae0bef84af86", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQh:cqYUQuVDt0TZEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782291677, "uuid": "3fa70daf-bf33-4f89-bcc3-261822e68d93", "value": 4128768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782291677, "uuid": "abef18f9-e7a0-41f1-a4da-1d3d64be59be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782291677, "uuid": "8283a052-b29a-4c0a-9a63-f0ef7e24ba9f", "value": "530ec88c5da09375f53ee51cabedbc06a44495d1af22558a4c8083c8d26d00ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1faf4d4-7003-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782329632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329632, "uuid": "e2bfa180-9855-45aa-ad02-cb27376e5d25", "comment": "Malware payload", "value": "b58e52acef8ca9cbf30e997b9449b5cd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329632, "uuid": "c8ff7463-d46b-4a23-924b-b36cb88eab1f", "comment": "Malware payload", "value": "533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329632, "uuid": "3fae94ec-a474-4a5d-a149-8903478c41e1", "comment": "Malware payload", "value": "fdd819056ccac60bd44d8e084acdd4883a9a964f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329632, "uuid": "08db291b-82b8-4c47-b622-4884a4039f80", "comment": "Malware payload", "value": "e5d1505c1cd4149ddf72531dbdb5e52adf538d680550e4373b7396756d81e1f46aca569c1cad7aabc31a1af757948fc8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329632, "uuid": "045b3eb3-b07d-4a71-8ab7-f278480888e0", "value": "T146137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329632, "uuid": "ab3da1ff-2560-4836-809f-6d7d31a10d2f", "value": "768:z+A9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:z+9co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782329632, "uuid": "85af6ac7-426f-4497-b106-385edecdc6d7", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782329632, "uuid": "29d1d025-8e70-4335-a6f8-d8d4a8c52d89", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329632, "uuid": "f56bb31d-b717-4f89-8fb7-655f920d30d8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d3bed5-6f7e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1782272387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272387, "uuid": "dd5a912c-f180-4f03-832e-6692d5adf00e", "comment": "Malware payload (Joker)", "value": "56dccb2e418f5525eafc08dbe8982dd2", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272387, "uuid": "05e661dc-e11b-4f66-88fc-9f311ac6f832", "comment": "Malware payload (Joker)", "value": "53ec3546057bc6eaffc0403fed417b9a3aecf31482456aacc1c6ef8f64449963", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272387, "uuid": "3e5b9574-b221-41ff-96c5-04ecadd84ea9", "comment": "Malware payload (Joker)", "value": "deafd0def7abf9b445090dc9f6fb011212026cb9", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272387, "uuid": "5e10b37f-546c-4def-92dc-7970e35b7e30", "comment": "Malware payload (Joker)", "value": "5f450a76a7e576a41f41bb04d26af6b5d3d197b3b0f7dd950dd10dcee116aaf41b117cb5e7cf8ba517d9f52a48251d51", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272387, "uuid": "1df8e466-bbfa-40f2-99ad-97e26e2c2f76", "value": "T1CA86129AF71CE03FDDB72832497A13225357240689939B83A914951CBDAB6CC5F2EFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272387, "uuid": "15cd5edf-44a2-4b34-a5fe-47e1a38d41c4", "value": "196608:pgqczMTy5QY3zWgh1Z6V8LFAWQEvwY8yiNS4SxN7EFF:pgvzMEvfLaRg2y8S7bgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782272387, "uuid": "16dd6648-fceb-4711-b815-b7977b49886a", "value": 8074113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782272387, "uuid": "a3de07c6-fc70-4d4d-ab15-fa75808dc87b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272387, "uuid": "f67c908b-0cab-4c40-b63b-b55a2ef5f2b5", "value": "com.placevt.junkcleaner_3.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d30dd5-6f94-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782281888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281888, "uuid": "116cd9d6-c1f2-4382-a81e-ed39d382150f", "comment": "Malware payload (RemcosRAT)", "value": "19424bb6e469ba51066fef87b93f55ba", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281888, "uuid": "d408950f-f536-4b95-a491-6e5a7eed1ef9", "comment": "Malware payload (RemcosRAT)", "value": "558eee1d844abe408ba89a5df01ad8bf9807158f4a4885ad13cb75d4a226da48", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281888, "uuid": "3d3cac67-b34f-4058-8ff2-8cc19096983a", "comment": "Malware payload (RemcosRAT)", "value": "82e5e2b5f19792ee1db5f9b62e20b5b351d5d429", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281888, "uuid": "b7753286-1869-449f-abe2-3565e142b666", "comment": "Malware payload (RemcosRAT)", "value": "3021496653d0398db116eb332b4c29ee20da807a5b85d54e077dbd16359705dd9f4413fcb940c7bc8501390f9a111633", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281888, "uuid": "596f7a7b-d63c-4c21-883f-1ffe8b5dc278", "value": "T189434C71D999066A4D9B27ADFC911F55C9BCC609162304E9FEE9030D601F8ACB3BE61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281888, "uuid": "d10c35dc-90b0-4982-9f6f-1810167856e9", "value": "768:qGPYIQMNI89csGFhTLHa4cDt0m4TWxgQ5i/5mE3plAZgUB6SH9qQ8xuJO5GvSXV6:Wjz3AP4qpi/RplAuiqmSXQfe9OpJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782281888, "uuid": "df8bf6f8-f766-47ed-a8c1-110e5a32c3d6", "value": 55617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782281888, "uuid": "d80d934e-f7d2-47ea-9b86-3fcdaf0b4074", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281888, "uuid": "4f4d29b0-98d2-457a-b369-c7dff064d180", "value": "2026 Leave_Vacation_RE-Schedule.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c851f82-6fcf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782307075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307075, "uuid": "0c7c2b16-bc1e-4961-96c5-d1da0aa52531", "comment": "Malware payload (Mirai)", "value": "454ca9c489b865814ddf447cbe94b830", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307075, "uuid": "32f8df6b-403e-46cb-8de7-6d0858733098", "comment": "Malware payload (Mirai)", "value": "58de7cadc2c6898d40a86af3bdd90c66704ad841aa5f34d84e32be5508e2fdfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307075, "uuid": "513072d1-5132-45e5-bad8-6e6de9fb3704", "comment": "Malware payload (Mirai)", "value": "086fb807e99c329645be0afe0fdff8aaa2c3d19e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307075, "uuid": "1ca39da8-3d4a-476c-b4fd-b9ea4aa970be", "comment": "Malware payload (Mirai)", "value": "3a469d812b234087f0cbb78bba5fe471aeed4d6f832c7dd7f2537b28ce334b8288796c1ad4838067b6e24483422f0364", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307075, "uuid": "e84a102d-244f-421f-a790-dbef7cbb3a99", "value": "T1D5E309567D418F13C5C325F6FB9E42983B136BB9D7EA3102ED246FA1238B89A0F27511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307075, "uuid": "c510bcd4-1aa6-4dba-a2d9-3eb72915bab5", "value": "3072:eN285ackZmRW3x3jfbSvu4yUW8K5KCdiBt15bm8uFyu:XnjZ+W3x3jfAXyUxBCdin1E8uFyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782307075, "uuid": "18aa7eba-f2bd-4d23-a4e0-a58d0d1b01fd", "value": 146144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782307075, "uuid": "d1c9c8c4-50c8-4197-ace2-5303884fac7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307075, "uuid": "48b59450-1123-487b-b1f6-b3cbe3b0ec8f", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9a62d4-6ffd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782326996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326996, "uuid": "51881006-2922-42ae-91fd-44c7048c56fa", "comment": "Malware payload (Mirai)", "value": "b1b40bdc199977d96c9cc0013a32e53c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326996, "uuid": "ddf51f8c-ce18-46bb-93b4-b60121dd963e", "comment": "Malware payload (Mirai)", "value": "5913021291f2e43955ccf5a4dd9b0daf462fc378b60dbc02b26271bf700939a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326996, "uuid": "531ed27e-0e5e-4863-96da-b7bcf1c62357", "comment": "Malware payload (Mirai)", "value": "508b8e22ac56f9135d66db4fbb09d7c9b3e245ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326996, "uuid": "d9101c8e-5455-47f4-9137-2fbae994fd75", "comment": "Malware payload (Mirai)", "value": "0fdf80c191f414ead34790e080bd154580ecda30a00086f991c89bbd1adf5ef9025df8e364a7f9e3623258bf437ebeb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326996, "uuid": "7eac4ebc-fb50-419c-a9c1-f3fcf1332319", "value": "T12F733903758180FCD488C1740A3FA536E5A2B57E23356E5937E8FF267B4BA242E2D664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326996, "uuid": "7867fd9b-235e-4bf9-96a9-25333f3d376e", "value": "1536:iyp2vv2HD9eunps9Uvv6PSPb6ad0GkIbHJ:iAheKXvOSmaiIbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782326996, "uuid": "70d1c9c0-aea6-48e5-b112-16d65242526c", "value": 75136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782326996, "uuid": "c724e587-9887-42bc-832b-15ac2ff5c966", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326996, "uuid": "faf73223-6c74-463d-b935-6d3550a5d9a3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab36d83-6fc1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782301247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301247, "uuid": "fa4569b6-696a-4841-ab25-c62a56b88e54", "comment": "Malware payload", "value": "b7e18d1ffbf5f1bb913f7f9c3356335a", "object_relation": "md5", "Tag": [ { "name": "brillende", "colour": "#C59696", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fakegiftcard", "colour": "#295C1E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301247, "uuid": "36caf9bb-428b-4c68-bcd5-6afc33dc24da", "comment": "Malware payload", "value": "5ccc6fc748ddaec5fb8cae462eb2537d8bb294beaa28b1109ffb4752e7beb246", "object_relation": "sha256", "Tag": [ { "name": "brillende", "colour": "#C59696", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fakegiftcard", "colour": "#295C1E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301247, "uuid": "bb205a49-10dc-4313-9b23-91fce8c183ea", "comment": "Malware payload", "value": "f5fc18132ebd0e1af781897d0db4222de009c2e6", "object_relation": "sha1", "Tag": [ { "name": "brillende", "colour": "#C59696", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fakegiftcard", "colour": "#295C1E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301247, "uuid": "cd3b470e-e916-4533-8fcd-a97fdb828e75", "comment": "Malware payload", "value": "24dbbc7a07d97a122ac3ae68e4a9c6f544c65c4569100229ec3ff73a18ec9f713264f21d03d042d791c95bdff9eb2ee8", "object_relation": "sha3-384", "Tag": [ { "name": "brillende", "colour": "#C59696", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fakegiftcard", "colour": "#295C1E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301247, "uuid": "b91916fe-302d-4e61-a9f5-97da06c0cb54", "value": "T1F1F5CEA30384076AA3E4CFE580943117A4F9D56B3D3521A9BBC366D7FC2BC5A5878B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301247, "uuid": "dce66210-42da-4f29-9a0f-086323a5362c", "value": "1536:zk50qPOaGgT72QuhcJ/McDJaVhc0/PDZZ3NLt5rYn/zaC82AsgkIS0apW8oqOVRg:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782301247, "uuid": "91f2aedc-5f98-4559-8353-e775a3144b6f", "value": 3566014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782301247, "uuid": "610f084d-888a-4d88-affd-d45718ea2e3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301247, "uuid": "60463d4e-7503-4fe7-8e58-1effc846faa4", "value": "Gutschein_Zertifikat12174.pfd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd2699e-6fac-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782292420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292420, "uuid": "55237640-54bd-4ce8-b1dd-1a509fac8c49", "comment": "Malware payload", "value": "e782b28efa45e2b2785f6e49f1eb4611", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292420, "uuid": "2df99311-13f7-44f2-b162-1e328a58b81f", "comment": "Malware payload", "value": "5d5f8482e76e920e57fae0cb21dfbd77af08fa54b2102157936bb2aad6e41cae", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292420, "uuid": "2e2419db-714d-436b-9c54-a726601c3a51", "comment": "Malware payload", "value": "9320e6e96645df250b33e34691cb49513048ce0e", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292420, "uuid": "beac8fb2-8501-49cc-9309-ff1e0d0bf76e", "comment": "Malware payload", "value": "7a1f1cddc41250e0c856eef52da086a5bbc2b085a1647d73b649b7fa2ad0e8b8d1bf5d61de10071d536a35240276ff78", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782292420, "uuid": "b88df81d-82cd-462e-88e3-ab865f41066c", "value": "T1F7F6CA8FF36E00ADDA792FE1FD12789114DBF7A42496014C46D8AC6EF652805F0BCB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782292420, "uuid": "30615c2a-8d9b-40ed-9513-abc8254980f1", "value": "384:cfb0J1L68rlZikSPbw85kaGlk+W85EJ+UBaYM38eGcr5Zyc7tIHy8up1gEYPkbVK:DtQWG3XPTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782292420, "uuid": "14a25216-6d99-482e-8d4c-7dccb98b5c2c", "value": 15477252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782292420, "uuid": "add22cc5-2ac7-4f57-8323-7a877191ed8b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782292420, "uuid": "279a0b08-cfef-43b0-ae3b-961b4dbe2294", "value": "RE0039092-0300290-00390 Rechnung DE0039002-R.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53dea652-6ff8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782324777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324777, "uuid": "38724b2e-d29e-4244-8006-5d200814f90b", "comment": "Malware payload", "value": "fec3116699e7df05e94699da9ccd153a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Dogerat", "colour": "#37700D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324777, "uuid": "f3871da9-5e44-49af-a51e-188fa18997e4", "comment": "Malware payload", "value": "5df2b81fbb3c441259eb797cf9df2311e8d7cfe89be820cfcbbde8f4f8609a23", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Dogerat", "colour": "#37700D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324777, "uuid": "a2280413-aaa8-408f-9ab9-885328a206c4", "comment": "Malware payload", "value": "fa751e39341e597d87120b363e5eee95c905b4a6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Dogerat", "colour": "#37700D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324777, "uuid": "6ddc173c-8d88-4033-b0e9-244833731bd6", "comment": "Malware payload", "value": "49034bc5c971be307ce06e041c25950125323b138ba172236546d105beb2f6e5d509768357c6b8a30a07a0ed0a3cdfb5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Dogerat", "colour": "#37700D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324777, "uuid": "69e8bedf-68ac-40cf-a4d9-d7b24bbd704e", "value": "T17BB61257F7445A1AC477907218AE1331224B0D4ACA439B877A1C771C3BB7AE81F9ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324777, "uuid": "535f282e-61ef-48a2-bfbf-3b3adb7aad89", "value": "196608:kiHSBZABRBSt+6XwKVmDiXnf4WNE7UDaTODMSeVMo1omLiKarrZiksNg2mpp:tWqBmtXXP7XnfIoDaTODMSGWCCrZwNA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782324777, "uuid": "ed992ec0-952b-499a-83cb-4515d5161689", "value": 10919793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782324777, "uuid": "1fa6ea24-40d4-4812-b3ef-a6249ef597b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324777, "uuid": "95aceefe-0cf1-4ef3-9089-011c3997d228", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8cd581-6fce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782306941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306941, "uuid": "280c8cb8-cc14-425b-88f5-59cf8a3bf0cf", "comment": "Malware payload (SilentNet)", "value": "c5f116397327e73504e6302398cbd3d2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306941, "uuid": "3b2093da-518a-499d-92d6-127a1b564b60", "comment": "Malware payload (SilentNet)", "value": "5ec88f4f1370ea51e5ba462d318381a819896a6815d433b9c59ad990af6e9f75", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306941, "uuid": "bfa17380-45db-47db-be40-046871a272f9", "comment": "Malware payload (SilentNet)", "value": "085842786b0b9663d8f719f417db82eb58ee0ae7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306941, "uuid": "ccbc2549-03c0-4646-b95e-3480451f4cab", "comment": "Malware payload (SilentNet)", "value": "8969e4c3ef6565966262370fbbc8901ee7080d8b9ca3377dc81f6b9ddfdec35806064229540276375bac10311de28057", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306941, "uuid": "c03da026-297b-4ab3-b7d1-7562525085f0", "value": "T1B3952353A7DCE035DD2BB3B4E953CB136CA81AE4D00361962AB946D95906BBC4F0B31E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306941, "uuid": "89b0422a-2be2-4151-a38a-acd0c5d95671", "value": "49152:qxFrg8t/JWzH0pNuPGSWYNjW9k/dM2476:EMIhWzH0pNuPDWYJW9kA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306941, "uuid": "cf74832b-5b5e-4a39-9bc6-397ee70c8179", "value": 1937551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306941, "uuid": "aee172fb-a105-4390-aabe-c92b58b54de5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306941, "uuid": "7e99c23f-6622-4b4c-aea4-640094771609", "value": "RadonClient-.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c952ee-6f83-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782274521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782274521, "uuid": "4ea223af-bdb8-481d-88b6-4f5bd5105aa7", "comment": "Malware payload (WannaCry)", "value": "7fb6b9dd2161f01c58080049750fd143", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782274521, "uuid": "41d269ba-0f5e-44ba-b4ec-99c7e4b35f9c", "comment": "Malware payload (WannaCry)", "value": "608371b1c6e84d844d1d07642e404c4d7083567f766ca3055dcb0780c23d016d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782274521, "uuid": "8155cd3e-04c3-4e65-84f6-d3d7a9121b32", "comment": "Malware payload (WannaCry)", "value": "cc91b5e01b25e38514188ca559c105f1ba74018e", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782274521, "uuid": "ada727ba-6e38-4b36-bb32-7b0280b7e6d3", "comment": "Malware payload (WannaCry)", "value": "1f0079fa88f2ed2cbc237ef869fbf64ab0fc7830647fe2400f96b29cd77acd273698f84c540b688d1ada8c151a6aeab2", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782274521, "uuid": "1a9db439-c82d-4499-bb3f-4c4028285cf4", "value": "T1EB36121861F41278F27357B658EBDE13E671B857A5218E4F0752028A0C23F62DE96F3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782274521, "uuid": "8168ddbe-2429-4c9b-a12b-b2d3fa4548f2", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782274521, "uuid": "e1aca7bf-a942-4d2a-96db-ecff6e087fe4", "value": "49152:jn2nAQqMSPbcBVQej/1INRx+TSqTdVyAH1plAH:DyDqPoBhz1aRxcSU7yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782274521, "uuid": "ddcf9468-feec-40d3-a9a0-c65e7f6ee423", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782274521, "uuid": "d07563a2-0088-44bf-9e86-2511e8012bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782274521, "uuid": "c6052b1f-8762-4887-a59e-a39703e95eb9", "value": "608371b1c6e84d844d1d07642e404c4d7083567f766ca3055dcb0780c23d016d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c284697b-6fc6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782303488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303488, "uuid": "1a5899fa-42a1-4fb5-90dc-03ae5e17fee2", "comment": "Malware payload (Vidar)", "value": "6af7483ce34362221e539cf6be1af2ff", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303488, "uuid": "929472d1-3b18-46a1-848e-1041b4995f2f", "comment": "Malware payload (Vidar)", "value": "6196e32f242f6737966a8a0b67013bfeda5d4628c58f83e329c6fb40bfac396d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303488, "uuid": "45f14056-82bc-42b5-b84c-81b1af97d446", "comment": "Malware payload (Vidar)", "value": "312dd9b554387affa0e88894527cd85fe3be12cd", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303488, "uuid": "729bf1da-cdff-45cf-8c36-f51c802be835", "comment": "Malware payload (Vidar)", "value": "9f4d27114cb71f5e70322d5d23ee75b0c7585b67ed47baa9d9b8ccfc562c4f44e9ba043e8976ac2970aad198d6726d01", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303488, "uuid": "28fb30d1-0bd6-440c-8684-249ddeda38dd", "value": "T12CD59D076CE049E9D8AA93B18C7251927B34B8400B3577D72E90BB382F76BD19C77789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303488, "uuid": "58deb61b-9f26-4100-9ee9-6e8dd9e2756f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303488, "uuid": "38a2cb8f-7ded-4194-a355-448494e58646", "value": "49152:G+6I9H0mvRZeFlfoPrP+dMqqHEbAz7PUO4Er:G+nVTPyd0p/PxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782303488, "uuid": "3980ccd1-f022-4f1d-b327-8aaef503d943", "value": 2989056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782303488, "uuid": "0d10f8cb-889b-4d7e-b9f1-df5a1909240a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303488, "uuid": "a1b53d01-4237-464f-810d-7cc6cb95136c", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5a6ddb-6fda-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782311903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311903, "uuid": "088a5cb3-f2de-49d6-a8b4-766c2223ef77", "comment": "Malware payload (Mirai)", "value": "ea0a591cad19a1c4a423ae0db021c6b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311903, "uuid": "6bf2dfe9-9607-4101-b3a0-c755ef84201c", "comment": "Malware payload (Mirai)", "value": "639dfee62c369c13077da24b31452d2e7278ed3249e5f0a93a8712a2c702a934", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311903, "uuid": "1094bf8d-9caa-4757-8963-207807faf063", "comment": "Malware payload (Mirai)", "value": "0cb58cf2eb6c6f20b832918fe5b3d852a4c9f4ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311903, "uuid": "e6fc8318-a40c-45a4-b437-05eb975f837c", "comment": "Malware payload (Mirai)", "value": "16f64ab8f1fc15c9eb1419a0e66f96d3e1a739ef0f50987ec5026a1975e0f8e0861349d01b743d601970a377ef481be7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311903, "uuid": "8da9952c-cb92-446a-a938-3670b6a07e50", "value": "T1ED01B8A7E86350F3E68544371FAEB56C40A320374332D959330C3C248E7BA817D62B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311903, "uuid": "c5712ba2-f5a0-4cc8-8f3f-d7d00065950c", "value": "12:4sSmFXalGz5yNN3+0oo+0BOt0Q1F0f2ez5tGfasvWN/srLV8VHTQQ3FseXf:4sJXalGz5GlfogB7Q1Gf2ez+SsvWVsHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782311903, "uuid": "8a35437b-859d-400a-9cf6-334ac892d074", "value": 707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782311903, "uuid": "756718f7-b704-43c6-a878-5842d4e61643", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311903, "uuid": "3e5d4ace-cb02-4029-96be-05518267b7c4", "value": "639dfee62c369c13077da24b31452d2e7278ed3249e5f0a93a8712a2c702a934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b033ae89-6fd1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782308182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782308182, "uuid": "ff7c7439-323b-4d6b-9782-40ef38f97abe", "comment": "Malware payload (Prometei)", "value": "3fdcffdf7cacae8528aad63d9613378c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782308182, "uuid": "e9af3ab6-d957-4a87-9750-74b58d3f3c73", "comment": "Malware payload (Prometei)", "value": "6488e4d17e55e59962d21bdea4596169a17a29865ec43b14b6c163852d71a0fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782308182, "uuid": "40920e7b-ab9f-4695-bf9f-8951a56ddb88", "comment": "Malware payload (Prometei)", "value": "a98d1eabe1e7ce207d315f9e074956f911586013", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782308182, "uuid": "6d7b932d-16e6-44cc-a116-90db2323f19a", "comment": "Malware payload (Prometei)", "value": "22957bd7e30e5eb64bf3b57b9605ead9bf3191cf96e2b586ef1867fbc9760c90a8248bc049558604c65a163cdd652cd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782308182, "uuid": "5914ef8d-11f4-4a39-9ce2-725f81beb08a", "value": "T148A423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782308182, "uuid": "c5e46cdd-2c25-4923-9e0d-5c140484a68f", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdN:Fs6pyCC/Ya2hpi6T6N4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782308182, "uuid": "4016d34e-ec1e-4f42-9086-bd5d82a94c7a", "value": 449054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782308182, "uuid": "78faf84c-3fb1-470c-b13c-500962da88be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782308182, "uuid": "3c09c29a-da1d-4598-ade1-e2861eb86f36", "value": "6488e4d17e55e59962d21bdea4596169a17a29865ec43b14b6c163852d71a0fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e3ed97-6fd9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782311580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311580, "uuid": "3665c013-7129-4fc0-88cb-cc6a31330fe1", "comment": "Malware payload (WannaCry)", "value": "22fd61e52893c9aec35545c81067f2a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311580, "uuid": "c8620ca0-cd04-4a49-a149-a4f00f0f8259", "comment": "Malware payload (WannaCry)", "value": "66ddd0edb16bfb041ccfa78e41af074bdf2f9b23eda55e45b54d29eabb1200d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311580, "uuid": "c84b42c9-99f1-4909-9ade-cf01ef4960cf", "comment": "Malware payload (WannaCry)", "value": "d465606dc17e7daa070f79d5ceb27b288a5698d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311580, "uuid": "4ce49112-77af-4459-875e-9f167537292f", "comment": "Malware payload (WannaCry)", "value": "28ba4b613c7da36ab1ef4eaae4a51d582f15852cabff8a4fcb8db114887a0eaae80b253180e7504632f6fb7e92828280", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311580, "uuid": "daf5b41b-81a1-4db2-9cab-b72f8ec72315", "value": "T16536021AF6E8D1B5D91D32B085A6421873363CA542D2438FE7046E7B7E77B049E33E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311580, "uuid": "c62af810-b62b-4649-b5d4-7ac9578de88c", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311580, "uuid": "00badda3-3880-4bcb-b27a-04261b00e970", "value": "49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvntuwP:d8qPoBhz1aRxcSUDk36SAEdhvnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782311580, "uuid": "ebc6e94a-f282-4663-9c8f-2ca393c193e4", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782311580, "uuid": "79051e20-5514-40e1-a402-ec9992672af5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311580, "uuid": "7f8503b5-883d-4fec-b4f2-2a95b842db87", "value": "66ddd0edb16bfb041ccfa78e41af074bdf2f9b23eda55e45b54d29eabb1200d4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda31c9e-7005-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782330592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330592, "uuid": "28b9b04b-05fd-4325-899e-36fdc4f681a8", "comment": "Malware payload (Mirai)", "value": "913a3fabec8a0fc69cb9d705d0d4f521", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330592, "uuid": "605bbd87-b474-4fcb-a900-20b1cc3ea147", "comment": "Malware payload (Mirai)", "value": "68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330592, "uuid": "dd30671a-2a77-4059-987f-589b0d71546a", "comment": "Malware payload (Mirai)", "value": "5bcc7b477409a390125791ac9fffe9a71c4c0422", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330592, "uuid": "1896074b-cd3b-4a54-88cc-e6a4a0cf3a74", "comment": "Malware payload (Mirai)", "value": "bd2467f83393d0a57bf8bf8dda8d38764618db689e5ef35e3713cd40d889df08ef4f337b4dbea87c1bd9f46eb178d50f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330592, "uuid": "8037b9de-80eb-4474-be4e-80a91b1ceefe", "value": "T18DB34A5BAA9D3EDBC2C2873E9E966A701117F47D8F0383721F11528DAE9FA8DDD90044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330592, "uuid": "c828ce6e-5f33-4c8b-90fa-c93ece359331", "value": "1536:SCB06qowuZnUAl3yQxQPFNSNSCJyEQ/o/r5w82jtbmpDWWO07KSw9VF2uL:hm6qh9Ny8YT5mj5zFj9VFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782330592, "uuid": "620cd9b9-f27b-423c-b136-72713dc17dde", "value": 113696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782330592, "uuid": "c0729407-5b4a-4b0b-a84c-33f904fe6804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330592, "uuid": "513ea6ca-df6b-433c-8010-0324ad2dbd7a", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f49ea0-6fe3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782315714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315714, "uuid": "cd6b2465-a6f9-4922-b532-8505f69c5153", "comment": "Malware payload (Mirai)", "value": "55394b6c605b2a0c619bb5f74318efc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315714, "uuid": "4548af0e-fac1-48b8-ae95-e6db97acde55", "comment": "Malware payload (Mirai)", "value": "6939688e913de7ada49ec441e397590df499b06791f7764a4fbc3ed56543987c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315714, "uuid": "eb76bd5f-9fe3-4f00-aeec-4c72e7eec976", "comment": "Malware payload (Mirai)", "value": "e94c38fa0cc30031320b809f2e560462b74b8aba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315714, "uuid": "9ad3017d-cadb-4463-b5fa-9f5d68216dca", "comment": "Malware payload (Mirai)", "value": "6ab753fd46b1f5bfd532f88431f65d4008a260247902beeaeb8ee140530a0317d618a2716412cf733b40710213336760", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782315714, "uuid": "a4eec3d3-6507-4cdd-a30b-1544cdc308d6", "value": "T18904980A6F228F7EF369877057F78E30976977D61AE1D680E16CD5001E6028E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782315714, "uuid": "47c60670-c23b-4851-a273-dbd85a99f9f9", "value": "3072:fn5vpaQ9ct99BAiAcxDqqfwYbQpXscQ3vnWaYQFx+ihPp:P5vpf9895vXfwYMgfnWaXzFhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782315714, "uuid": "42fb0168-d175-4d23-b8e3-aa2c3dd20703", "value": 183132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782315714, "uuid": "ac5f43db-e3f0-4a98-aca3-5ad483faff65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782315714, "uuid": "269dedb9-885c-4771-aa18-0f1c7737a877", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98944f9-6fb5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782296252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296252, "uuid": "d95ae966-3e77-4fb3-ac73-5946344900d0", "comment": "Malware payload (Formbook)", "value": "e2e001f0896a74144a4fb0bbabe8e672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296252, "uuid": "2f27a10d-efa0-49a9-8156-2785a47b5d0b", "comment": "Malware payload (Formbook)", "value": "69642cd14966d9ab7e824fa28c3f06b00c18a3d6de683d3754e41b5424d4f750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296252, "uuid": "010dbba1-c538-4bb3-928c-8c61237a4c6d", "comment": "Malware payload (Formbook)", "value": "68b5904aeae8503ce30dc89dd38dfeba13d4ebde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296252, "uuid": "d9ffe23e-37fd-4d03-8051-77b029529230", "comment": "Malware payload (Formbook)", "value": "d644fbca29ae7e9c7527a33f98ea8bcd85eda15196668dd2dfdc89e1ca0ff406cb98c7aa3267fd96ddf8629699890a73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296252, "uuid": "7752f015-942b-4f93-9138-b75f63f05b7a", "value": "T15F350184331DDA12D49A8BB51831E2F807B46D54B951E3078FFDBEEB7936B192D18283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296252, "uuid": "df24c145-9704-4c8e-b177-8c0e50716ba6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296252, "uuid": "43c05070-5557-430d-aa85-ccdfeef9cd89", "value": "24576:LMp3hytuoYaWVw00Q25jWLDglUpj5Kzfj86vqF+8fx:ruowVEQK8co8zjHSF+8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782296252, "uuid": "c084c5dd-6ce5-4280-9bdd-976f539e247f", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782296252, "uuid": "938b1dfd-2fae-4a81-815b-de5ccbf6425e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296252, "uuid": "2274356e-db86-40b5-8684-b916565f96ad", "value": "Supplier Evaluation Form-Hilteks.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f16935-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322710, "uuid": "6798ac1e-c6aa-4cc7-acc9-67a9550d13c2", "comment": "Malware payload", "value": "6206e485622a984e9add4c03fae33363", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322710, "uuid": "40cc69e5-9fb1-426d-ab44-92b06b622a68", "comment": "Malware payload", "value": "69fb412d697c8788d8d864be990714b7320dd69f1dd6397dab7e3eb34c1ace25", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322710, "uuid": "8680b3d5-33ea-45e6-ae88-9afee0704af7", "comment": "Malware payload", "value": "3621cbbce90e28b27effc2804c7e9f318bf19fe2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322710, "uuid": "abab86e7-18b4-4ad4-b576-cd3195646200", "comment": "Malware payload", "value": "db03c65ec62ad3ad5d202a87bdfc603e82149405f1e7261cba656ab68dd2464049ca52ad61aa985a0c697f9f50119244", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322710, "uuid": "1b73dab6-5125-4512-8057-d767258adb69", "value": "T1D9C60247FB048A56C0F783F2593757A026670EA68B4397C76960397D3C736D06E8AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322710, "uuid": "ab2fc824-be9d-47bf-89ee-9ae53362f112", "value": "196608:YZZSOZN+vDgJh6tG0+rdTg04pjecZoQJPYQle3Xbpod2LH7H6mN5lFU8jZyswgJM:2ZCG0+20oeBQV7leHbpo+HTNnqIyHgib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322710, "uuid": "de0f6be3-efad-4145-b18a-40bc80e4b974", "value": 12259056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322710, "uuid": "6df4e334-cdc6-4b3a-bf90-0591573bbc17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322710, "uuid": "4d9c80fa-36b8-479e-927a-9b63f89303fd", "value": "kraps.semag.ygrenes.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923c4dc0-6f94-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782281932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281932, "uuid": "9df0db08-1eb9-4f8e-bec9-1436c38bb11d", "comment": "Malware payload (Formbook)", "value": "0c10a1c86e6035f0cae905545e53f577", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281932, "uuid": "cba180dd-a5b2-45cf-a4ea-5b83b282a891", "comment": "Malware payload (Formbook)", "value": "6ad2118a59a80e57fd618000c194362a34042e2ea4efd2eda5936360419df35e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281932, "uuid": "0daf41f7-d7cd-45ac-9555-db975a8872ba", "comment": "Malware payload (Formbook)", "value": "4ae86d62113dc0b8a1c808efe10e4ea5edac896f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281932, "uuid": "4e682241-cff7-4c52-882f-a6e078cfb2dd", "comment": "Malware payload (Formbook)", "value": "d6f5dc23ca872ec50d4adaa721625531ee0855f63bc0643741db08e9b2ece76681f47ea5aa403fdbe5e2eb725c0e209e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281932, "uuid": "b64a7953-da0d-4898-a5e8-cddda7d2bbe7", "value": "T13463524263D1B88C13F75FBA3B2F74E5F4AA089E6D448807F244FAE4E4A5515EED0A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281932, "uuid": "17163a42-b7de-4e2f-a2d3-4a391fc4558f", "value": "1536:DwpVgfmiDgY/zzy0o2WExDYWZSMTtGrG6E:DwpWOiDgOu0oKtqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782281932, "uuid": "ddbd750e-d712-4b1b-887a-332bb1578e15", "value": 72090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782281932, "uuid": "da85ca3f-b201-4c80-b2ec-96fa7183684a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281932, "uuid": "d272f8c7-8217-4268-b903-1ff6da57da5b", "value": "Makluman Tawaran Baru Dibuka oleh JABATAN PENGURUSAN SISA PEPEJAL & KESIHATAN PERSEKITARAN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4753855-6fc9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782304833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304833, "uuid": "44eb547a-61d3-4228-9892-07fdcd1eb6a6", "comment": "Malware payload", "value": "e9c9c45456a5e3429ecdf3a621ee9260", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304833, "uuid": "229ee087-1779-48d1-ba92-68ea4aaa8389", "comment": "Malware payload", "value": "6e87157051e31528627d600f310e0b7252f85fcaf9607b34e5a4156b2d14cdec", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304833, "uuid": "fde49e5d-b0b4-4b22-9453-eb3165f87426", "comment": "Malware payload", "value": "d8f7ce8458df71ae5dcb2470d3700d4b94160f29", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304833, "uuid": "cf9faf42-525b-4518-af05-4856198645f6", "comment": "Malware payload", "value": "0e4fe722827b742f0adf59e64f49238c320ca5ae943426094e7411be52663d0d7fd0e045a07d71af8b8214c5d4b20df5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304833, "uuid": "42ebc6f2-8338-40d9-885c-616531e13489", "value": "T106662391EF41DA2FC477803709464732A266DD2EC692970388EC762D6C7BAD84FD9EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304833, "uuid": "d9cffe50-bb6a-4d50-bf97-8103e5d52465", "value": "98304:1xGRsdXBnbgeTQIe70ORfAWZaBpwnYwo7z6xVd7RkP/j0stDl9kArrRN:b+iblcIE1AWgB+Y36xVd7O3762RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782304833, "uuid": "a1117e2e-37c4-4934-824a-bf43890ac217", "value": 6536182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782304833, "uuid": "30805079-6e61-4c55-a854-60d6fbcf2174", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304833, "uuid": "154da6de-2365-4142-9099-dc50ad986af9", "value": "T!kT0k181781778809254.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e858f91-6f7f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1782272853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272853, "uuid": "c8d4bc38-5f4f-437a-b33e-92be972392a2", "comment": "Malware payload (Joker)", "value": "cb6a75a2d338ca7825aee04daf112360", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272853, "uuid": "c52795c7-c51f-498c-9476-49014b3e62e7", "comment": "Malware payload (Joker)", "value": "72a6442a7c3ba07ea66f46472ac79a35b39a9d6311337eaffecd1eaa61aed3cf", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272853, "uuid": "2623cff6-8f91-4af8-9fef-45aa07a7c084", "comment": "Malware payload (Joker)", "value": "d506e4e0e67bdbd0eade26082872b7750b35b6dd", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272853, "uuid": "43ca8741-a174-41f9-8a74-e453f59d855b", "comment": "Malware payload (Joker)", "value": "584baf1a949f52f928885998413b13d65426510ce3516acd046997b6a8d31b27bd64bc4dc2875a94b2e25c3ffc608af3", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272853, "uuid": "d43543b5-a51e-4611-9bb5-02670e5ab421", "value": "T1D5C6120EE70DD43ADEC5B53879290693361A6CD816A1C3AA1C21F614BFF36DC9B25BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272853, "uuid": "8d886e0a-5b7a-4fe3-b45d-efa0411cb65a", "value": "196608:dpJLj/xbQCf10J6j5yCHPIsaGEx6hChHbCeOsBarUJz1eX7G8aEx9:dpx/df10EHPI7XCAwpXazQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782272853, "uuid": "3a3418fc-89b4-4bd2-a3a6-ffce2e3e0127", "value": 11992776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782272853, "uuid": "a7839295-f601-4ab2-95f2-fb3b639e5158", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272853, "uuid": "48c19183-3149-478d-8996-e5ef27c048fc", "value": "Storage+Junk+Clean_1.2.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5aba52-7010-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782335076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335076, "uuid": "9b72da13-8ad9-4e91-bbfb-f10c38f13287", "comment": "Malware payload", "value": "90eac76c66312a53a00774a796c3038b", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335076, "uuid": "0eabc368-b33d-4fea-88f8-40cf01bf60c7", "comment": "Malware payload", "value": "72d80252032723c3b7f9c04be3fcdf69e96dad41cd8b7968266b296643357316", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335076, "uuid": "0d9388e6-0c0b-4968-8ba7-fdf81bae5b1d", "comment": "Malware payload", "value": "18d2aec50aace75a08802583b9811f3e5320727a", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335076, "uuid": "f282d9ec-5e6c-4400-b7c7-b9ea827a98b0", "comment": "Malware payload", "value": "a5a4db1042ad8065141c27dc63e60e180da4a53444759879bafbb88dfffa7d838cc20317f7028e6fb52550ae3b11199d", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782335076, "uuid": "28a7ecfe-922a-43c9-b860-0d6b0fbfa7a2", "value": "T15F8302379C4FCE1EE8174E79671864F7BB7F2893148A10767F939D4EC6325A02606136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782335076, "uuid": "12544667-90d1-424a-a838-d5e1e563c979", "value": "1536:wc7ZhnrtTSqboNZwofgy0vnE2zCnV+5GwWLshE/ndeQ0mwui1J:wOVtTnMzwofgyunfz8VSjAshEVeQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782335076, "uuid": "487de76d-4ca7-42e7-a3ed-d79a18e0ebcc", "value": 87543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782335076, "uuid": "84ff82ab-2e9c-4942-9ea6-f2cb4c46f1f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782335076, "uuid": "abca16d7-da94-4d6c-acb4-78f60523866a", "value": "PrestigeClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a00710-7009-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782332273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332273, "uuid": "b305151d-bd4c-45a1-a4e6-6597ba2cf14f", "comment": "Malware payload (Mirai)", "value": "8a52c5bf8708c587b15ea35218e5c6bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332273, "uuid": "657f4864-2496-4ff3-b4b0-f48db231ced5", "comment": "Malware payload (Mirai)", "value": "73c99c65a819726ba3e1d68ed2ec58b941a705c393c05934ff351575bbf74940", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332273, "uuid": "69bbb2f6-f0cf-4418-b745-031c6ae51290", "comment": "Malware payload (Mirai)", "value": "d796fd38c246bb50812952d05d68cb60acfb2b8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332273, "uuid": "d6f6b71f-9244-4554-8925-bb1048eb1282", "comment": "Malware payload (Mirai)", "value": "41580f58fae4092d9bd3dfcbf0136cfc92e0df239c830d75a693a25ef91506ed36a89dca9ed71d4830e2ab061744a057", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332273, "uuid": "ea2fcd5b-71d4-4239-abdd-ff630a0f4a50", "value": "T10C734A4678E2CA56C6D573BABA1E818C331213F4D2DB3603CD05AF797BC695A0E7B484", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332273, "uuid": "096a0fc5-1abf-40f5-a55a-23dd6467c8e0", "value": "1536:F94GpCAZX+Fg/H1VE6YcMM3H5JVAIVb3XhCPutZj5H+Ka+RdtsWFNd4D:X4GpCAZXrd66tMQZzlb3XkCZj5HJ6W94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782332273, "uuid": "405c9ed2-0cb4-468f-9021-c0423128cbe6", "value": 74892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782332273, "uuid": "64609d3b-f159-48ee-b75e-0a6b6e2ea6ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332273, "uuid": "b02aba94-e222-43ee-b5fd-2b520ca530d0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b2d93b-6f71-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782267004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782267004, "uuid": "72ede52f-1521-4690-903b-9def3ca08d35", "comment": "Malware payload (NanoCore)", "value": "d92ecbd69ae37ca0ac56a79b9c0521c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782267004, "uuid": "9b3ad22a-5dce-4498-8653-a88c13a5916d", "comment": "Malware payload (NanoCore)", "value": "752faadcef0c8a53370583cddec408b88b0922655e260d424763ce00f08b91d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782267004, "uuid": "06ab75aa-e5dc-4147-ad6e-fb3273901605", "comment": "Malware payload (NanoCore)", "value": "5caecdcb05e70f0e314f74577403a8092847298b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782267004, "uuid": "57921f2c-4096-4e84-9e2f-34f7099855e5", "comment": "Malware payload (NanoCore)", "value": "a4501937b9a3563ecf39553cdb377de45008050810bef01f03d40e98542ea651cee42e02c118ffe04ad7594370a2bf70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782267004, "uuid": "07f5d8d0-b964-4796-93e3-25a6186a013d", "value": "T15C14D0563BA84A2FE2DE8579712212139379C2E3E8C3F3DE28E451B64F567E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782267004, "uuid": "f3f51fe0-3c26-4935-9230-7280b0c873cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782267004, "uuid": "1bc063e3-f6f0-457b-ae17-5d8efe1d35c8", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HILmsC6wwBLsjAIZnB/nFgMbszL:sLV6Bta6dtJmakIM5r+LsjAcW/zhIRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782267004, "uuid": "5002f445-accb-410e-821c-091527343399", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782267004, "uuid": "6bb0261b-764f-4c5e-a600-d4f32af4f540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782267004, "uuid": "2d305e84-8a83-4514-a8e5-e5a0c902208a", "value": "mhsra.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fe9dbf-6f61-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782259979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259979, "uuid": "7df4743d-53ab-4218-ac72-376aa92e8a68", "comment": "Malware payload", "value": "a08ca6495ae6d2ded6d8733bb34e0892", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259979, "uuid": "0ec1c40b-2ab5-4aad-96a2-3cb2a12895f2", "comment": "Malware payload", "value": "76ffbf5212a8157868af8191045876b74c1640dec4fec22d27fe28b797a2b97d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259979, "uuid": "72554394-607a-4d6c-ac45-bfc490bdecca", "comment": "Malware payload", "value": "bfd9c7c2ce3db1b4fec518ac2a29b92a1a64e32f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259979, "uuid": "89730241-8733-4e3c-9a53-722fd4c37f82", "comment": "Malware payload", "value": "135fbecfaf86c91efaf61f851b0c125392877c0a36a72b06193b70d14e950ce783ff700e233d6177aacf802ca814e4aa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259979, "uuid": "5564b844-c06c-443f-850d-9b3926273c0f", "value": "T171D097B3217302F822A12839F0C6A880B4058B7E6C83C62CBB0324317F01348F0C13D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259979, "uuid": "a74ee494-42a5-4cf3-a3f6-d48eeaf67c8e", "value": "6:hTed8sbGPbvT2oSuImwTwAulNXYq9DG+NjVsNXYrkJ:Ved8sbK7+mw0Piq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782259979, "uuid": "9bdcecbd-c547-4020-8cf6-a1a14e0add19", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782259979, "uuid": "ce7800a5-297e-4f45-a615-20a11467a6e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259979, "uuid": "ca826e34-f1b1-4ee9-9b43-7f840fca7053", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72ec394-6fcd-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782306475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306475, "uuid": "b8aa9df9-e758-4f43-93b5-600f153a41ef", "comment": "Malware payload", "value": "be1d3de2515e605459d0ddf4836c1ccf", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306475, "uuid": "84f5fcfa-9469-48ea-ac1b-a9e0e06fd69a", "comment": "Malware payload", "value": "77525609cbcf835b65d7a895d7f7213248874307df2b9e237e456b5dca291893", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306475, "uuid": "5ccbbaed-7f6d-4ce1-b331-cc6d7d6a8494", "comment": "Malware payload", "value": "70ae2e10f9079c6eefe90ec86e66932fb9a863af", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306475, "uuid": "05f4250e-f1f9-4e6a-98d7-34accfb5a524", "comment": "Malware payload", "value": "735e5db0305b9baa661e0bd1f1e760a37611e2c0b0d04682f72823e844834112ca8df1842917108133aec384225fd5a3", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306475, "uuid": "7e2ce790-4ca3-4264-af80-f08a63d3ec95", "value": "T1F624CDE6AF0A0F7513F5D8A752E881918E9188E4FE7E8706F4CFC851584C895F2936CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306475, "uuid": "cf9d523b-9920-4301-8a9e-9fc371c20474", "value": "1536:myUjMuNliNPJPnIl6K3CxDTev+24Qki0vJ4Ls4KfyqyhkevDFw:dUjLlq1LTe22IvkHWyttv5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306475, "uuid": "cebd0ea9-7f46-4918-b064-def5955bdda4", "value": 210655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306475, "uuid": "704fce45-5a29-4ee9-bc1f-ce661f1741c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306475, "uuid": "658d2ea8-6dec-4655-9a61-2ce7ab82a007", "value": "fort", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a181abde-6fe5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782316747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782316747, "uuid": "5ab455a6-a2f3-4205-b517-216fd34328f6", "comment": "Malware payload", "value": "4d5c13508b6d314cd4ebe6fd56c6ebab", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782316747, "uuid": "81bc0b21-03bc-4a7c-becf-ddd3b4da570f", "comment": "Malware payload", "value": "78b5873bcee5d9d117dc77b9fce12d4571818cc56eadb30d21b5d4b93a31c78e", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782316747, "uuid": "8608141a-26b2-461f-94ca-8b421200addb", "comment": "Malware payload", "value": "02edf727ab3fec513cc53d66a8cd25f214f7f898", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782316747, "uuid": "53646b2e-ddff-40d7-bcc8-a25adc3eb336", "comment": "Malware payload", "value": "cb9279aa66efbba0fc9c6daae37d5a0e0c9194f83478b6f5e1f0106c41f80ce5706c0e0f79f084ba101d39fd242f33f3", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782316747, "uuid": "a74b5d6b-edb5-42fd-ac41-9d485a65ccf0", "value": "T1C2669E82734D658DCE221F72C061294BDFB9641CB6EEC048F6B3A1D1196395B836F9BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782316747, "uuid": "59caf2ec-76eb-4734-80b4-0484d2e72c05", "value": "c129097361b8295c6461feaed5b0ddf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782316747, "uuid": "56258bb2-8201-4edc-af67-7bdbf0b27028", "value": "24576:Rm8flKTsLslmdBhi1vUkj/OZReHELFMx9u854dwO7jn/pWvB9cGJm5+WG7S2Qnc2:R2TwtSX2rexsHxn/pWvfTm5+1FYAqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782316747, "uuid": "f106ab4a-39d5-4dbd-9215-1842c57c02c4", "value": 6852096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782316747, "uuid": "e3ae3715-8786-4de5-b20b-fb34fa294fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782316747, "uuid": "ff205187-e378-4e21-a656-bd1385afe2ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803c7669-6ff6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782323992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323992, "uuid": "73002880-cc53-4a20-9e99-24a61bf4315f", "comment": "Malware payload (Mirai)", "value": "98ed0d4724bfb1cc6bc9d46de7515eb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323992, "uuid": "1f905a1a-f31d-422e-8f56-331181f4bcd8", "comment": "Malware payload (Mirai)", "value": "7978b25841d7508bae82fad292aa21a8ac3259a56e5ab5b5156b121e34fc4eb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323992, "uuid": "5969ede0-8ea7-4d70-9348-eb260eb430cf", "comment": "Malware payload (Mirai)", "value": "362224d0b2e9039fa7e90ffadaeb2c6535c25675", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323992, "uuid": "41c89dec-f8fa-4876-a30c-ff872fe350fe", "comment": "Malware payload (Mirai)", "value": "92d0b474dd08a109ea458eacac80390b5dcdc697e54964c6fddb9843a63b8f252d2198d67a35504b93f32268c3b57bb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782323992, "uuid": "cb0cfb18-6a9a-4b52-8493-351b533258b6", "value": "T1E3F3A64A6F228F7EF369877147F78E31975877E616E1C680E1ACD5401E202CE641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782323992, "uuid": "49f19649-e9cb-4260-8742-2d915b2d3f18", "value": "3072:egggXEauOS+rXNjfyVKqaQof+Fyj6PHYQA/xJv1/vrnESlG:PggXEb8rdja3u+jGpJV7ESU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782323992, "uuid": "bb9a3b93-a011-40ca-8a03-660ee3882d5a", "value": 158132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782323992, "uuid": "bfb539ee-9f00-446b-9d4f-9b9e1d1fa329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782323992, "uuid": "7a3bb5e2-a36d-446e-a3e0-be14b06f3791", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe86a71-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322838, "uuid": "010ab73b-27e2-484f-9868-e6d08ed870db", "comment": "Malware payload", "value": "e65021b786c6b78a48aa3329a3141ba0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322838, "uuid": "68a70fdb-329a-4fdf-ac5d-6868cd3ff269", "comment": "Malware payload", "value": "79e5be731264772458094ecc3a5f0b43f87a52f0bea15f1ecf42ab90b8a9edb5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322838, "uuid": "e544087e-ad44-4e7e-b83d-15080ff4f1e0", "comment": "Malware payload", "value": "88ea5ef09da98d42ad5985af64f162d2ccccd76d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322838, "uuid": "8cc88348-5739-4739-8eb2-1cc429364166", "comment": "Malware payload", "value": "9f88c80f986c28e318fd3b97cdd85550f73e5b874c9a7ee1b8875ce76d0785ed26261a1e12d3506f9051d8a5b514e635", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322838, "uuid": "17679de1-effa-4d68-907f-6bb95ccbd8a7", "value": "T172C60143FB448A5AC0F787F259372BA116270E668B4397C76960397D2C737D06F8A98C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322838, "uuid": "48af042c-1373-47fc-b822-37910c477ec6", "value": "196608:CcvuTYEkO3yZuPyAvGjXj8lvko57RWYGyxT5mSn0d7T0K3:BWkvO3yMPybzyvdNRzBxdmYCMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322838, "uuid": "c0055722-6b95-494a-94db-164034c52423", "value": 12284209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322838, "uuid": "f6513fc3-7ff7-4d19-b5ec-2db64bd3e011", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322838, "uuid": "d79d28c6-ee68-4792-b291-5084ea45ce97", "value": "simulator.quantizer.transformer.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a572c94-7010-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782335015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335015, "uuid": "3f1beaa6-7cac-431d-a9fb-2682c89a7272", "comment": "Malware payload", "value": "6ffd22bda1d0f1e6d7a820967127237d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335015, "uuid": "43028a35-7998-4d03-ac83-195ee7bc6d2f", "comment": "Malware payload", "value": "7c8ddbd9294e581b2266ab50e6075e40ad2bd39f61d44fca52910e9b9634a46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335015, "uuid": "7db68f7c-5691-4264-b788-8ec56201d64d", "comment": "Malware payload", "value": "7241584f44538bfdcaa3578adccb6da1ed72e75b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335015, "uuid": "fef49dfa-1c17-47fd-9498-ee4525d90f77", "comment": "Malware payload", "value": "8aaafd3b75ffade0977d950d6dc9c2a41bad7bfae21db0bfd345db168d91a9c286a3ce097e04731c7b015e9e050cfc02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782335015, "uuid": "e6187981-5d59-42e4-8b5b-3ec1d9e9c106", "value": "T1E5D4D4067F549462D1665D38C9B6C7B8E3B1FC094751939B32E26E2BBEDB3C21D262C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782335015, "uuid": "68e6e647-e1df-4708-a9e0-94c6618772de", "value": "6ce33c0cf2229cc5a025f5c023abbf7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782335015, "uuid": "969f2e15-f5e2-4703-885b-d7886fe389d4", "value": "6144:I++J8H7jQ9mKA/74bR7qdjQrd5KDX+ZS7ohQzItJMY4Lmo8uhL7LjICBE:I+C8H7qmf7C8djQrdmE8oizF7hLjFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782335015, "uuid": "fb176aa2-31cb-4998-93fb-db9323653957", "value": 604504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782335015, "uuid": "1236387f-f2ea-4e6b-9ef0-5e2d8e0369ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782335015, "uuid": "f22522e2-86d7-4401-914e-8c3fe8db9ed5", "value": "ijevhpezl1vxjabh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40a39fa-6f66-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782262205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262205, "uuid": "826bc12a-d9df-45d1-8df9-bdabba374a09", "comment": "Malware payload (NanoCore)", "value": "cacc96ee99446f6f5b66e17042b4352f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262205, "uuid": "81f6b2a3-a9c2-466a-83c7-bfc1e287f52d", "comment": "Malware payload (NanoCore)", "value": "7e0de4a54fd3e5c74bd4cccebe26d3e7b141e493edf4a2df59b9ff6e228999e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262205, "uuid": "086a2357-6261-469e-8f18-de56f50ccfa5", "comment": "Malware payload (NanoCore)", "value": "bb9cdc99b70a7a599cf990cef18b0bc2541835fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782262205, "uuid": "b106ed9b-1c62-4068-a0f6-69a4f0d4cf1b", "comment": "Malware payload (NanoCore)", "value": "d241a9688df8183fe98bcf04cd9e082459662391572988c84ebecb9eebd44c4b60ecf8ad91939e833145110047657170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262205, "uuid": "d65193a7-3125-4066-b951-33e5c6faea7c", "value": "T18014CF167BA88A2FE2DE8679601252129379C2E3D8C3F3DF28D854B65F177E10A470D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262205, "uuid": "7630dd0b-f8de-4eac-ba0a-5ba434e79e13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262205, "uuid": "e24b9c34-8ce9-4cd5-aeb4-f5fce2854a32", "value": "6144:sLV6Bta6dtJmakIM5qZmvN1onPN5rjfmQn:sLV6BtpmkQvN1MNR1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782262205, "uuid": "f9c60e53-7dfe-4727-a122-ea63ac7d3a0e", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782262205, "uuid": "7d5d1e56-a53b-47f6-aab6-c7c897e3fcd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782262205, "uuid": "be0b3e4a-63dd-41c3-95cf-89874151a4e5", "value": "dpvm.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f330123f-7023-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782343513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782343513, "uuid": "296e5eb3-87d9-4583-80ac-740d1ab0a971", "comment": "Malware payload", "value": "c60b4a44d173787c6f1a34083eb9b2f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782343513, "uuid": "86a77ddc-b286-4699-b261-df1b393ca1a8", "comment": "Malware payload", "value": "7fb004cc7b621d44c3524a65439f97cc8bf856359100f439f5ce8cfb6caf774a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782343513, "uuid": "a3788feb-4d02-4de5-8e45-428dc7a7d36b", "comment": "Malware payload", "value": "c6d8497f0caf059bef1f4a2393b7e6c9a908c390", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782343513, "uuid": "a3da3540-9813-4ef4-bc8c-09add93f6914", "comment": "Malware payload", "value": "d134fb01900f97b4b7519d5550a0f88d6e5aa5deb247acda9e030190e4e83f860e839b417eb8d600f5b24e89eff61571", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782343513, "uuid": "10b61bc2-b428-44c1-8a55-d317a5db1e63", "value": "T137738E4173090F53C5676A30583F2BD28399DAA522B9D7452A1F6B0FC1B2E71868EEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782343513, "uuid": "a7a56987-f30b-421c-8dd9-588f3e555d5f", "value": "1536:x2lqeqMW48fRwV/Kry7C+W4bPor7M4zern5N/2MNv1Hz3q8lk3XhIhO2o:iCGN1vFLlIXhI4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782343513, "uuid": "b0ea7fce-7527-457c-b9ab-c497382164ea", "value": 75388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782343513, "uuid": "33bea643-6df4-4b2c-9c52-041922794198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782343513, "uuid": "c81a22c5-147c-49e2-ac40-db9e33fdc8f7", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725fe8bd-6feb-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782319245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782319245, "uuid": "809d9bce-fe59-46d2-a232-388869e68eb1", "comment": "Malware payload", "value": "079f12995435c41bda69b366c1ce5047", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782319245, "uuid": "82a48962-7018-4c7f-9fb7-08f28aaa89f0", "comment": "Malware payload", "value": "7fc832491e04b83425646c5039c7e8684aab087f54b2d94ad25bcd8b567ff529", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782319245, "uuid": "f932d084-ce58-4ef0-a610-d9dcc899b990", "comment": "Malware payload", "value": "c2457c14525deae38c83587c35a93299088392e9", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782319245, "uuid": "079b60ce-ee61-4e91-818d-4b4d60746789", "comment": "Malware payload", "value": "b90fe3332640a191d0fdc208580975ab677ad66752460f7ad90f2c405a23f3185cc73df6aa7d86d0e5c3810ecb26da69", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782319245, "uuid": "03654940-5465-48dd-9a25-9887e1c2c5a3", "value": "T12A35EF42BF10D446D15A0D71CDB5DBF82720FC08DA65834B31E6AF6BBDEDAC26D12298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782319245, "uuid": "6d3533e8-7ff7-4aa3-89bb-d53f420bf77e", "value": "634709bf89a5d5411ae046a132bad72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782319245, "uuid": "d322d89a-2695-4f05-aaf5-356730db5cf5", "value": "24576:Fx49+kSbJVg8BnYbTZQSJXngvVGuNTmF8ozK:FeHkC4YbTZQcgvVLN6F8oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782319245, "uuid": "7e8bb4fc-4d68-41a3-898b-b26884884647", "value": 1102264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782319245, "uuid": "21f4f2fd-94c8-46d1-9d37-182f8077efeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782319245, "uuid": "15ab24ef-e7d9-4f44-ab5c-6d14fabfb40a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0754af-6fa9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782290755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782290755, "uuid": "4d3bc2b4-2b45-433d-8f06-bd35404aa37f", "comment": "Malware payload", "value": "c986ccb1ca171605c7b919a2ffd645ce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782290755, "uuid": "bffdb3dd-3a80-4715-803c-c03fda2127f9", "comment": "Malware payload", "value": "812a2969f3ff3641c962dbcb504de4a1b7de78196921a248acef1ecd2e1c8f76", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782290755, "uuid": "0351ca3a-737a-4b76-85ab-a17866b44c4d", "comment": "Malware payload", "value": "5946313b2421531f4d6d1f2c0a40e957a3d72e87", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782290755, "uuid": "d248d20b-e709-4acc-8e4d-c0ea23e6d412", "comment": "Malware payload", "value": "e05dab970d6ffb1148fdb9b7824d2a73022f3ee2eb59cbbc3e18c7f374f6df08dea9843c2eda8d4d304870be43c91bce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782290755, "uuid": "ff24db84-e56e-4fe4-8685-a85753957cb2", "value": "T16E0148CA8550A900502A8E6D66D756A0B422D3CE498B0F687FDC6D3DFBEC904F166E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782290755, "uuid": "e58cebf6-160e-4ab2-924f-09b713559d9d", "value": "24:kXCKysE2hi0ziQvZohaXSJHN1Lns+9ON7:e9Qp+MsXSJHN1Lns+UN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782290755, "uuid": "29ec684d-0170-4d91-bb0e-d700a45df913", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782290755, "uuid": "772f0f0c-6369-4bd5-8d80-589ae95ed408", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782290755, "uuid": "0a5bf815-98c2-484f-9818-28cc27a78a86", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fca075-6fcc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782305931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305931, "uuid": "3891b2ee-0cc9-426d-bdcd-d2587df6592d", "comment": "Malware payload", "value": "242a10592fba06f3884c6d4e3fba4f83", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305931, "uuid": "1368299c-364c-42e8-98cf-2e194bbb4e9d", "comment": "Malware payload", "value": "839468f2fe4e29c76b2f28a2734d04294b107b4c73898718e6ea5083ec9a8063", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305931, "uuid": "606da0aa-675b-4a2a-8834-887cbd9f4352", "comment": "Malware payload", "value": "d0341c3f4d98eb96b825713b057fcb2c7645f1c1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305931, "uuid": "b5514e17-dc7e-4ffa-b6b7-173bf35080bc", "comment": "Malware payload", "value": "c4a9f6d0850b0980b0b9ce4bb3ef38b15fa227e9d8e3cec495cfa0135a7589ec7740a7f0867f7652e136530b2ced6dd4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305931, "uuid": "96062673-5d8d-4137-83f9-944a674f27ae", "value": "T1D60148CA8410A90050AE9D6C22D75565F821D3CE198B4F69BF9C6D39ABE8D14F066F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305931, "uuid": "04bb338a-828f-41df-a179-12217a18ee99", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaXSCasaIWnChFo3FCsFnjCs6nljCS6KX:kXCKysE2hi0ziQvZohaXSJIaP1Lju+KX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782305931, "uuid": "2700c6c6-ccf3-451e-8060-c1424134f10b", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782305931, "uuid": "0295fa47-1b0d-4e77-a822-3e90c1dbffa3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305931, "uuid": "66c1b372-89ad-48de-84af-0586812622b3", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cb55ca-6fd3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782308936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782308936, "uuid": "bd915af0-ce73-4c21-8615-7a1433ca5e78", "comment": "Malware payload (Mirai)", "value": "f5d2dfbf13553d0042ab6038d207a971", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782308936, "uuid": "a50d902d-af83-41c2-b86d-8d9da65b55c8", "comment": "Malware payload (Mirai)", "value": "83f0930e2f9b26b475b31a9629f0445dbabcfe1e27bb40c2ebf3bf145fa2e42d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782308936, "uuid": "05b5ca3b-7dd5-4069-944c-226023691d85", "comment": "Malware payload (Mirai)", "value": "8a2ed9f721d0c0be992122385f539928946b1737", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782308936, "uuid": "7d6e4143-c11d-460d-aced-667693cc6766", "comment": "Malware payload (Mirai)", "value": "350a0ba712790297161370e600ceca50d06e2a739f763960252f4722597f241eaf0b1928be6444f5618aeb969a221e95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782308936, "uuid": "f79d6766-a71f-4dbc-874c-c09a04355974", "value": "T136F47E9DFE4E3C42E2D7E3789E4D87E1A22775E0D32391A33982434CD5CADD9CAA1911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782308936, "uuid": "b5e74f19-2c53-47e2-b7d5-3d08638e8607", "value": "12288:cq6gVoZPYWMijml2YQegN7AqYN8Ky6+dvpGLp3ecOdb4Dw5rbMfBo:d6dZPY12d7AqYNNyzBv9L2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782308936, "uuid": "18be733c-d5ba-4dbc-be5f-c6059e661fcb", "value": 726288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782308936, "uuid": "63964f17-25fe-4f28-8160-6d890f04f257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782308936, "uuid": "5b84788d-2003-4446-973e-fc42b2298384", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f7b30b-6fb9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782297992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782297992, "uuid": "02c2eb01-f5e3-48c4-b5ee-6eb7f359e24b", "comment": "Malware payload", "value": "e60d545cb13913397ec5fd8f05b8c69d", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782297992, "uuid": "f67ece8f-a497-4360-94c9-9cfdcbf5ab9f", "comment": "Malware payload", "value": "84d1b628b1c1cb79ca79b3d289da400e90d8413c9e337c0c125e244b585699e5", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782297992, "uuid": "cec51478-cc5f-4099-b469-c3d087ca5774", "comment": "Malware payload", "value": "0e84b6d0f7c52141ea57868f58419fa1faa4e17d", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782297992, "uuid": "820f7f80-d7ab-4c83-9344-963044baa017", "comment": "Malware payload", "value": "c272de17eaab54ab4c95b17a97369ecaac1f2e45295ee8877ffa5602787980a9f56abc11fcc89e121057cd160c086082", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782297992, "uuid": "a61750a8-d12c-4640-ba50-9904285c3419", "value": "T146D58C132CE11DE8D8AA633249B762927B71BC840F75A3C32E45BB742E327C19D76794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782297992, "uuid": "8025bb00-1c22-494b-b71b-b08248e21b7f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782297992, "uuid": "140afceb-9623-4cb0-967a-a4605d44568f", "value": "49152:2D72B32h+ZNUOONPP4i/Et54w8GOxcpXI+Iia4Df:2DCu6aEt54w8GOKpXI+IiaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782297992, "uuid": "36dfb489-e18b-4f33-8b03-0c8a2f8bcc16", "value": 2986880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782297992, "uuid": "07e3a93b-8753-4467-98cb-5ed6e6aeddb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782297992, "uuid": "68180fa9-a2f7-4a77-bfc3-f20816394e54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30469c5a-6fca-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782304960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304960, "uuid": "83008375-5535-49d6-8ba9-7058ad757aaf", "comment": "Malware payload (RemusStealer)", "value": "3a66625c5c8282e29473ec9128db8438", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304960, "uuid": "327b0026-ea2e-4d98-ab46-3972865f9794", "comment": "Malware payload (RemusStealer)", "value": "85046369ce3c2d3cf9f34139aeaf411ba267e04e5618ebb6cc84eef8d13f1f48", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304960, "uuid": "cedab9cd-c721-41d1-9e23-ae0ab5237549", "comment": "Malware payload (RemusStealer)", "value": "e845d2e5deb742848ad9d7a543dc4908b5de331b", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304960, "uuid": "a75441d5-f55b-4055-9fa5-9d9905cf357e", "comment": "Malware payload (RemusStealer)", "value": "117e4f76225006203079d4cdb182960dd6c511df06c8e5f2b3a2bc152aa57b1318e4a85e2085050b1daed7c2704eefe8", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304960, "uuid": "11eabac0-6e14-4343-a436-c892b4425e63", "value": "T18606D0CE567198F49BFD6245A6250B37877043D01C838681A1FC8B607E25FA76D8AE3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304960, "uuid": "dfeb7530-a1ad-42d1-a008-2a0e8652181e", "value": "24576:ZCzZsvCml9chf0wnCcRSjq0ypcwtmft6PgtfSzL1Qh:ZNazhfacRSjwtmQotfSzLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782304960, "uuid": "a211e4a4-f908-45e2-a13b-0408b6ca6876", "value": 3812980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782304960, "uuid": "837e19fb-b654-4ccb-a7bd-eebb6c8cad29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304960, "uuid": "1ab891d0-8281-4911-a8d2-e74c88607235", "value": "RStartecqX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff8ad6a-6fbd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782299725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299725, "uuid": "b612dc32-d760-4055-bbda-3052122c0d6e", "comment": "Malware payload (WannaCry)", "value": "67b8124fadb279c17d379cb2945280d3", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299725, "uuid": "f15892b1-a490-48f5-902f-c89f25fbdf42", "comment": "Malware payload (WannaCry)", "value": "8540b339ae5a8ce9b54e4a41e42a364b317d78ac6679a8a845d33c27d3f435c8", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299725, "uuid": "e2af8672-0544-404e-923e-1541be2d499d", "comment": "Malware payload (WannaCry)", "value": "de672f778b3a568320a1f39a911f018215bfdf47", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299725, "uuid": "00a35af6-4446-4cb2-8866-e3644f37a6a4", "comment": "Malware payload (WannaCry)", "value": "e680704415e1decf0c08e9e2dc2350135d4becb76e2149a526e80746e93db39e9061c528e4d39d12581a6c52027f3f39", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299725, "uuid": "4c28c96f-ebe8-4e38-9223-991b811a04db", "value": "T1C536F601D2E51AA0DAF25FF7267ADB10933A6E45895BA66E1221500F0C77F0CDDE6F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299725, "uuid": "406e87b8-0022-4a79-818c-8922edd7b42f", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299725, "uuid": "17eb66e4-17a6-45ae-a32e-75a75bb01892", "value": "49152:jnxnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:DVDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782299725, "uuid": "f50a588a-41bd-45bf-bf36-0195c2803312", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782299725, "uuid": "81bd4e69-8499-493c-b505-c4c84c15c27e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299725, "uuid": "118489d5-4054-4b82-8b7e-eb4c877f4a45", "value": "8540b339ae5a8ce9b54e4a41e42a364b317d78ac6679a8a845d33c27d3f435c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01e0f34-6fcf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782307376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307376, "uuid": "84b0c51b-9713-4c79-9d81-a8aa6a9b0da9", "comment": "Malware payload (Mirai)", "value": "fffa83c8e093bb1205fbc1adaba7fe71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307376, "uuid": "c42acedc-00c6-48a6-b251-16053a3a5b69", "comment": "Malware payload (Mirai)", "value": "898615544f07cdd1c7177a7c97d3253743b9d021481e67680ccc475843d8053e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307376, "uuid": "afb9d3d0-dfc9-458d-b072-2ed97ac180e7", "comment": "Malware payload (Mirai)", "value": "b4a985a3ea6b6565f74d5eeaf7d5dde766c92a5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307376, "uuid": "cf2a0bfa-88c4-4537-b4d2-d0bbd44fb578", "comment": "Malware payload (Mirai)", "value": "002a6d39620583570abbca93eebe0e11cbfde69b588063c05f7627e5e1361f2c890d3403967460a3620f9e27076639dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307376, "uuid": "ffc56ebc-7b86-4567-9d18-8a00ebff7cdd", "value": "T133342A4377324FA0D326D1714AB38F5659EB02D11EE288E5C36CCB147A24BA9685FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307376, "uuid": "63200533-048a-4fb9-91f7-1b7463c2ce6c", "value": "3072:vmCt85LyBH4IgCtWPfCbwGN2jnKxPDwIKR+DXFPcep6BpK:NqYJ4IgofwGN0nkrwNRYFRp6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782307376, "uuid": "de354187-6746-4479-98f7-6c76ab496809", "value": 234404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782307376, "uuid": "bcd47993-6073-4d49-9008-57df1bd86803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307376, "uuid": "7a1c61e2-ef6c-4b84-b657-e7c6fffcf3f9", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96284dc3-6fe8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782318016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318016, "uuid": "9119b07c-9c0a-4be1-ac95-90325277d955", "comment": "Malware payload (ValleyRAT)", "value": "358a85bfa76a008773958cab04cbbd31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318016, "uuid": "103c52f3-b46a-4d5b-9d9a-bc4799a666f1", "comment": "Malware payload (ValleyRAT)", "value": "8b2be6abdbb3062becc9c3b73c9148e06f623d0a3dc44df3775c05ee7355c5a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318016, "uuid": "5864b673-3427-4a04-9e50-e26fec6950da", "comment": "Malware payload (ValleyRAT)", "value": "24fbcccf700e1b9861f94d9d74c39b66067de997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318016, "uuid": "e126c2aa-0cb0-4921-bce2-ea338c661c82", "comment": "Malware payload (ValleyRAT)", "value": "6eea3c99b071d6d6e2df4d51812d864894d1f0a60c59786595615981fbbb1cd6eba2c7f753dc8c4bd71fe6e63eed9a46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318016, "uuid": "02f7eaa6-b867-4b27-a7c9-03fcfb65311a", "value": "T19DA5549D6A4454F2C57442F58D0805B8A2BEFD1F3E203925BA38AB212C77786DFB8375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318016, "uuid": "6b152fd9-2994-41ab-a537-e8378ac953f5", "value": "b352331f1815c3aef5e75c650559b8d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318016, "uuid": "7efab010-74bb-4232-b22a-4a33638e3aae", "value": "24576:GBT3IdwagHtoI7Wtgu/917dYl4R0KuGk2XGA+tDNq:GBT3IdwagH6I7Wtgi7dYlkkMl+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782318016, "uuid": "2caf69e5-340c-44dd-911f-87b214b6e16c", "value": 2133896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782318016, "uuid": "4ab822d6-7413-440c-a37a-c818701b884c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318016, "uuid": "6680e2de-c180-4ab8-96d2-f5a6362b42e7", "value": "358a85bfa76a008773958cab04cbbd31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8308e73e-6f97-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782283195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283195, "uuid": "974eced0-39ee-448e-b5ee-4e9eeaec37ed", "comment": "Malware payload", "value": "b4dc9217a498fe4ead46de389ab1fb77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283195, "uuid": "89be38fd-0ca0-4b14-8706-d56bb4d4e9d0", "comment": "Malware payload", "value": "8d737f5f1739472cf0cf0b688fceb5de206ed73f66301432fbf9fa12f728e9c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283195, "uuid": "0f522e20-14b5-4f68-bf5a-248548840554", "comment": "Malware payload", "value": "69c6d73d43bde695be7b32216fe71087184445e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283195, "uuid": "e6b02924-4264-4c82-9694-e4bf3d858c8b", "comment": "Malware payload", "value": "652899d96f098efb496fd14f590074f24b423665f2b17aaee00598e5dd39383722ab1d3f7ce5595fba279da1bcf0843a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283195, "uuid": "420a3f2f-83cf-420d-88c0-a447c5abfeb2", "value": "T1600633ACB6CAE69DC794B41D1C2F61F3522F46F716234623048504B6EFC06788EE96DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283195, "uuid": "e12fcee6-b37b-454d-9a4f-8fb9b680c342", "value": "98304:qyoKh0tYA5DVHfML6/qRFGisI0X52LXMlQYKZZ:qyoKhuENRoN088Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782283195, "uuid": "b4ee4c35-e472-4872-b7e3-f17d11f05b85", "value": 3687180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782283195, "uuid": "d2f0c4c5-62e2-4d95-9cc6-536094dc9a8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283195, "uuid": "63d5e270-025c-4eaa-81f6-27a3d25f1adc", "value": "untouchable.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49607b0c-6fc2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782301567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301567, "uuid": "65863225-56d5-410f-b3cb-01e82ac97294", "comment": "Malware payload", "value": "87c1badcfd555bca1b5fe13ed212d1b2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301567, "uuid": "15a2469b-cb5b-44ea-83f4-6c95734e8cc9", "comment": "Malware payload", "value": "90984d6788417bc284b17c3b302c1b667acfbf881eee0afeea1141b30f7379e1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301567, "uuid": "50292e04-056c-4c53-baee-0d96776e3936", "comment": "Malware payload", "value": "c9b580d9811f2df1c70edc25825319d2eb29d392", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301567, "uuid": "24405cee-b9d7-4f4a-ba9f-e0a964f9ef5b", "comment": "Malware payload", "value": "98bc34b20fc5fa6a35fc0b32c5125a50a10fcc1f39115d10f795c480772b014a4242a5171532036ad9c485a4f929f1d8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301567, "uuid": "9b6ea89c-dc4d-4009-902e-b15f8133e911", "value": "T195C2E28173F81304F5B6FE36DE39AB45483ABA90ED31C7AC5950CC1D2A66A00EA75F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301567, "uuid": "5b12d65a-8868-44f4-9446-b5f71ec55ebd", "value": "48:ABx3NGkTvdqTel+tk051WUyauR6qxXY67QqTel+tsd51WU4csoqJ/iWEB/iIc1f:ABxZTSel+t1nJuXV77el+tGnFtjoIAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782301567, "uuid": "75e04b71-5d5d-49e8-95ed-1d8913f5b687", "value": 27372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782301567, "uuid": "72b6095a-cb0b-4964-b0f1-8176810e3bd4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301567, "uuid": "795690db-0e25-4a3b-b5c0-3b16620f27b5", "value": "123.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e46091-6fc1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782301072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301072, "uuid": "c5811b23-77c2-4f7a-b60c-9361e3ffbe0a", "comment": "Malware payload (RemusStealer)", "value": "028f4d4e2a10746578248da6e51ff891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301072, "uuid": "65db34c2-8e6f-44e7-a5e4-25b6653410bc", "comment": "Malware payload (RemusStealer)", "value": "90a27fd7f19422c8b76ac2961c329b544ce06f1320c98295ab5fcaceff02d543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301072, "uuid": "e88f8bd7-bac1-4467-821e-581c66980454", "comment": "Malware payload (RemusStealer)", "value": "d8613f56f7a2c1e8b22d503db11f6a98746ccb44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301072, "uuid": "c075e059-4973-4982-bfea-f855840170b0", "comment": "Malware payload (RemusStealer)", "value": "9f8e742bedbe1e1917b185d2877b57a455b8202881b25210f1b7956b1c6fa4a2c123f5f30f0e5af36f52730f076af285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301072, "uuid": "27dcc87d-9d20-4904-8200-dbdcedd35bd9", "value": "T167A55B077CD009EAC4AAA73289B662967B74FC050F3267D32E90B7782E767D09D36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301072, "uuid": "e137ddd2-1318-43b2-b427-8a9cd0808c2f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301072, "uuid": "48f6d071-6a1d-4b17-969e-b634a31f930f", "value": "24576:3Zxo3YmKrJ5T0meRuZtAKBPjmFnuDBVaUzauGWBsajM9ldJBeletr92xMNW1kB+s:3ZxcYmuJ6mquDfboIOuB6enW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782301072, "uuid": "a9b30591-b338-4a46-ba7c-a8e983093e91", "value": 2157440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782301072, "uuid": "1d3a7df2-d706-46c7-9cbb-ba44f018c50b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301072, "uuid": "b79c6768-96a2-4720-939b-b69671f906da", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e914cb2c-6fa0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1782287232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782287232, "uuid": "5eedf828-618d-481f-ba79-703f9fd60d40", "comment": "Malware payload (ACRStealer)", "value": "3066df7e7d4cf323a22a776d25e3d65f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782287232, "uuid": "14552a39-bb9a-4f56-8b5a-e8fece16a54c", "comment": "Malware payload (ACRStealer)", "value": "90b7c9e9910c3512f4793b577a0b9025e8995cd67ee36e46f36b7b7b80b4d65f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782287232, "uuid": "f1f353a5-1ac4-416e-81aa-94b64f0cabbe", "comment": "Malware payload (ACRStealer)", "value": "c7be81782a80c8866056aad17a1a58306e7dc1e0", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782287232, "uuid": "5317940f-c020-4a26-b9bd-95d32f758137", "comment": "Malware payload (ACRStealer)", "value": "79e482355121970201c446c73854ae53a39fd89468607538f3dc6f224314a5423aea07e572250b434100a6962eee37bc", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782287232, "uuid": "3b86c7be-6688-4ea3-878c-1359561b4f10", "value": "T100051A44E89B8CF1FF834C77A10AB3AF776895188D14C6D9D7B9496AF5E2F00620D0E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782287232, "uuid": "427c4127-e3f9-4005-b888-32fc824e0fe0", "value": "12288:QwzYrPpq40H4DbnJT5fZZgCKx+6mk6RBHDOUmm/sZ40T9vHZ0:Qw8rxq4AknJTPOVx+6d6RkUmm/K9vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782287232, "uuid": "b3e218f4-481e-49b1-9851-a432e82da16b", "value": 804353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782287232, "uuid": "0c9e3b2e-e10c-4058-96c5-d62de20f6bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782287232, "uuid": "a0d758f0-86d7-48fe-842c-50872ff047ee", "value": "3066df7e7d4cf323a22a776d25e3d65f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434af2b9-6f96-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782282658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282658, "uuid": "11d3935a-e0f5-45ee-b6ba-a80b02f28dbd", "comment": "Malware payload", "value": "fc332f5ca08d5f166a173f394cc42da6", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282658, "uuid": "4aa8d8b0-38ee-4d12-ac9e-c70dc642c2dc", "comment": "Malware payload", "value": "9101bd5fd52fac30eb6fe9362d0a045db7a5108c8ae4248564d23e829e5f22ba", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282658, "uuid": "b127bc04-5746-4f1b-9e99-2572bee8bba6", "comment": "Malware payload", "value": "7a3b2bc67f7ca013f8727658c4ed317a2471c35a", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282658, "uuid": "bbfca042-b3ac-42c4-ba1e-4bdfdd487614", "comment": "Malware payload", "value": "42152119b880dce46e2fd163ea1003f493c7c00fc162cfb28b4cb83eedcb89169aef83872cbd94630d580a6dc9ad00dc", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282658, "uuid": "64d0e59a-af90-407f-ac58-3954f715c79b", "value": "T1E411EB7FE07495F02B55C98671A8C48C29934197B1A75EC1B3CC7831ABAFE4D38E124E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282658, "uuid": "3abb6e51-df42-44c1-be3d-c17550ef99b7", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkQyHV0FBoHAxABUWxABC7XfAw6fnv:FzY8k1/sWi2jkIyH+BA2ibiC7van", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782282658, "uuid": "78123104-473a-45b1-874d-2999738d766b", "value": 983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782282658, "uuid": "7718b5f1-8f64-40b0-9960-d768d1b82488", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282658, "uuid": "2aca54da-889f-46b0-9861-693edc2d52a7", "value": "ipmiv2.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c3ff69-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322816, "uuid": "411181b7-ec9c-49d1-8cfa-43f32821111e", "comment": "Malware payload", "value": "ebbdcb70608a8e7d52f834f3b583400b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322816, "uuid": "6685192b-b527-4b10-8a3c-619d8b22ee08", "comment": "Malware payload", "value": "9286b69febddf2e6240ce739d5814ad696f1589635802904f7213bc98cae97f8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322816, "uuid": "dc1e6a24-12a3-4fa6-ac3d-f2fc004675f3", "comment": "Malware payload", "value": "8b6b42e91e4912c878f9fa18eadddf567bb3707e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322816, "uuid": "c7123348-ab09-42b9-8b75-6f64dcff625c", "comment": "Malware payload", "value": "46042addeabaa661800c5f748ea3f6428f14438e828e2cd3c45dd7aba0a788e4392ffba64cc7c592f4e022d0fe2d7c45", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322816, "uuid": "06febdcf-e011-4425-b6a8-131394fbac6b", "value": "T171E62352BB461618E4F78B324A32129123364DB34B13934B7AB27D7CAC77BD0DBD1A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322816, "uuid": "7f18b055-d480-4240-a904-e9cdc50dfdb1", "value": "393216:ix0fkaKSDkB0l37Cpls9CXCpIHIK3RoGpNZ7pKvzK6Bw:DfkaBPl2btHD3RdT+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322816, "uuid": "0d1d8b41-c8a8-4388-9677-56b61d3c7eb9", "value": 14385800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322816, "uuid": "44fa696d-7f24-42d3-8ac3-fde709afc99a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322816, "uuid": "71676bf7-5a92-45e4-83fe-f50d77154c30", "value": "service.lonce.app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387690b6-6f7e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1782272332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272332, "uuid": "720638ad-5590-4774-9cb1-8de0e0fea0f2", "comment": "Malware payload (Joker)", "value": "16a4c860b844f21e6f56ec6f5a8ce8a3", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272332, "uuid": "0e032e0e-c3f4-4c18-a424-c3208352cf41", "comment": "Malware payload (Joker)", "value": "92b4d6b3527a78cc2483f3a1f0cf30b849fc117272310fe85f1cef934914eaa7", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272332, "uuid": "e54c9fa8-4709-4217-9c90-2c6ad7b59b54", "comment": "Malware payload (Joker)", "value": "0d504b3addbd85173e5522736bdf8fc5820c6fda", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782272332, "uuid": "b6f74b17-8836-4827-b2bb-90012b7d3582", "comment": "Malware payload (Joker)", "value": "dbf42d28739a60091663478eeaa9aa6a4f70db1854f7b418aba567291846489c6d64a567f6a0548c1f58298514adb025", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272332, "uuid": "9b3db25a-89cb-465f-a38a-0c59dee0d291", "value": "T160172397F70CD41FC87B74768E7A527202564D868A83EBA37514B32C29B35848F6AFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272332, "uuid": "c8e7a236-92dd-4aa1-99d1-bafbdbf7cf73", "value": "393216:aHxJgPh5EujqLC+8KFEGZvLFCi0amYOh8wxOYziw8StFtf:CoZ5EIq++8cEm6E28wQC13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782272332, "uuid": "eb78834f-6a86-4a24-8e46-46d9b2207672", "value": 19401347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782272332, "uuid": "7fc99f4f-1c6d-48b4-bbba-8b6d96980487", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782272332, "uuid": "2fa23b9b-b720-447e-85cf-46078e954505", "value": "com.maxorbor.phonecleaner_4.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dec7dd-7005-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782330532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330532, "uuid": "b9bd3924-db43-41a2-bb71-c2dea737339b", "comment": "Malware payload (Mirai)", "value": "15039b463cc4e696fbc73824cc538313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330532, "uuid": "d6ad04d4-ff87-4f28-bd2c-18b09ac0df26", "comment": "Malware payload (Mirai)", "value": "94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330532, "uuid": "f59001b8-015e-4983-8382-801dc089ce1e", "comment": "Malware payload (Mirai)", "value": "3a6f7badd9e344e0070987a5316849abe1b2d0a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330532, "uuid": "1c3c8997-434c-44a7-9da5-11c8009edd4a", "comment": "Malware payload (Mirai)", "value": "7c3ac44d1b49457813993e0a94f94cdc229b1859a4987129dc8a7802f9581477bbfdd621924ecba052e77c27a387bebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330532, "uuid": "f5dbcbac-fc3f-48a6-8b60-7807d02be652", "value": "T1A9735C8761119DADFC0FB5768A174A01F539E7508F630F3393A2FC6398520E65A7BE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330532, "uuid": "c83ddc14-14fe-4adf-b553-0c241478abbb", "value": "1536:9Uw+yqzisONOWB448GWcaTdPvC3JztwU0GYS8OUJc+bE6sMr8umXCeKBFLGuvp9O:9UFyqzisOwWB44LWcaTdPvC3JztwU0GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782330532, "uuid": "daaabd6d-60e5-434c-98fc-04d0c6d393c4", "value": 80400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782330532, "uuid": "5a47a460-2d93-4561-8c99-31616a424e79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330532, "uuid": "facc4ab8-d2ac-4259-a7b1-fdb8c7d2c932", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e69ce3f-6fe7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782317574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782317574, "uuid": "25561703-44f1-4821-82bd-5c3ab51a1721", "comment": "Malware payload (Mirai)", "value": "4a40c7b08794b0728aa61be1f0c681d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782317574, "uuid": "bd15ca77-5e90-4464-bfdc-a38d264254e6", "comment": "Malware payload (Mirai)", "value": "95a57eceb052295c729356076e7b542b6ebab7d2eb22552d81b39fac7f01fb05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782317574, "uuid": "c5033abc-4d48-4c70-81cb-2c1c61fc1fbf", "comment": "Malware payload (Mirai)", "value": "3709fa9dea58115420069eb5c87751aac85bf5ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782317574, "uuid": "a3a5518f-3839-4de0-ae01-32bb13bc4380", "comment": "Malware payload (Mirai)", "value": "fde2335d0e21ee661bf404ae56fab34cf37c019c554c72b29c7d022afd7afe3aeb12e1e644a19775fd49849143fb54f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782317574, "uuid": "78ee7190-f5e3-4fe3-a96a-54f1b15856ed", "value": "T1EBE47E9DFE4E3C42E2D7E3789E4987E1B22771E4D32391A33982434CD5CA9D9CBA1911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782317574, "uuid": "402a2499-437e-4eb8-8e32-388726024b15", "value": "12288:28Z4qVBI7i4uJUMhpCT63FSsq8LBxq8vcmyj0MAvZK+1UPPAGw5POMeCIe:fyqDJ4uJmaSsq8LBxnE8MHLjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782317574, "uuid": "418bad6a-5725-4b95-8ff6-d2b8f117ac9a", "value": 721216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782317574, "uuid": "a689a8c2-56c7-4374-a7f6-be1b94b1efc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782317574, "uuid": "e3775c66-1480-410b-8cdf-2d27894fce31", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1296d341-6fe3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782315648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315648, "uuid": "90140bc8-c85a-4776-9dcb-91684e9fa2ea", "comment": "Malware payload (Mirai)", "value": "170d0afe6271d854b406d0a66ed0935a", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "ascon", "colour": "#6E4C0A", "exportable": true, "hide_tag": false }, { "name": "asconbot", "colour": "#329D2E", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "su9wyp", "colour": "#A8A0A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315648, "uuid": "4eb58a26-5168-498b-b4e9-fc4ed9eba8bb", "comment": "Malware payload (Mirai)", "value": "96f926f634fe67a384d577612157472f7aae9db5c0651730dc9d98360b9e8766", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "ascon", "colour": "#6E4C0A", "exportable": true, "hide_tag": false }, { "name": "asconbot", "colour": "#329D2E", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "su9wyp", "colour": "#A8A0A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315648, "uuid": "1b950cb9-3c50-420e-834c-b89664f1eb1b", "comment": "Malware payload (Mirai)", "value": "252bc9034ff77985efc509e9b98046b15741a9ae", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "ascon", "colour": "#6E4C0A", "exportable": true, "hide_tag": false }, { "name": "asconbot", "colour": "#329D2E", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "su9wyp", "colour": "#A8A0A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782315648, "uuid": "2f00300c-3da9-49a2-a5f9-f879b1c48381", "comment": "Malware payload (Mirai)", "value": "b39bf2902ad38b298fbe5806131f596611d7516be6e94bea8398cf6616f998a591eb556037be7bb447f168b425e34c19", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "ascon", "colour": "#6E4C0A", "exportable": true, "hide_tag": false }, { "name": "asconbot", "colour": "#329D2E", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "su9wyp", "colour": "#A8A0A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782315648, "uuid": "8d8b8c7d-5ec2-4038-a50a-e84d7d253fd6", "value": "T1C0541855F8509E53C9D4173ABA5F435833334778E3DBB203AD285A782AEB74E0F2A581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782315648, "uuid": "927d4f3b-fca0-4820-a1dc-65f8d32fd5a8", "value": "6144:sLNwhumFJ9+84NlDUQnOoynDKQmITEonZZds8KQKzv2aRfwaN:omcA284LgQnOfDhVDdsgaRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782315648, "uuid": "e036d02d-749a-4264-8492-00abc8a9be98", "value": 303792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782315648, "uuid": "daf41345-ded5-4f30-80b0-468e1997a047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782315648, "uuid": "de4f8252-2298-4085-867e-ae998a8468f5", "value": "zkrbtwag7o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25f2bab-6fce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782306950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306950, "uuid": "8b118197-4673-4f4e-b627-37779e45e578", "comment": "Malware payload (SilentNet)", "value": "aa40a7c8ac3281ab7d23f93977bef810", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306950, "uuid": "f5c7a481-c857-42b7-8d86-428d13a64f56", "comment": "Malware payload (SilentNet)", "value": "9a03d956152e4fb2f4b5e2492a72b9190de671899ad549489e1fdcb395b8be32", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306950, "uuid": "bfdbc17f-8b70-4d41-a06e-435d834aa6ac", "comment": "Malware payload (SilentNet)", "value": "33dec836daab15a8ea03c400ce852b8758542c80", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306950, "uuid": "dcee4ffd-851d-431f-b0dc-23085afa1b3b", "comment": "Malware payload (SilentNet)", "value": "d05b632e896acf42bf195b3af209ed499edfe663cb9ce1ee762a2e3b2a64726692ff52898de7a59e97e172160f1ebee3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306950, "uuid": "c7b3dd5d-7b37-4fa4-a224-b4d7310b3000", "value": "T13CC302B5B488D82FCB277BFA4D844AF069A119D41E0F91EF22DA4D5C045B6D12FC3B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306950, "uuid": "02fce899-ad49-4ab9-86f0-024dae64f621", "value": "3072:uTnrYOTdX00cdcPXdsFiBJvaWKL4e8o8eId4A2zL5gkFJMPv/f1:uT8I00ccHZicroI2zBJqn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306950, "uuid": "b905c22e-0f6a-4124-9670-dabc6ea77fb9", "value": 126674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306950, "uuid": "2886a204-e663-447d-a719-9609ad28724f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306950, "uuid": "4ff5ff9b-1883-4327-955f-d5fa6c53d610", "value": "SmartTweakss.xzNIqVXr.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaca71f3-6fc5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782303018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303018, "uuid": "09b4975b-4ee8-4941-a845-fc75c457d4fc", "comment": "Malware payload", "value": "101dc271fa687014c43138258da87f60", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303018, "uuid": "e32277bb-ab9f-467e-a86a-e20885cd3ac9", "comment": "Malware payload", "value": "9acfe847575ffd349e3d05b12db398dc77f742e8dec9642392b35c1af8b6df84", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303018, "uuid": "a4198071-1c3f-410f-9ec9-25d4471bed0f", "comment": "Malware payload", "value": "d474c477e603121056634406f089e03ae274cfd7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303018, "uuid": "901db1d2-4624-4e86-abe0-c177fa416968", "comment": "Malware payload", "value": "c5aed71a9e4912871093e7c41ad216d1064d11e90804f92fbdb39529fb3e010f9eb50eeb823a54d4075634c53a104cb1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303018, "uuid": "fc5c8c8b-85b4-431b-9b39-940f90e35875", "value": "T13BC65DC527B067868EB010DE8CA29C4098FFE4866B9041DDDD5CD4372A64DAFF85DB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303018, "uuid": "f5de0871-08be-4f4c-9259-29445c3c08df", "value": "192:YCYMMXLjAEEYCEDrnI5fb/kHwYM39MCJRt8arQU36teeHRGxz7UgWsAZtLD3uJS1:K4hjoyXeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782303018, "uuid": "241b7216-7b77-4601-a215-3feabc36983c", "value": 12281056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782303018, "uuid": "eafb1df6-f850-4971-a0e7-eb487130d77c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303018, "uuid": "c9f9a9d3-9a09-4319-91dc-1a9309536be8", "value": "SALE AND TRANSFER OF PROPERTY TITLE NOBLOCK 823599 INO REDSPACE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d1edef-6fc1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782301366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301366, "uuid": "677222ef-a41f-4eff-9178-59ee7555f314", "comment": "Malware payload", "value": "7a595a22d2af8ec96e838508096e9892", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301366, "uuid": "ed28bf60-8a4a-4215-afc5-58c97573422e", "comment": "Malware payload", "value": "9b60269480d404ce86666de8971cdedf29f4106bf4221997d8761cbb9233f69b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301366, "uuid": "ed6b0ade-9b7c-4014-8510-87e51e03f850", "comment": "Malware payload", "value": "80d7f2ac539ae2e290db135fcb1b3d0b4fdff089", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301366, "uuid": "7979c1b4-230b-4d82-969f-6c8f61c9e1b8", "comment": "Malware payload", "value": "e3c68c869b231458b922e7b060f6a51d4cb64ed9e0bfd9f2d4e2c01eb0766cd68716a902ed9f0209d7f8caab512825e9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301366, "uuid": "9aa0780a-1ee3-41b0-908c-6add195df777", "value": "T17F71F1E4E253E9832B2030DDA99C8B5703793B9301C75D2A7F7B6C8D16C291274D9A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301366, "uuid": "bfe47cb8-9bcd-4f31-8a6d-852b4b182f8a", "value": "48:ZSgxQKYC4Bdt0pqbOATTo8IxIemQMbaDGrmvi63o9IEap8Rm3dsR5yPWT+WAFFmj:ZSgCKYCCu0bNTk8cihbjH6zFYAtvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782301366, "uuid": "18fbb483-6376-44c4-8ef2-694d2d0b5ab2", "value": 3712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782301366, "uuid": "a76ebd0f-d8c7-4b06-b8ea-adcb02f209da", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301366, "uuid": "e395da09-7491-40a1-b065-3f686fd359b1", "value": "CHM.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce028e28-6fce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782306943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306943, "uuid": "80ae3e64-d657-43b0-9de2-87479d9d4179", "comment": "Malware payload (SilentNet)", "value": "94494c5439e40a4a72d3efc3362410e6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306943, "uuid": "cd3d1b10-e820-4288-939a-50f986bbe882", "comment": "Malware payload (SilentNet)", "value": "9bb9980179e64dff5dd3e567d2067941646993dde90247893e8b01487f608d0e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306943, "uuid": "665f74fd-5ffd-47bf-bf72-129a64b51163", "comment": "Malware payload (SilentNet)", "value": "35800233056fd4594916caf6dd418bb2912ac7bc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306943, "uuid": "c80499b7-6726-493e-903f-0d1c92e1d8a6", "comment": "Malware payload (SilentNet)", "value": "d5b8e33230706a12a5b5a75207f40c77aaa9187c679369eb3ce21446a557b11a3f2ad5cbea96c6b03200df337915e371", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306943, "uuid": "60c8a7b5-2f9a-49c7-b64c-ccdc15fbffa2", "value": "T13CB4E026D90CD077E607B13746085E66743D4FE1E14B54A61AF90DA22C93CAB1F0FBBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306943, "uuid": "4d0745a8-08f9-4604-8724-844a4899071f", "value": "12288:YDXxmN+afQnRLUA/8KnGPYY0pJm540n9xb1I1rnqQe:YbxmMa+RwgbWZ0pJx6xb1ArqQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306943, "uuid": "4233f486-ceb0-40b8-8268-0803149a97d0", "value": 537027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306943, "uuid": "fdb70ebb-bc86-4777-8673-cc4e655c0a28", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306943, "uuid": "5f21b4c7-2a7a-4d64-a439-944339a3dc15", "value": "dqrkis-1.21.11-.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ab290b-6fb8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782297448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782297448, "uuid": "092599bc-8687-4310-a047-27f690b5060a", "comment": "Malware payload", "value": "5603668478cc7e8b607aa2cf7c48583c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782297448, "uuid": "9ed0c762-9d7d-49eb-b0ef-0cc8bced102a", "comment": "Malware payload", "value": "9d7fee6b208d97744d7c8b2f3e287f1df976c2f881fa7dcdf237984b423f1192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782297448, "uuid": "5dcabd0e-ac16-4a9c-a323-2b788804c851", "comment": "Malware payload", "value": "5005a6231055eb80539b9f8bca892e682c4429f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782297448, "uuid": "c417e734-5240-46d0-8fbe-d63d51a12cd7", "comment": "Malware payload", "value": "304cf74a252f7a7a22ace34410dbfbdd7ca0d77a7e8df0d4f80e0296d03b3a8c9a2e74620f8f1b2d14301c2a4bb43eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782297448, "uuid": "b7000437-f164-4126-98fc-29f3e9404385", "value": "T1D908331E5176EE2EDA36BC3257002E26CB4287FA9436561E73C0C04CF6C96D26D6C5EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782297448, "uuid": "00693f86-748c-415c-a150-67b7ec276db2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782297448, "uuid": "adae31c6-8976-43cb-a3e2-c4b2dd9290a7", "value": "1572864:Nt9IKPVAvm2TRWYSTM9sbVlMUc0bajJ5GcsGaP0SnQ/7:NUKD2TRWjw9srM1UEDGc/aPs/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782297448, "uuid": "801a95df-4be8-4c6d-8f68-f85e7303147d", "value": 77323021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782297448, "uuid": "57d905ca-1f43-4324-ae44-b940b5c58de4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782297448, "uuid": "0c64f92e-b32e-48cd-a163-21eabc6ad688", "value": "Ayako_game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c977b93c-6fce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782306935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306935, "uuid": "c4fdae37-1d89-4a03-a189-e12eb872cbba", "comment": "Malware payload (SilentNet)", "value": "6e8ce273347014a4f3ad4110c7a66cd8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306935, "uuid": "9d40444f-c570-4043-a9c1-dc2a89f276ca", "comment": "Malware payload (SilentNet)", "value": "9e2a3a9b44158af7d10318066bc8643942a4628e590e5b9c62ab0db4d5789b3b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306935, "uuid": "f7e8157b-71c0-4f9a-ab40-b6766bcb237f", "comment": "Malware payload (SilentNet)", "value": "baf4953ddee987c6d730e84964ebb2d663bbd51b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306935, "uuid": "2bc9547d-de34-4642-a5db-fb5b7d4066e9", "comment": "Malware payload (SilentNet)", "value": "4d69742bb4ea0fed61b69fc69e3812bbae4e5413000cc750cc5cbee93b8a7d346b93081fe9234c635934c5659576ed51", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306935, "uuid": "5a8cf42d-3be6-4838-b834-fa63f8cf3c0d", "value": "T1CA462352FA0DA43DE007933358154EA6B82986C9E14FE6FB36F815E51C879C72F6930E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306935, "uuid": "e0ab6365-c2f4-49f0-b116-91a889fc9474", "value": "98304:qKx5wXm3KMMyLbPn9NuNAwbrupLggtRBdCP2moRFMhG2UkyMFe8:TgW6a/9NmAwbruPtw2fSh8nKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306935, "uuid": "b2b6726a-9101-423c-a72a-9566757d6ff8", "value": 5557213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306935, "uuid": "071dfe2b-3629-48b9-8f64-c25000d35598", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306935, "uuid": "e2b964a8-d1f6-416d-8dee-581eddb12fab", "value": "NoxxClient-.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ed1a7e-6ff4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782323036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323036, "uuid": "8debcb67-6a14-4a87-a5de-6bd538d13c7f", "comment": "Malware payload (Mirai)", "value": "36d95ae1ad6d54ee9d0e487df3d1d619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323036, "uuid": "86244452-c432-453a-ad58-a3c745e592ca", "comment": "Malware payload (Mirai)", "value": "a16cc8566e42b514ce9acb6d1a220487fd5aa2a6c75a1a16a4cff0e7ca8f6397", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323036, "uuid": "e054c243-be66-40ba-898e-c8c0e9610055", "comment": "Malware payload (Mirai)", "value": "7c95d4a7025fba6ed98cad0b06c77def61b1d9ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782323036, "uuid": "b3272bd2-5152-4c91-9d04-0762789896ad", "comment": "Malware payload (Mirai)", "value": "0f73dc4bdb3b94a6da97188546fbe0ba7cf197ee097f5f7457fd5fb5de2662ff65a0d846df4a170a970fcbb5dde9b42c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782323036, "uuid": "8ca77519-f8d4-4927-af88-18304e79a3f4", "value": "T16C634B95EA83D4F0DC0611B018A7F73B6B33E4650134AA4BE76DF77BAC12722A50579C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782323036, "uuid": "72652120-2ef7-4667-9296-5b340c27996b", "value": "1536:pvFE8bpGRfA9Vr+GyZ42YfXUUl2hdMh5h/jhF0kQCbsn89:J68V2srm4P5zv5Qk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782323036, "uuid": "58ef8299-a687-4c6b-9856-6b324ebaac11", "value": 70608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782323036, "uuid": "a911b1ec-3ae7-48aa-a5d4-8cb8af265082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782323036, "uuid": "56b1ca2d-70f9-41b2-b47c-f11699aa8cf2", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58205e80-6f89-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782277110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782277110, "uuid": "70dfc888-4d38-4fd8-907b-d939910aabb0", "comment": "Malware payload (ValleyRAT)", "value": "91e9b61aeb427f56a870f7b1d781fc9a", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782277110, "uuid": "e85d5958-e4f8-4329-ad08-5ea796e6e461", "comment": "Malware payload (ValleyRAT)", "value": "a30f0643c7c07a9e014cc5de5d5cf9c03489b61660bd3783efb030f7c52dfe6a", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782277110, "uuid": "3f8c65b1-eaac-494a-a11f-ca78a54a33e2", "comment": "Malware payload (ValleyRAT)", "value": "b44dccc5f1e6f4302342f236c8f2d71e75bd05fc", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782277110, "uuid": "983e1c65-a49b-408b-93f9-e151d09cee5a", "comment": "Malware payload (ValleyRAT)", "value": "d5b88a44a4e69eb9d88b212c747c5b3dd086e21cbab5ed6180357f83161e70293a02564b941c1d8bab429da4b0ec3198", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782277110, "uuid": "52729e6f-cdcb-4e7a-a991-780ea9dbacc7", "value": "T1CDE56C17A29401A8D0E6C1BA8E6B9D43DBB034060371D7DF0A91C9935F7BBE15ABF712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782277110, "uuid": "bece2559-c8c2-4ba5-9914-95aa9db15bfa", "value": "add1f4043594e8696b13972792118a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782277110, "uuid": "8cb17865-3278-454e-b468-cb0b5f0442ff", "value": "49152:CcpLT4K17o1fjN+tHhJC8otbMtv6nvEISYOCzU4Fcr04OTbJUN9YrrzbwpSGvXGx:xtA1fjAJC8uwv6BQ4erkLajXGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782277110, "uuid": "0996deb8-052a-4944-bd10-53bb541b5e93", "value": 3198976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782277110, "uuid": "f04d8929-a468-456f-abea-550f29483173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782277110, "uuid": "ce9d2c7e-ef3a-4db1-869c-8c4ac25fa6ac", "value": "LYSDK2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17703867-6ffd-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782326823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326823, "uuid": "8dfc596f-6f45-4eb6-9fd7-a1d4f0c16f71", "comment": "Malware payload", "value": "b216cde3baafff1c591ac4366e58eaa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326823, "uuid": "c8195752-98d7-47be-993c-43032e0b50e5", "comment": "Malware payload", "value": "a485a98f07b6c3357436071164908a99f6a2e13d86d39e53ae9897e7e21ecf4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326823, "uuid": "c3bdfc08-6acc-457f-9b25-31b2057ee6b1", "comment": "Malware payload", "value": "842e926773a607ee7de28313833fe4d98290cf4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326823, "uuid": "407359c7-cbca-4b27-9732-e02ef9293d2b", "comment": "Malware payload", "value": "c1ba52f9432341667e128bc5c1bbc514b4f735b60753685d85398b743d866586db244e288b592ae5f7e7ca9323b6603e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326823, "uuid": "a87b91ad-0c77-4a05-b022-be4e96645b9c", "value": "T1C1D38A5E6E328FAEF66CC73447B74A21975823D526E0D684E2ACC1141F2039E545FBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326823, "uuid": "296528f1-4405-4fc9-8664-04cfa3875b55", "value": "1536:yFHNkl+qoOloOEtOZ4SSX2/otFsrhyWIOrveJoVS+OIzqjTQylef8RVqP5Nj:yFHNSFUFEhyWIOrO6SlhUf8CNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782326823, "uuid": "80e7f722-0e61-4f7d-b9f1-313049958241", "value": 142224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782326823, "uuid": "584970a2-6e34-4c60-9cc7-7e21751b62c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326823, "uuid": "f16d1b19-a600-480a-9bcc-68ea60281911", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c695e96d-6fce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782306931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306931, "uuid": "b378c8e7-c173-4876-91cd-13473a802fc0", "comment": "Malware payload (SilentNet)", "value": "3b31d713c5715eda1bd20f28932b4467", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306931, "uuid": "c9458e0f-65cb-429e-a3e9-3abb086aaf0e", "comment": "Malware payload (SilentNet)", "value": "a4f0e29aeeb9cc9a0396c68263691eac24b4fbf91217586eef12607d2812eadd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306931, "uuid": "37e98047-e2ce-40b1-a176-57308e13c217", "comment": "Malware payload (SilentNet)", "value": "477dc0b430da43b817840f42c6e892b922db5202", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306931, "uuid": "3c138d24-50b0-46ec-98f3-d0c2d13b0b60", "comment": "Malware payload (SilentNet)", "value": "3a0003c4e142a2cd8bdac3042e439b27346c231ad273b85015fd68e4709cc95799f062dda8001b8a95980eaae4f3baa1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306931, "uuid": "5237a98c-7395-4439-b570-4d46309dc320", "value": "T1EFC40113D84CDC3DEA8E777410BF0DD3A05C62A9A0C5966B06B1E7DB0562D8A1F3E49E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306931, "uuid": "7e487e71-31af-443a-86de-c2670e6d2928", "value": "12288:7AJKojSyr/aofzzbe3NhCu5Jm+yfHLrT6Ndpm6un4:EKoWHKPq73YLGSZn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306931, "uuid": "e958e4bc-bbb9-4f28-baa0-4001c3a8dd23", "value": 577125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306931, "uuid": "d1804def-c66c-4fb7-9b66-94f230e4ad08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306931, "uuid": "c0a06f43-2053-4a1e-bf60-ea9e919f3b2e", "value": "xenonv2-.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b70f5b9-6fb6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1782296497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296497, "uuid": "341d8ccd-8868-4618-b2eb-25d8d59a6b67", "comment": "Malware payload (Gh0stRAT)", "value": "7f4dfafd6d37ad850e5d38f090eed2c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296497, "uuid": "1f8c44e1-6425-4639-866a-dd7457a4267d", "comment": "Malware payload (Gh0stRAT)", "value": "a54318d38eb5b85ffa139155072f9581b55eab73b03aed1cfba6431dda1fc7c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296497, "uuid": "b2a4f3c1-baab-45f5-aec2-b0347e51c677", "comment": "Malware payload (Gh0stRAT)", "value": "35738a73dba62cbd14c11590c35927ad729107d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296497, "uuid": "6b509b3f-24b5-4ece-b5d4-0a04b2ec5dfb", "comment": "Malware payload (Gh0stRAT)", "value": "75c3526e44e56077596acebe7727f4d88874d3a79779e194f103a20a340fda30db7898ff93fd3acee9484c3afa38247b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296497, "uuid": "aa3b0bdb-ab0f-425b-9bfb-9bb7461a9da5", "value": "T1D907333FF268613EC4AB073209B393505DBBB664B56A8C2E07F0495DDF6A0601E3E759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296497, "uuid": "efbf9d89-4aeb-46a9-bac6-1d55ca07aea0", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296497, "uuid": "49e7cf76-efcd-4692-b14c-8a7522ca6f9d", "value": "393216:jE7u80Jc0vqvBEf+C2zph73iefaNYLsOsHJDi9:Qf0CEf+CIjZYuslFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782296497, "uuid": "03367879-7b94-404a-a5de-45368b4994e3", "value": 17897620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782296497, "uuid": "a873589c-3dfb-44fd-91e8-1a642476a702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296497, "uuid": "179ebc2e-3bf4-4ceb-bb35-ce99b6be2586", "value": "Jiawei Factory Floor Plan R.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e3a013-6fd9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782311464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311464, "uuid": "7db034b9-a3ef-4ebd-9911-5bed34b1b5ee", "comment": "Malware payload", "value": "b5e2fb36619bcc0184f8404fd8c487ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311464, "uuid": "6690bc1a-3cbe-4f21-8b35-4ad0eb14b635", "comment": "Malware payload", "value": "a630ae17ca1f27c7b83fe2c2168667fcdd8dac4284992592926903929378481a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311464, "uuid": "b5343267-3e0b-483e-8f4e-dc9f2a22e1b2", "comment": "Malware payload", "value": "79168d47b33152adf5bc5d520dc72e4c6a503a4e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311464, "uuid": "71ca7759-c9f1-4ff6-ae20-57307091a815", "comment": "Malware payload", "value": "e2ca9292ed32df88f4f01abd65142a18cd128c1af5fb61797b6fe34f7114c1b0a80bbd8914ecfb61f289d3a25cc4cd8f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311464, "uuid": "f6f16aef-bfda-4541-be3e-6a7c04961e05", "value": "T192767DB6011BFCFE2A7C2E80D0162E640D9D618B4665A155FEC8B0FE53FA690CE1DE71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311464, "uuid": "c21e8145-23af-42d6-acf3-9d0b2f1870a6", "value": "24576:zBKtURTKHZgsYMOa8EfXWiaZ9tEPYEiVxnQFZdZF/ruCjuOUsGK0UL7pSPTq2aDR:RKGQ35uCjuubJhSLjvphE4MEr07RqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782311464, "uuid": "1f605839-2532-4cb8-9a9d-d39e368613e6", "value": 7235121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782311464, "uuid": "b377a27f-8901-4218-ac6b-6dd2a3ecf030", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311464, "uuid": "da4a9e8f-dddf-46b7-9d45-7f1427524826", "value": "CallLog_AudioCapture_73267.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9a45e9-7013-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782336442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782336442, "uuid": "6a3e6e40-d272-4e33-8ebc-148f74a14726", "comment": "Malware payload (RustyStealer)", "value": "215d24f82100037b3b0212c7a53166e6", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782336442, "uuid": "d89dc428-a53a-4397-821a-69e2168c7004", "comment": "Malware payload (RustyStealer)", "value": "a64eee9ab72607f0f5b69d6bb3871586767b8b3e46f23d3154833bada493afb5", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782336442, "uuid": "90aac75b-8852-4890-8f49-09db45d250de", "comment": "Malware payload (RustyStealer)", "value": "a6d21904e1661fd2f368afa633088aeffcb21ba3", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782336442, "uuid": "d2f1f5f6-1345-4627-af14-56558e4c661c", "comment": "Malware payload (RustyStealer)", "value": "8d2584b34f5aadaf883794abf8ac34393eb61f521ddd9ca4acdbfe04013443ce7debdd42534032002ac96c89fa069ef1", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782336442, "uuid": "699bb616-a5b1-4279-93ca-8af092fc634e", "value": "T1D477F158020CE388785F4636F3E4F83FE3DC25993776E8A9BC39D1DAA412295C279587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782336442, "uuid": "085daeb5-1fac-4f43-a102-bac7c5a8bcc6", "value": "0bc1b1e557f4a4387777840b7c7925ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782336442, "uuid": "501b17b5-1e62-4ed8-b64a-0df608408789", "value": "786432:GgTFxe3rJH0VCahDLBtVbD1DT9SfhMhz:GgTFxe3razhDLBTmMhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782336442, "uuid": "909ee19d-c1a5-480a-9476-816831a9bbd6", "value": 32744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782336442, "uuid": "4bd36ea7-b194-4d12-ade7-262ad5d696e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782336442, "uuid": "140da722-64b2-4cdb-b476-054507380965", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a3df94-6f97-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782283260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283260, "uuid": "f44f9d05-3da3-41d4-b528-adb817394aac", "comment": "Malware payload", "value": "0ad79be406037d9f4c989afefde15367", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283260, "uuid": "89bdc46d-fe96-4105-a38a-fc7e9162057c", "comment": "Malware payload", "value": "a7a2497ef4bc7fd6366d20c7c41dcb9299654042a65cb673c730cd4ed57545f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283260, "uuid": "a0ec72d0-9d37-41bc-8526-d08ca053021f", "comment": "Malware payload", "value": "3b35af72f0e1ddf413257dfd15e8d2bfc1bbbd3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283260, "uuid": "c4f7e4c3-e651-4c92-94f5-44594a697c1a", "comment": "Malware payload", "value": "91c218d00d3c14036da5cf1d30b64f31f6ddbb4cfa7b940f657c2446385dc590511ed527b402925cf54d44bb7b8c1270", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283260, "uuid": "8a800503-3073-448d-90c9-98bef79f05ec", "value": "T1F7D63A63E8D71594C4EEC170C672823BBAA13C5E1B3823D71790F3246B36BD0AAB6755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283260, "uuid": "b8fdca2f-8792-4d7b-830d-304e2d0a962e", "value": "98304:Q+F5EnE6dt5/DFNUom0uhh7sJYlXWKuFxcDxQ0DEH:QAj6d/cRhfSxcKtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782283260, "uuid": "8a09b953-9ed7-41ec-b607-743c0c51686b", "value": 12922152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782283260, "uuid": "28d95174-beb4-4ee4-ba1a-c990696a590b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283260, "uuid": "51686be0-82c7-4709-9248-c9226c2cde15", "value": "untouchable.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf14d0f-6f5f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782259265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259265, "uuid": "78d42fa4-71cd-4276-9452-d4cb623feaa9", "comment": "Malware payload (Mirai)", "value": "1de5ac82d2f8056287669ef844e79e40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259265, "uuid": "5e1049ba-0b82-4bcc-84b8-a5b16bc690a6", "comment": "Malware payload (Mirai)", "value": "a881050c8ac1682c8f8e44b8ccdee9a0fded8891e8ddfa8f41416a16fa42ce08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259265, "uuid": "b794a6be-1490-4e77-b3b9-69c665e2a3d4", "comment": "Malware payload (Mirai)", "value": "242dbdb632f4f53d80b44f2e52adb955325d4b01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259265, "uuid": "9cd7fd05-00f1-4aa6-9a48-f7ea1c08e0b1", "comment": "Malware payload (Mirai)", "value": "9f23cb17960d887a45342fd62f2ab2d61858b9886833079e7646a5ad31dd86b97bfdcc1dd3d3623357fa8ca9c966926a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259265, "uuid": "cd808dca-6db3-4fd5-8bfa-e2b94f5c7f38", "value": "T1A1731991B982565EC2D013BBFA5F928D337563E8D2DE3123D9218B1133CA52F0977B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259265, "uuid": "9ecb3ec2-86d0-4bd7-8268-d2a67d56ea84", "value": "1536:6YXLJ1uloL2g4rgKcgtxoNZhI5Xzi2mWf7Iyd9jb:hLJ1Z2g4rgKcOfGebd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782259265, "uuid": "b3e2240e-4862-446c-a400-4b45ff3f4431", "value": 80588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782259265, "uuid": "c5347efc-cbae-454e-9635-bb5140cd15d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259265, "uuid": "3753171c-ab0e-45fc-bd99-e3e1fdc2e51a", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc96741-6fac-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1782292340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292340, "uuid": "233c124d-8a59-41b3-810c-7cff4fe5c377", "comment": "Malware payload (Socks5Systemz)", "value": "f6ad32434247191f22bb92daec16df79", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292340, "uuid": "645ab5b4-63a0-46e5-b57e-2d16587cc636", "comment": "Malware payload (Socks5Systemz)", "value": "a8c80fd91c3104f110be2bea8288621eadba7d4e9060fe9d9ae97719d5a298f6", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292340, "uuid": "40af3652-24bf-418b-96ae-2ba7bcdeba79", "comment": "Malware payload (Socks5Systemz)", "value": "fbff8303fa9e9967753d6c32f227045d3dc98536", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292340, "uuid": "6bb25489-9ed3-462b-b355-ef11fb69b1ce", "comment": "Malware payload (Socks5Systemz)", "value": "847ab84c8d292fa7ac520b0c57c365ccb1dd0cecf0d0b3fb0b3316d423a03ee4c6f0a2d54686740ed57e429a108d55af", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782292340, "uuid": "2a49b5c5-be5a-4bb9-b61c-f681cbd84d2d", "value": "T150F53311EA92EC79E163C9F15812AE187F63F8438179D30932DC8DAD0E3D158B9627F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782292340, "uuid": "db34fba3-a889-41b4-8e7f-8b56f02a069e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782292340, "uuid": "7e162347-f671-41fe-ba59-b18d8c620d36", "value": "49152:1vO5W/jfc8Bkbyi63KCiB6i/WGm9H8c3N9JkSl5sBSVgbi+uv71i+kPOPsH11beT:NOMr08BVi6YBMd9H8c9g65vZg11yvv5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782292340, "uuid": "6aec217f-771f-47e5-80ff-8e6c7f244c00", "value": 3355874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782292340, "uuid": "a3869234-544f-4999-babe-b4095a5b3d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782292340, "uuid": "efcc8e34-2db0-4f46-b784-fd74243836e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4d228d-6fc8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782304341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304341, "uuid": "293d7a33-bdb3-4444-b3db-77a6d7c3316d", "comment": "Malware payload", "value": "54a9a80fc4223f935be2b21b8200a1c2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304341, "uuid": "dc3487f9-7614-40b2-a371-294563dd45f1", "comment": "Malware payload", "value": "a97c8523696f6ef8f30cc6cf4b60a7a46fcb8716176741e09dfa81d5eacd8334", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304341, "uuid": "564b1aba-b7d1-4167-8b6b-ecd6e9d17801", "comment": "Malware payload", "value": "ef0f9b25947df36a5838112b82a4f0594f5c09fa", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304341, "uuid": "16a0ec3a-603c-41a8-9f50-eab675f698aa", "comment": "Malware payload", "value": "16144991338fafe22337a07af748345e3fccef72de9e89211eb581684891c41a4388b3df8402221cc223f297e9fafb42", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304341, "uuid": "bd03a8dc-a715-4ec6-97e4-6961867c14d9", "value": "T17E662380FF48D91ED4BB90331AA74B3026599D0FD687A70784EC725828B76D84FDAED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304341, "uuid": "f36f98de-c0d7-4872-a787-3ac56c55d0f8", "value": "98304:SSyvfxza75PzjyGKF7uV3+TfipLYs6HnCtyMQnIHUBrsiTbwwebP+H+8QrLEI:SFfEFPz+DF7uDA6NHUtsEbww++7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782304341, "uuid": "97b965b5-5587-498d-9107-053c290887c9", "value": 6598270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782304341, "uuid": "3a748761-7ebd-4674-915a-cd1d337686c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304341, "uuid": "881c2af6-d864-4c4a-b960-a248d47427d3", "value": "T!kT0k 18+._1782292005967.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e5af3a-6f7a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782270934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782270934, "uuid": "a5c108d1-3402-4a17-a16f-437cb92fcfe7", "comment": "Malware payload (WannaCry)", "value": "ca75020407cd030a1f43a362b6f0f977", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782270934, "uuid": "ac438d75-6746-4cf4-b280-4e6f52942772", "comment": "Malware payload (WannaCry)", "value": "a9bf6b54b485f91eb950df281998f1096f3a84c87bbd662710294e3b25c9f950", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782270934, "uuid": "b5f4fb4c-33d8-424c-a0cc-ee76e48ebeb3", "comment": "Malware payload (WannaCry)", "value": "34d0b2b1c8fb7a4cadf50602e01be5277f8a9a98", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782270934, "uuid": "1c7b7796-0af6-413d-97a9-9da78ceb3391", "comment": "Malware payload (WannaCry)", "value": "2f41ecf59181f61a85109361106d69c90b149d304938bc3a0c81ee317154edcadf240bd4f7ec7f7ecb5980f5e0441096", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782270934, "uuid": "e805cdea-e51e-45ee-8967-825874ae201a", "value": "T1BC36231A327C81FCD14A157894A38E25E3B3BC5A12BD870F9B5486271E13B90FB78B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782270934, "uuid": "d6aa1ae8-5142-4d23-92b5-e829c50a7aec", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782270934, "uuid": "ebffc0aa-71fc-49a5-9608-f115e29b6b54", "value": "24576:jbLg8bLguVQhfdmMSirYbcMNgef0QeQjGe6SASk+RdhAdmv:jnRnFQqMSPbcBVQeje6SAARdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782270934, "uuid": "0801857b-c15c-439e-9fa8-8d40348e1e34", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782270934, "uuid": "0c377ba7-ed07-4440-b251-17e9dd209dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782270934, "uuid": "597cc40a-4098-4cc1-8d8c-1bcc1ef2d1bb", "value": "a9bf6b54b485f91eb950df281998f1096f3a84c87bbd662710294e3b25c9f950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfef77a-6ffa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782325676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325676, "uuid": "01d89505-60c3-4bd3-8c60-ceafdf906746", "comment": "Malware payload (Mirai)", "value": "c65f940ab2d977d6d86ea719c6a1fd7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325676, "uuid": "569923b7-c9c8-41d6-b085-60536db27cf7", "comment": "Malware payload (Mirai)", "value": "ad21baf3b79af3680215d48448c86f38b95ba04b49f0dfa837f9dca39f8023d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325676, "uuid": "bb4bbe3a-9263-419e-b5b4-38845662412c", "comment": "Malware payload (Mirai)", "value": "94103aaebb499ada8f1b5d4e25265f8e1ed2b5f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325676, "uuid": "cfe85053-b16c-41b5-96c5-19c1a0b59cf5", "comment": "Malware payload (Mirai)", "value": "a9f82d1ec5ce9265ac7c62a197f88577134a843a54e431db13c93c9285312f466c5aa50f4c2dbdf52c44f8097d437ad0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325676, "uuid": "97656028-0d64-4e2e-894c-0e331bd39cd7", "value": "T1E0F3E70AAF610FF7E8ABDD7702E90B1129CCA91B25B53F797534E814B50A18B49E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325676, "uuid": "caf30cd5-1bef-47be-a550-594069cc8afa", "value": "1536:wrsl7+ms+CsvE9PtXp/d7V5239RKswhB10T9TmkQ0bKI81XzAIdUgaNpbiLZYoCM:17kuEV3ADOBvjrUZbiLYE6DxrrC1ET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782325676, "uuid": "67e0a825-02ca-4e7f-88cd-8f21b5fab160", "value": 161636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782325676, "uuid": "9054edce-ff6f-44ec-b766-f73f7edc798c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325676, "uuid": "9bc6217b-9880-4f3a-9437-200031032548", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a3ceea-6fc3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782302049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302049, "uuid": "1df5af01-d26a-48e5-84a4-74571de6a349", "comment": "Malware payload (SilentNet)", "value": "594f358defb3856e33e1d3933ab42b12", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302049, "uuid": "3b006678-a896-469e-bb99-51240b14e99e", "comment": "Malware payload (SilentNet)", "value": "afd2f898f93ffb9b0c1e7428ff955feac9786efbd7a7c296f1335ee4be25185f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302049, "uuid": "fa66a6a9-152e-4751-aee2-8527d2f0cc59", "comment": "Malware payload (SilentNet)", "value": "25c8afa148bf2389706616c8160e1083e23c015a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302049, "uuid": "05159522-0fd0-48c3-88f2-fb186070fc8a", "comment": "Malware payload (SilentNet)", "value": "ad2a31971fa452873844abf388143dc32c949c7c9d4e7e06cd03f61adc6357be0250b01717a8b9df992def6cb18ef555", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302049, "uuid": "d9fe7ea0-cc19-407d-9a55-36cc17062202", "value": "T18C7412DAF9B0503AFB1B3A31F0255BFC89B41AF9D1C7A41B187D1AC6894B4A31746B4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302049, "uuid": "17b1e843-e838-4d0a-b1b6-ef6b2861e8e0", "value": "6144:lDkfJGl0pcTde9FCDoesPTQRIfkaoZsD/xXDKf/YZIuR7QEP+AsPDmag:lgfi0pcJ6eWYWQZsjp/FWA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782302049, "uuid": "0895c47c-72a8-4a88-a56d-cb3a009aef6f", "value": 352806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782302049, "uuid": "b0f3b83f-484b-4f70-a307-5b72628e405d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302049, "uuid": "c8d35244-bc4d-4c12-bd9f-18a6e5363e5b", "value": "ZERODEBUG.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ca7358-6fc0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782301002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301002, "uuid": "7ace7a94-f7a2-41c7-b506-ad143c2ecb8b", "comment": "Malware payload", "value": "fb8936f3f59676535de48423ae62ec3d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301002, "uuid": "4720a5e8-16cb-4b6b-a0dd-ce0af2b8384b", "comment": "Malware payload", "value": "b130d12777d271184b92b8d9cb5f4fe6a9832dae9fd0f56c4659a823990c33f9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301002, "uuid": "54ea9844-b3b5-486a-89e1-6bc532111c63", "comment": "Malware payload", "value": "c95a4cbe988111be254e6c2e483d84093b3fea73", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301002, "uuid": "67dae573-a8b3-42e8-8f5a-5ce70f7eb0fb", "comment": "Malware payload", "value": "3ceb66899916923360723665073b290f50f4c53867837a03862f623caee3b78bbda761ad052bccdd7ada13dde30f162e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301002, "uuid": "c2bc98a1-e0ea-4e18-bc9d-e8ee47e6feda", "value": "T14496E55B93D403EE01B2B106E80D796AF612C4BC6B3693652D58793D33B6638873E5F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301002, "uuid": "3dc2edd5-01af-44f5-a892-5a0a02046c39", "value": "49152:kJnczAz0h9YvSlW3lvs0Ed5b1FJpSHeYHL3DCQ7wtjIyAFXyHdpJDSP+3TML:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782301002, "uuid": "5437d7d2-b9d8-4a6a-8ef9-57ff37670e27", "value": 8940199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782301002, "uuid": "15a9261c-8be8-4924-b35e-35c0547500e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301002, "uuid": "c7a98dce-afe4-4208-b580-3d13bf0d8d06", "value": "nouveau_curriculum_vitae.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3948d7-6fbe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782299931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299931, "uuid": "72f4696b-0724-452d-9e38-94688ff293c1", "comment": "Malware payload (AsyncRAT)", "value": "d89940de135aefb14006171ce9583685", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299931, "uuid": "c0561df2-514c-471c-8d43-c5c8c208a5bd", "comment": "Malware payload (AsyncRAT)", "value": "b1b2ce043a42e8a9fd97d478bf86776103b2be910dfcff97e7d9ce6378e7701e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299931, "uuid": "02dc2eb6-8912-4bac-901c-81e6b51696a8", "comment": "Malware payload (AsyncRAT)", "value": "8cacd12ab5c7695626d67d4d5bc13c7510217039", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299931, "uuid": "c977a92a-7a73-4582-ad51-92781ac64afd", "comment": "Malware payload (AsyncRAT)", "value": "bf1e32a8219cf30446db9d2c2dfdb890122db82a31c838ebfc44b875083312db42654ab30acf8844bdb046e528bab0e5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299931, "uuid": "4a0d1ec1-9015-4441-9b33-25e9e48c3c27", "value": "T1101833504348C614F254D735BCE1A3C3D122B6E7CBA973FB2967CA6BD957AC88A30E44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299931, "uuid": "5c1067b1-3d15-4f75-a973-5aa61948e9a7", "value": "9da7080b9b697496fd4f41997e8bd436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299931, "uuid": "3425baec-d690-43a1-80f8-fb4be9e8ced9", "value": "1572864:HgetfL93x0KUSKqq3h0EL86eaSKkeFkEX5UYc4N6JJ90bgkJVxtIK96iYG:HgEblkh0EL8Ip77X5dc4N6z90U2Vj+ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782299931, "uuid": "9b879ab4-3ad7-4035-a66a-f5c71e5cf6a7", "value": 89849856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782299931, "uuid": "a9bdb2c8-a06e-4e1e-a4fc-8208c96f185c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299931, "uuid": "325e3970-8d61-4913-ad4b-9c5c40e0fceb", "value": "xenoexecutorexe.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c74754-7007-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782331134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331134, "uuid": "71b2cabe-130c-49b7-a0db-88d24f735ce5", "comment": "Malware payload (Mirai)", "value": "40e5e5e048690ec87d6e4ea408ee863b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331134, "uuid": "226ebb16-06ff-47af-b689-b8a073462243", "comment": "Malware payload (Mirai)", "value": "b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331134, "uuid": "02328a3d-2a71-48f1-88e8-96b1337abe95", "comment": "Malware payload (Mirai)", "value": "423d4960092711ee3bd76147cbdf0ac633181773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331134, "uuid": "6f14e0b8-2818-4224-973c-d11533c63535", "comment": "Malware payload (Mirai)", "value": "0da591654972c25638a647c3d86f33ff6809c8e6f66189546105b94c6bff4010e7db0cfbc72b1cee66afb0947e2311ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782331134, "uuid": "e22b2e7b-6546-48a8-9189-9198c21c8472", "value": "T11F844A52F2A228FDD952C930825D6123E638744943129EFB27C8EB753A16ED06F3EB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782331134, "uuid": "a6c5ba19-b35b-4c82-8689-2b6bb338881c", "value": "6144:KiVEL9iGruSOwl60jkALIsYTFyJ10hspXuzKONq8LOUiqzO4JWktw5Q:KInG2v9AksC8JCYurBLOUNK4e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782331134, "uuid": "dcbc0a49-1746-4432-b8ea-d420b2861232", "value": 392896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782331134, "uuid": "e0653447-f064-4a25-afec-4f73f9ec099c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782331134, "uuid": "08f1cf69-b9f8-4f5e-b169-688f01ebb945", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509fa323-700f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782334650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334650, "uuid": "67684a69-a031-4d96-90fd-4ab76a01924c", "comment": "Malware payload (Formbook)", "value": "280a26accb8a0b6ea46506785fe22391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334650, "uuid": "df88bc52-528c-46e7-93c7-f84b2676b1a7", "comment": "Malware payload (Formbook)", "value": "b710e94d81dab6603ad14a45ee82926305bfb35f848d9108d4fc31eaf5161707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334650, "uuid": "17eec06a-7faa-46a4-b6db-14255583fff8", "comment": "Malware payload (Formbook)", "value": "e8faecc955939d21d2ada0465bd42c8bb6df7946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782334650, "uuid": "49dc8781-4dea-4d8d-8bfe-ee767ef3effe", "comment": "Malware payload (Formbook)", "value": "6ff1d91439994c16528a028ecc872953b2e2559cc13860c2022285f338fb8cd6b9510e6feef6b466554126db9c21844a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782334650, "uuid": "4290c946-5c96-4f8e-b445-da210fc4ea4b", "value": "T110350244339DEA01D5A84BB14871F3B813703EA9A921D3079EE9ADFFB572B056D58383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782334650, "uuid": "a8320462-d992-47dc-8afa-b1e549422238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782334650, "uuid": "eda90ee6-1136-4f17-92f0-21fc99179c6b", "value": "24576:tP3hytuUb/lvVSt9ogoVLSe9VT5Nd8ml3YIRFg1uqtsMmKA+T+:muIleogOXT5f8ml3YIRW3tp5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782334650, "uuid": "97abb71f-b112-42bd-bc96-2e5770ff5169", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782334650, "uuid": "ef17fa4f-3bf7-4de9-bb12-198ad594e28f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782334650, "uuid": "0ec364f0-3466-4007-96df-4b4e0f30902f", "value": "09786y7662026-DMS108997.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e34074-6fd9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782311327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311327, "uuid": "443844d6-9851-4dec-a774-cca68244e58d", "comment": "Malware payload", "value": "6d849ce3474d79f69d4d7064016e2fec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311327, "uuid": "cdf37a40-2af1-4834-8808-1ce1fee5ff97", "comment": "Malware payload", "value": "b814be65fb39f770520cf4c411a7bbf24cdb62c9d72ea49f6a0d7036d835cffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311327, "uuid": "6808fad7-022b-407d-a324-c04f3474ae2f", "comment": "Malware payload", "value": "88855157e994363712bbccf8656d6bafc195ae0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311327, "uuid": "4941c5b7-cab7-4cdf-b2a7-11d70bb13e35", "comment": "Malware payload", "value": "b9cde166be907de01294c3b03ba3dea7ba6e543a24d7f3b887a8ad130befced2ba0c102863c2a1e16565ccf5aff8f3ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311327, "uuid": "775005b4-3a89-4102-bf79-35af4c9c3905", "value": "T124F2E144BE7482CBCD84DC3E1E9C1735E6BE9A11BE05803083E45275DBB3DA1DAB3295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311327, "uuid": "5037e5eb-5725-4b87-8597-c4185768dc80", "value": "768:GfI4zlmuIruFUZ+47HU49oc2UIFCPI1St0N:ABEZ57049bI8PGQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782311327, "uuid": "66642233-2077-4f54-9810-ca3228a64f01", "value": 35200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782311327, "uuid": "dff3d697-200e-4922-888d-2c2544092aea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311327, "uuid": "509dc4e9-30f0-41e5-8be9-e2effc5af93f", "value": "b814be65fb39f770520cf4c411a7bbf24cdb62c9d72ea49f6a0d7036d835cffa.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd3d48b-6fa3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1782288505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288505, "uuid": "28df5825-32ed-4a17-9478-caa9e60edd7c", "comment": "Malware payload (Socks5Systemz)", "value": "53d284398c7c2da4abc56bcc5c298c9d", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288505, "uuid": "1f8311ba-946a-4c36-aafd-3096d9504eba", "comment": "Malware payload (Socks5Systemz)", "value": "ba8e4352c46cdeac82c521a5d5b0661a6f99e5745812287c7234184c99be6819", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288505, "uuid": "0db78084-6c50-4fca-8898-a824b9915c99", "comment": "Malware payload (Socks5Systemz)", "value": "397b953926106a8ee18e1408d4652f58193f21a2", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288505, "uuid": "5ed8cc52-8679-47c5-9cd0-3371dcd49f8a", "comment": "Malware payload (Socks5Systemz)", "value": "89e93e11801d88d3cda90522af689f2e7384719116e3a10e0c543d79ff34b589743f217e8da38409b51fc6ff73fc997a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288505, "uuid": "e458746f-289a-4910-95aa-450313e5a03e", "value": "T1ACF533A9678D9936C17822304C5BA6BD8D6BAFF504309518379B1E648FB7D80CE0E3DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288505, "uuid": "5c163274-4dfa-43ba-95ee-1b04c569fcae", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288505, "uuid": "27ffceaa-086b-44c6-abe8-6d4eb132fe0e", "value": "98304:NQODbogHEDAsmb6rtgiIVZ/QkOkLN3VMyrNx64Pkvv5V:1PogkDzmbYdIQkFLNlMWNxVPkvvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782288505, "uuid": "6cbaed4b-a753-44f2-8e73-aab3566cbcdc", "value": 3440877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782288505, "uuid": "5e3d657f-43f2-4cc5-aca2-20302b195f23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288505, "uuid": "26b4bfd1-d5f2-49ce-af4d-53bae4f18273", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b451944-6ff8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (IRATA)", "timestamp": 1782324763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324763, "uuid": "b45c3ae2-0005-4e09-b050-915d2cacbe99", "comment": "Malware payload (IRATA)", "value": "3960b401fc189fd957564c0348550f2b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324763, "uuid": "9d83b781-a1d4-43d0-8980-10a333920fa0", "comment": "Malware payload (IRATA)", "value": "bbd6c516a908658a0cd636856341db09e3f2e67a5a9be9fd1e121992c51da0c7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324763, "uuid": "fbe551ed-467c-45db-b4d9-d42d047bcf4a", "comment": "Malware payload (IRATA)", "value": "ce75c2b0b449f81be11284adac579a70bcc7d1e3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324763, "uuid": "ef22df27-1159-49d7-b141-2245c4f3467e", "comment": "Malware payload (IRATA)", "value": "484e15382b4fb6d0d23e645ef4dff704bdc5a3aa65dff3f9834fdf352ece110919795eb3d643a20fe1e9b330f69c622f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324763, "uuid": "7aee5cb3-e54e-4676-b8bf-097e06d12fb7", "value": "T139562346FA93E89ACCF6C33140B60B39613A1E2AD34793476375B6F468BBAE447471C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324763, "uuid": "72a60ba5-a834-4a7d-8390-d02917185252", "value": "98304:YctGbZgi40QT8nBP2BPv3tVooAlHAVdrwr1/RkgOqJd4bS306zShQvOsBMFIk:1nynBelvtVN161/RkgOSBMQvDMqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782324763, "uuid": "59d8bc56-098a-4c87-be3c-6b36a92a3c46", "value": 6204201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782324763, "uuid": "bd948839-2e3b-4644-9a64-5e3df16fbedc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324763, "uuid": "4fd5c54a-c3ba-4efc-a90f-122f85604b6b", "value": "AndroidAuto.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810fa880-6f9c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782285339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782285339, "uuid": "0a123434-bb74-4212-9169-fd62f1e5d7c6", "comment": "Malware payload (WannaCry)", "value": "6459cf127cf33bde7820cd1365b43fe7", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782285339, "uuid": "ea7f03a0-e8ee-445c-8423-f2fc9bd44bef", "comment": "Malware payload (WannaCry)", "value": "be6b529a5d73a36219c8c99dd8099bde97794a210b6236df48b1724060f6c37c", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782285339, "uuid": "cf1748ca-8367-42a8-be68-cc3ded89ad23", "comment": "Malware payload (WannaCry)", "value": "f04d178859b38c3752ec2ce12cc47c2f20b725f3", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782285339, "uuid": "83c6d5b6-e66b-42b9-ac57-218857512bc5", "comment": "Malware payload (WannaCry)", "value": "e85091b1a639b2ae0c2c46b14c2ce6bb55797df480c710f091ad81f9d6a317c148862bb350fc05dd3c19eb3cb0302afd", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782285339, "uuid": "2594e2cb-4716-4ec8-a105-bf7ea418cd63", "value": "T16436F117D3E442B7E0B90B3242F71B26FAB7B85266625B8F071167291D23B02ED34F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782285339, "uuid": "5c4283e4-beee-41bb-92d2-a2e8df0de7e8", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782285339, "uuid": "10be7998-750a-4b63-baed-20137a2c1007", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9SPJp:DI8qPe1Cxcxk3ZAEUa4PP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782285339, "uuid": "3081c175-b4c1-4176-a52c-b64285f59d71", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782285339, "uuid": "b40b6c6e-d27d-4b35-ab26-833de85cf752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782285339, "uuid": "51e077b3-dde6-4953-97e9-d78220b1df04", "value": "be6b529a5d73a36219c8c99dd8099bde97794a210b6236df48b1724060f6c37c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6575b060-6fc4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782302473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302473, "uuid": "eb8a8d99-4259-43b3-b43e-ab4444fbb698", "comment": "Malware payload", "value": "e6c9b3e784edfe1e7a4aa3e9dbc9d6bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302473, "uuid": "586b02e7-b8fd-48dc-90d6-aa2616a3a016", "comment": "Malware payload", "value": "bfa36eb058e276e8085e2c5dabade21c688eee2b38d806b74da4aa51688b8e98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302473, "uuid": "ed09a3af-8d3e-434b-aaef-8c0cc736111f", "comment": "Malware payload", "value": "95a16cde01e90251e7ee7c8e83d66ae501674efe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302473, "uuid": "450e8b7c-9abb-40c2-a0c5-1daa8fe13a37", "comment": "Malware payload", "value": "d56f0cf290d1a58f663780879fa95fc9799264513ba31310d3669ce8c91d7f04914b0ed05f326b7f72a7c409d0087a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302473, "uuid": "535a64f7-8b15-4aab-be42-a36101fef25e", "value": "T1CC4733C676514A3ECB628BFDE283A3EC94BA91050B32A5EF6E447E540B430E653777C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302473, "uuid": "cf8f26fb-53aa-4b70-aa9e-824ad5f1f6c8", "value": "d54f439a5f27d050424502aee8cfa597", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302473, "uuid": "b3be9573-e535-4206-9a34-acdd9cd477a8", "value": "393216:aap0m05rZHbSXB1Vb0bvQMPJNxraxqjFRu5q4fVi+K/w3xiS8RedCXuFuOK:aap7muB1V8vQ2OIFRbyXb26C+VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782302473, "uuid": "fe55e7f6-9c73-46a4-994c-61c31a27bc75", "value": 26090352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782302473, "uuid": "5c8bd338-9240-4a6a-9317-ef6e2a423283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302473, "uuid": "23c91891-cf7e-4a7a-ac50-c309b6ca023b", "value": "AetherBeast.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522fc786-6f9d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782285690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782285690, "uuid": "53fd5bbd-7448-4b35-bce6-e11c4ebd4cde", "comment": "Malware payload (AgentTesla)", "value": "8cf8af76ad86fc12897dc30a55f51a56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782285690, "uuid": "1e6d6dd9-ddd0-41b0-900a-3668ea1e2414", "comment": "Malware payload (AgentTesla)", "value": "bfbfc055824ea3e0b16feda40a04bd0a1b18f44618b3c6243416eccb471173d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782285690, "uuid": "79a0d634-eac5-462e-afef-1506481284e9", "comment": "Malware payload (AgentTesla)", "value": "fd53933b7e0e9c1629a20d3176101ff08ca1e33d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782285690, "uuid": "4a2a7e78-f366-4a3a-b4df-8ab579ebc147", "comment": "Malware payload (AgentTesla)", "value": "056071cdf11a45d587ee2a6ac3b0f4497869ca7eb30505a330986cd38fbfcbe8900d9ccbf62e179aec34cf44ca3ab8a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782285690, "uuid": "bfb96135-033c-4987-8284-0bd1c88979b8", "value": "T107C544ED45818579814383FF6F46B6684ADCDF92FA83CCA68B89757391F101918AF20F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782285690, "uuid": "8587c1ca-8715-45d2-ae99-30641848de58", "value": "192:hg/g/6CEluxNyHMrwRX7rDpCnO2L9QYQdbjo8f383D2s8Ve3gUmXQya5AXLcBQvk:aR6MGIn7rN1WTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782285690, "uuid": "59afa909-f05f-42e0-94c4-6a6e841a7e72", "value": 2537983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782285690, "uuid": "64c58457-2162-41c8-b3b1-59d148ef306b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782285690, "uuid": "1fc939d0-db9d-4560-bf58-ae50cc828d11", "value": "Quote 240145.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a48c815-6fc7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782303635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303635, "uuid": "f1e6cb6e-deb2-4905-bb4d-efe0bf837824", "comment": "Malware payload", "value": "9f597b54ffc7418789fb55058e7df10b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303635, "uuid": "53d82449-a35a-4a5a-a076-eb456386dd36", "comment": "Malware payload", "value": "c082fc1620bd7684da37b909d91e028444a7680d5a3ae311b49fbabf944798f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303635, "uuid": "9f1e0916-8079-40fd-bfcc-aa792819729e", "comment": "Malware payload", "value": "e084f47e40dfc59fee8db2d200c23bb1be9c1048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303635, "uuid": "77312f47-da18-4eed-8558-838a22af17ee", "comment": "Malware payload", "value": "3d236a860d9555cf1e75a3ee0dd63c74ed823b8c78bce75f1bf7a0bcab49462a842b5b9734720c7da40bd9ea36d80a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303635, "uuid": "3953dd5a-98ea-48c7-8336-c22fcee55ec5", "value": "T13018333B1335E3D2D1516F7411F63329F361A32C6B322C4EB21E58AE67A0645BB385A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303635, "uuid": "6cc3166f-e0d5-45d9-aee5-67749d6b0119", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303635, "uuid": "5c360115-051c-41b6-be73-45413071124e", "value": "1572864:Dt9IKPhZD5PKkVzGzEpZTRWYi4ZRyxMlMcGBc3kdUF91CAnpbOu/t7:DUK3D5PKhEpZTRWH+LlMJBSkGFGAnJOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782303635, "uuid": "ee7381b9-8189-4b97-83f6-e3b666e4372a", "value": 88780775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782303635, "uuid": "1026e0e0-0a80-4a79-ba35-852d99751694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303635, "uuid": "82637c07-d45c-4317-a5fb-353cdfbba5ed", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5b4b82-6fb7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782296740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296740, "uuid": "b3e3fb57-71ae-466f-9ab0-a647de2c7c5d", "comment": "Malware payload", "value": "956f60d70f15aa5829d55a1904bddb78", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296740, "uuid": "19eaea03-40f6-41f2-b22e-12393de16107", "comment": "Malware payload", "value": "c1ff355dcf854a5aee3c9645771070b516e117b189172e9517e1b015c314a7dc", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296740, "uuid": "7d2aea08-80b3-4d3f-b483-1c9fae0ba936", "comment": "Malware payload", "value": "2523455859b92e68bcdf8eae652935ba9555f4c7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782296740, "uuid": "152fe2ab-61ee-45f3-ac24-45d1ba7494bb", "comment": "Malware payload", "value": "ed9734a1dc322ad6deaccce80bae7eeadb71f46bc0e6c4d764d2052c03bc3e851793f9b7d1deb828a5d8bab4ab27a05f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296740, "uuid": "f034916d-e81f-4cc8-afd0-012c592cd51a", "value": "T127D633624F2ED40982503DF9DF4713E3B2BDDA683096B9CC28D1E6A573B23A47254BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296740, "uuid": "b65766b5-6da9-4803-b8cd-e57f5e7e89d5", "value": "393216:Y5/xtP0h515C/i9c2xrmeiXaUk6mKtBQdiqtY1Qvb2:QmLm6TyeYmMBQgrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782296740, "uuid": "231cd9be-9d3b-45bf-8b7e-961c8f082052", "value": 13364058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782296740, "uuid": "4d8a813a-d983-42cf-aff8-64b95a26543b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782296740, "uuid": "4ad36670-06bd-4091-abda-f211394618be", "value": "5 Luxury Beauty Campaigns Strategy Oh My Cream 2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e062925-6fc0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1782300850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300850, "uuid": "0209242d-05d1-43bf-b231-7cef6d87552a", "comment": "Malware payload (NetSupport)", "value": "cd8e28971cbb3f2726bb1230ff5fbb52", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300850, "uuid": "f396ca29-e9f8-4d64-a602-39649d2f8ac4", "comment": "Malware payload (NetSupport)", "value": "c2b7b186de9a6f745e271de00c9a6ecd748ac506e95bb667ef7a2c791017e392", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300850, "uuid": "21310583-106c-43c2-890c-0e7534f077a1", "comment": "Malware payload (NetSupport)", "value": "ce926e57cf80e8111b24eb64bd054da0a56b1e72", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782300850, "uuid": "19faad38-3ced-4c91-baf6-d24775b412b7", "comment": "Malware payload (NetSupport)", "value": "03a70c27285f38c0aba5931dec737c09586844e0845e81d69baac9ccb77d458f9a559bb305810c02e35bc0eeff1fd7a9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300850, "uuid": "5264ccf8-8208-481e-8636-92847852dddf", "value": "T1F016333B71263BB2E48F0974D4D7678B17284C160903689B57FF37A805B878274A7ADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300850, "uuid": "ada9eee0-440c-4ab2-bcd1-bba5fcf0df86", "value": "98304:5bONECMZhw8CjM4rC08/EkrPa8XHqvBS+77AprKL0T6q:5IBMZhwE5rrPtHqvMAoKL0T6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782300850, "uuid": "37e2365d-875c-42ad-b2b1-02542fa9729d", "value": 4022272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782300850, "uuid": "addce744-2acc-4d1f-a91b-111f2b747706", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782300850, "uuid": "860e6e6b-e1d7-4df4-a239-6b280d9fb24e", "value": "setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853ca786-6fb4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782295654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782295654, "uuid": "53ceac89-ea5d-4773-bc8b-6ea10e7e0175", "comment": "Malware payload (Formbook)", "value": "375e3e0945e1aae4a3ed38420238db1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782295654, "uuid": "8493b88d-e180-4884-9a4e-f1e5f682f61b", "comment": "Malware payload (Formbook)", "value": "c5c2c8515c39bb0752d0e4064af465978b8cbb12a762b0c2411297262c4230e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782295654, "uuid": "89dd0019-b299-42b9-82bf-878d953cfcde", "comment": "Malware payload (Formbook)", "value": "6f02fcb2e516ca88978750efcbd6810685c501c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782295654, "uuid": "9be7bb86-1136-4a0b-94e0-f047ee9814d1", "comment": "Malware payload (Formbook)", "value": "14422f730e25d41e223d47e66b06af49149a8abfeea2d31925b3312964d6c3466116751fe1e83184fe91d168033fa1e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782295654, "uuid": "ab6ab9a3-51fd-4d59-a108-541d7592d6f3", "value": "T1F6351250335DDA01D89A47B55871E2B813B47E18B921D3079FFABEFB7933B496818283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782295654, "uuid": "cf9f4a1d-76a7-4c51-98f3-f6e7b785c441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782295654, "uuid": "53636197-e059-452b-83db-daa4070144c6", "value": "24576:Y/g3hytuimnsKCE/L65lXjQxjfKkUpJ5T4XnxSr9nCjhZzFTSwQnd:guioncRgTKnLT4XxSruLFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782295654, "uuid": "5c1d28ac-d2f3-4d0d-a83a-0f74b6ab4cc0", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782295654, "uuid": "6ce1210c-d2ff-4073-8bb0-37b1a037db0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782295654, "uuid": "d06a748a-c7f3-425d-8c01-a12afa6fd8ec", "value": "MAERSK FELIXSTOWE - MF-E-26-024~028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf03327-7005-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782330646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330646, "uuid": "a2d5186c-650f-428c-ae99-805b29789fa1", "comment": "Malware payload", "value": "84184f95b7743e1c9c534587e7fde316", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330646, "uuid": "67a6fdcc-3522-4f3b-875f-821d1772cf18", "comment": "Malware payload", "value": "c5dc6d8f325c125fba0a9ceea0cac957642fbf0a38bd4da867a82f6f06962d45", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330646, "uuid": "968136c4-d9d0-4ac5-9301-90d07fa612a5", "comment": "Malware payload", "value": "c805757eb686b7755a839715d413a55827881fb1", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330646, "uuid": "715878e2-642d-4996-b251-54045e8dc6d1", "comment": "Malware payload", "value": "c3b9315cafbc49524b4f0873df72de225439b3d4b819abdf709460369cf67be508d1de5e50d88d774d389e388f267b38", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330646, "uuid": "bb9d88a0-21aa-44b6-b139-39444b3669ed", "value": "T1A7562380FF46D92FC47B44370E524731229AEE2E8696A34384EC3A1D6C776E44ED9ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330646, "uuid": "1cc0d4bb-17cb-48d8-8b62-a229ffd9be87", "value": "98304:f/LDuZ6OAyu8AMJm5eDxgZz7ITd61FT2cLW9Iby+4Sb8igkM0cmOF2:3LDuZ3AyuLuRgZzETd61FTDoI++4SbgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782330646, "uuid": "b2b5eb8a-412a-4722-a631-e2732d69dd8a", "value": 6024466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782330646, "uuid": "4c3b5198-3971-4c41-a1df-db28e26d887e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330646, "uuid": "f70c4850-0be4-4a79-914f-69eb1e6bb6c5", "value": "\ud835\udd4b\ud835\udd5d\ud835\udd5c_\ud835\udd4b\ud835\udd52\ud835\udd5c\ud835\udd5d\ud835\udfd9\ud835\udfe0+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901026bd-6fe8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AZORult)", "timestamp": 1782318006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318006, "uuid": "c72e300f-9ed3-4bd0-9c09-be9d2ffd8f75", "comment": "Malware payload (AZORult)", "value": "226dc0a0f19f82bc6e4f08d7ebcfc9ad", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318006, "uuid": "87b6d407-8b9a-43a1-a009-75b4e694695b", "comment": "Malware payload (AZORult)", "value": "c6c2dffdc7a7e00a8f726f1603b0001ae7244a5fc9db0e3064eab684c19f6b77", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318006, "uuid": "8dcc2ed9-b524-4c60-9505-a15d1d6d91d8", "comment": "Malware payload (AZORult)", "value": "e19037fba59f57e964fa6467db08ca373623eb6b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782318006, "uuid": "8e62fac3-8d0d-4a6f-8993-521837f6b8a5", "comment": "Malware payload (AZORult)", "value": "6951413186cb296a0c9f3f0ea4cbde7ca55e41acb80fb7f60c0367e6f9d4833a7476a33ece27f7146a336eca03e22998", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318006, "uuid": "1ad22d7d-75aa-40c0-8a46-85956ff7312f", "value": "T1EB555922DD773A8E32A0921017F3393D1BBE07E094199EAC826915874397FD67ED8E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318006, "uuid": "58fed45c-c11f-49a8-a661-3d2cc026f62c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318006, "uuid": "531abf09-ed5c-4e4f-98ed-454a3239e067", "value": "768:P+XGU61bijXjpqHHYrinbmCUPT1rwcbuqRfiugqWCGLt9YLWAfar+qaXjGFhpy69:P+WUYbijX6YnCUB255Ckf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782318006, "uuid": "3f2fdf41-cfca-4649-9055-b41e3e9c8d44", "value": 1321472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782318006, "uuid": "ad4d6c2a-2ccb-491d-814b-1461ca0e6195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782318006, "uuid": "ef84a04c-dd29-420a-87b8-a32580e409b4", "value": "226dc0a0f19f82bc6e4f08d7ebcfc9ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b37df90-6fbd-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782299503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299503, "uuid": "4c702bf9-4d78-4d61-ad75-6b7bdb771b35", "comment": "Malware payload", "value": "7f9a4aa27e5ddf85f56930b9f39eefaa", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299503, "uuid": "50bc780e-08d3-4ca9-b9f6-56e0f47c76a8", "comment": "Malware payload", "value": "c74bb6fb848cdb87c2b4261da1efc078023cdf95aa7b1436c52c26f3a11025af", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299503, "uuid": "adda4d35-dc61-4417-be59-b690eb386870", "comment": "Malware payload", "value": "33cff0ecea7ad564746e2c181fcb973e4d48772e", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782299503, "uuid": "4ba10993-51ea-49a3-b0e1-74baf9638c7a", "comment": "Malware payload", "value": "583069cf4b20840263efbe34386035df0ca89104f8f4dda1190ba0cbe78128b85398f5f4a3f3ba98e40d4d69a7f734ab", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299503, "uuid": "e954dc6d-3be2-445f-961d-d560d08f9c50", "value": "T142D5DD4166E91204F176FF3B9E7AAB84443BB991EE30D75C8B60CC2D29A5A10CD35F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299503, "uuid": "d5ef3d3c-88a2-45e4-be5b-69d4150a7140", "value": "192:shDqQyeDeR1HDqQO7eT4kHylAxrespmaGOlAxb7egH+VX:shDqQBaHDqQHa769VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782299503, "uuid": "d1289a19-f743-47a2-a65c-bee997510714", "value": 2785016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782299503, "uuid": "a053936a-31b5-4029-ac78-096a937c9c7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782299503, "uuid": "266aa359-4aca-47c3-b97e-7d2a50ee54d9", "value": "spisokszch.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dbebc4-7008-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782331734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331734, "uuid": "d5dc81bd-897c-422c-9856-3178397ff093", "comment": "Malware payload", "value": "3b118526e29c49ad3c6de1502c045576", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331734, "uuid": "afd43ce5-7219-49fa-8e6b-7c2883112cad", "comment": "Malware payload", "value": "c8e59f57038524cdd3f42fd80d4c721d0d2356e4f616079cd78ed90bb24edaa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331734, "uuid": "39202507-c004-4115-aa14-31ea29a5a6bb", "comment": "Malware payload", "value": "cbc31e1c6d3f8c474e6eafbb0a0dca1e3fd29835", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782331734, "uuid": "f06fc092-3bfe-444d-b752-227ea7dff408", "comment": "Malware payload", "value": "a9202c840d22e46c3d5b928e453c5e1b6b03d912c45e13b2ea6bcac29a5d153a21170a52f703acaf462c03a60b59dbe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782331734, "uuid": "38820fbb-ba32-41b3-8c9a-07216260f498", "value": "T1D7A3D54E2E628F6EF76D82351BB35F35C654339B2ED4C641D17CE9056E2020EA81FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782331734, "uuid": "70f9c94a-c956-4c81-93bd-a01cc398fd5d", "value": "1536:7WIQIYviFU6gaVbUmaZkFE8gEKxIhb5mlznMxE7xsB8K3ZsEvEI4Yka98tdSEbTc:7WfBvii6tvhQsBdvEI4Yk5TSOgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782331734, "uuid": "4272263a-baa6-4684-9f71-b84b501447d7", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782331734, "uuid": "b8d58953-2a75-44ae-b294-703698287836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782331734, "uuid": "91e7803b-6d90-4516-aa62-d37e68c76312", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66455b42-6f94-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782281858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281858, "uuid": "26c6f927-bbb8-4bf4-8eff-175da15b0b55", "comment": "Malware payload (Formbook)", "value": "7220cea0b37505fd83bfede300141504", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281858, "uuid": "7de6820e-f704-4f26-8eaa-a3e121f485ad", "comment": "Malware payload (Formbook)", "value": "c8ecede68b9b5cec883c8e6338932e859dbff782db0734bd3312c811d14ec755", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281858, "uuid": "c6f5cadb-b2a4-4ebd-a317-d20e8ca1edb5", "comment": "Malware payload (Formbook)", "value": "adba55a83bf2dbeac96537c2a039df852bf99a7f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782281858, "uuid": "c93946bf-3727-42c1-80c7-08a603372b6a", "comment": "Malware payload (Formbook)", "value": "c26488fb8210bb5c62506ffc7387de272e5d72dc47f990df605932ec8ac087fbb391a9cbd8470a5c19d1ea80e77eb77d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281858, "uuid": "a49d174f-a4c5-4081-b1ca-362f058183c5", "value": "T1DA95F1004AC46FE88FE95B1D60BE251EF3A00A8F5519A84AE733FD46BFE760456071F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281858, "uuid": "65aafaa6-f99b-44e4-9aa3-733cc9cfc71c", "value": "24576:8S8/2j/9GICMJBiQ9j+jJ67lyN3cSxY62QkCVdBv2TYQphAOwPA/9IfYtLM9sTrs:8De/Ihjblc9UO8oPz9FFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782281858, "uuid": "bd1c6554-7b4c-45a0-aaf9-4a0242125fec", "value": 1988929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782281858, "uuid": "834fc43e-311c-41c1-b597-c4ea196cdff0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782281858, "uuid": "c6c3784e-2a51-4af1-8059-541588b51ab8", "value": "RFQDMBU0083 - SPECIFICATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cad010c-6f9f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782286486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782286486, "uuid": "33109012-5a43-4f33-9372-27a6ec8521f3", "comment": "Malware payload (RustyStealer)", "value": "1a070e260d9d1dae0fc08cee290083d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782286486, "uuid": "93efeec1-257b-43ff-a85e-19f563063f88", "comment": "Malware payload (RustyStealer)", "value": "c9ff5a3b66a9ae58adcac9a7add8a9560f6e5b104b4fd54170f527dc1e08d1d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782286486, "uuid": "cee66b0a-64bd-4f24-b442-fd4c4d2d0ace", "comment": "Malware payload (RustyStealer)", "value": "c74ed6e44eff9b4f9f619b69c03801567cfbd5d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782286486, "uuid": "ef4b6bcb-bad4-4e1c-9500-c751303d64a7", "comment": "Malware payload (RustyStealer)", "value": "56f6e991d8236e0f6c0f55ea686951f5a8905a7752ce884e7579e0f34b9b52d73846ded094769a025abc7751e120c978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782286486, "uuid": "2a229289-9c45-4fe1-aaca-34db415b2d98", "value": "T100C65B43F26291ECC12AC07483166233FA72BC49473576EB7BDC7A212F75F906A29B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782286486, "uuid": "9ce7cc82-5cdf-4367-b391-136dd9a4cf79", "value": "51183827f0ce52372764212ad55e7f2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782286486, "uuid": "8c41442c-001a-4b75-8782-8fd05d5cd2a3", "value": "98304:ZDUs653JTRt5lHuY3DKhDFhhr58mDIXEu/w0KrU4r+UJIMlih9wtCb8wytH+/1EB:f65JRKWE1pTwmM1Y11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782286486, "uuid": "e5cbf14b-5784-4c8d-a076-d01c0457c586", "value": 12592640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782286486, "uuid": "e0b3ff4b-4f74-43fd-a4bb-94d6eafd0b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782286486, "uuid": "e101108e-0ef3-4e13-b28c-91cbdaab4cc1", "value": "1a070e260d9d1dae0fc08cee290083d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ab97a1-6fa4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782288647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288647, "uuid": "45e0a3a3-0aa9-47f1-90c2-77577a7713b0", "comment": "Malware payload (AsyncRAT)", "value": "4a9168f5ef1b6c3a71bca2fc58fe89f0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288647, "uuid": "d21aaf43-7803-4cc2-9aa9-a16bfea21f86", "comment": "Malware payload (AsyncRAT)", "value": "ca9c11c113a141809f9f5dfb294f124f6e232cc5d83f2097c99e77c7753e9c9e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288647, "uuid": "deb22df0-0a16-4328-b6b8-f4bf0846eb3d", "comment": "Malware payload (AsyncRAT)", "value": "08e07973239939aa44bd3d850c151ccaf3f974d7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288647, "uuid": "52d1e0e6-3d5f-40eb-9870-06590fee90f3", "comment": "Malware payload (AsyncRAT)", "value": "59f008c4ec2f1e10c4d9895a32b8bbb81d7e059c693dd5b50ee9c9c45845794857e5e7305f083ccd1442e6a609c18a0f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288647, "uuid": "c913c494-3320-4234-beed-eb27a32ee446", "value": "T1B7654387DBDE8A1BB223F9C488F3EC0485FCB5295DE754BB8458127D20578218D92E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288647, "uuid": "d86abc18-2131-4496-abd8-9fe5ba052e18", "value": "768:gxPeIWh2W+spO/tZVilhYPND2Ql5VhEK2m1nc0a/QAJIIozKPiG:gQ2EMViDY4Ql1cpYAWzuiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782288647, "uuid": "eaadbff7-c6e5-4be3-b49e-c36fb76f9061", "value": 1440770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782288647, "uuid": "5eaf9d7b-842d-4e9b-9d04-1623bc87445f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288647, "uuid": "f48207a1-3531-4229-bf65-9397cf4013f9", "value": "e-dekont_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d65cb1-6fc3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782302051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302051, "uuid": "41be47ec-7d6a-4ccc-a9ed-794271d7df51", "comment": "Malware payload (SilentNet)", "value": "de1c24d29ec282b0c0613237e1c7169d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302051, "uuid": "beb26af7-fa25-4ae9-8888-7a346b31677a", "comment": "Malware payload (SilentNet)", "value": "cae1a958b3e0d7d640c385d7d2ce6fe3229bf973c28bc39a55c1fea00192aa62", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302051, "uuid": "7fa5314d-cab0-4fca-9deb-5dd7b368e23d", "comment": "Malware payload (SilentNet)", "value": "0e7624473032fc5a2d50dde0be5b8f788b2887a2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302051, "uuid": "3b3ec09e-a5d5-4485-b292-b9890c05d682", "comment": "Malware payload (SilentNet)", "value": "7ffeee83f3309f7614c8d675f4789f659912e5b5a5dd80bbb8601ab6ddf0ab5ba75954bbcf9056781aa97d4255b1ae77", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302051, "uuid": "47c601db-ed4f-4539-967a-a29768b53078", "value": "T13C5401629FAD3421C03734F5BA99A940ADF987E4D902904F0FFC65C24A9325B4F58B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302051, "uuid": "219c5e75-2223-4948-a0dd-f31bfdd0c706", "value": "6144:slHoCx9e26znYDmgODjwvxvjtt/6SPYn0sE8jf59gRTwzgnmiiTKS5DEWzGjk:ooCx9e9sagOvwvnt/LnMjf5982NsoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782302051, "uuid": "2e7f3284-597b-4838-b376-42431312db2d", "value": 285620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782302051, "uuid": "10de450c-a46c-4070-9b2d-af6f53794324", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302051, "uuid": "63df4c8b-b91c-496f-958b-0b07186b00ba", "value": "Wizoxaddon-injected.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe68c62-6fcf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782307134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307134, "uuid": "f322a0d5-3962-40f4-87a9-60dcd437b35b", "comment": "Malware payload (Mirai)", "value": "bf822b0871d4b27da527a6081a8675f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307134, "uuid": "3fce8139-8d1f-40e6-b32a-4614c5719d1e", "comment": "Malware payload (Mirai)", "value": "cb7135750ada586da22c1914bb7565e7d8235d492fd1da20c4b35cf6e798a17b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307134, "uuid": "dc5f2708-bac0-4eef-83c6-331fdc6aa8cb", "comment": "Malware payload (Mirai)", "value": "f90e1e5d4f5c1676b3c09dade91a95ba88d96d5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782307134, "uuid": "17531ccb-d011-48a1-9b2a-e7e51044b5ef", "comment": "Malware payload (Mirai)", "value": "26a141afd1ecff754ca54b6b011747d1c88b9384fec8adc4f47ef4a1dba0092d266357649a5582fa416f4e271e51df1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307134, "uuid": "34112111-fea1-425f-9d18-8c2bc9311375", "value": "T19DE33A02770D0F43E1132CF0273B1BE18399AED115F9E585752EBECA52B5DB66181ACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307134, "uuid": "5b0ee721-5a13-4010-be3f-fd72a00a5251", "value": "3072:MkVJMkQMjtz40N5V9B3tRSuf81g+iu88Skn2TvkirZ:MkvRxtzB/B/SuE1Pb88SknAsSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782307134, "uuid": "035a2a1e-2dc0-408b-9a11-f6bd8f7d5440", "value": 151568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782307134, "uuid": "c2ba2cde-b1da-4f8b-a3d7-1ac0db045fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782307134, "uuid": "9a5c3b09-4a13-4aaa-babd-1b437a4bb8c8", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94d3c01-6fae-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WikiLoader)", "timestamp": 1782293138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782293138, "uuid": "ad750cb2-01b7-446f-b099-831222ce041f", "comment": "Malware payload (WikiLoader)", "value": "9f36877ed925f1dc2cf53db235c53b8c", "object_relation": "md5", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782293138, "uuid": "c1696907-5790-4367-8903-af0845dcc9cf", "comment": "Malware payload (WikiLoader)", "value": "cd078957167e1af4de39aecdb981cd14156fa81d5a9c6ac51e74ae5b6199a12a", "object_relation": "sha256", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782293138, "uuid": "4ec0c075-256c-4907-9966-9fa89d279ad6", "comment": "Malware payload (WikiLoader)", "value": "5a1fe9e72e94d4c92b866f1fc167a5bc098b70bb", "object_relation": "sha1", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782293138, "uuid": "a82f5838-772a-4437-8651-1ca4b0669836", "comment": "Malware payload (WikiLoader)", "value": "cdcb29daff085f3b6461f0e0141efa52a15269e0e2410fdc41b60253c6bacff15f1f6d0010a54ed01d4077eeb125dcbe", "object_relation": "sha3-384", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782293138, "uuid": "64f92488-7d41-4a9f-a01d-0975fe89fbdd", "value": "T1DAC6331F31D0CAB04F5D5037287D33AE40A64E9919ECD581413BC7AD3F3A2EA15AB9B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782293138, "uuid": "b271ddca-bee5-416a-aa69-d03ae3c447c5", "value": "196608:AOjqC4P7ZYTfbEYyFFSSMJd9e+kXNT9v2vED9O9NhweQgl+LY0jBE+h:AAqCudYP4TnMfUNT9vO698hTELLE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782293138, "uuid": "d3d40f4e-9412-45cf-b926-160035daa7b0", "value": 11614504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782293138, "uuid": "245f4bf6-c79e-472f-b068-ff0f6e4d4a77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782293138, "uuid": "9ce1f07d-e46d-4614-982c-c5b449d4afba", "value": "cd078957167e1af4de39aecdb981cd14156fa81d5a9c6ac51e74ae5b6199a12a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142d60e0-6f8b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782277855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782277855, "uuid": "c3214c69-4b42-4e02-9361-95c0a388f7b6", "comment": "Malware payload (Mirai)", "value": "11d82f1dc9f669669c2dee30281c7667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782277855, "uuid": "c9367d77-185e-4b0a-a592-e5d8e3f41c42", "comment": "Malware payload (Mirai)", "value": "cd16477300d7a6b1adcfcbeedf928e232aeeafeefdb0ec070b95f8e26b0c1288", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782277855, "uuid": "5b7afef0-d692-4bb6-bf70-c663fa9111ab", "comment": "Malware payload (Mirai)", "value": "6761bcddb9c9fe97dfecb3c9a85126743547d2f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782277855, "uuid": "16b44a4b-f3bf-4a38-9e3c-74dc33318fd9", "comment": "Malware payload (Mirai)", "value": "7d541c634176aa899a550f484858d9c7163f2f82382b6f19a1ec11f75a5416e1674a565360898a400b593689157de99e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782277855, "uuid": "c1f5a30e-df6c-4b27-8023-9595ba0e923e", "value": "T1B31449C3F900DDBEF80BE73784134915B130A7A214925B37B257797BAD3A09A0577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782277855, "uuid": "5cd39517-7c61-4e07-ab20-1427e42104e4", "value": "3072:6ewM4lgVTtorfbjt7NkJoaTMmGeyq/PSPGNiVPjbi/Le8zmy6hHmky:lwM4l6TtoPraTMTepOGNZLe/y6xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782277855, "uuid": "37aab347-7b22-49ae-8851-4f8e381dd83e", "value": 190688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782277855, "uuid": "a197c85d-59d2-4d43-bc1d-42bf6ce78e00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782277855, "uuid": "0caf350e-5e91-480d-ae96-74b54a0872c7", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba11ac8-6fcb-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782305463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305463, "uuid": "1f2f381e-8509-43f5-9b18-fde5e0aea4e8", "comment": "Malware payload", "value": "7fc18a3383cc72c9b901d165a8b28771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305463, "uuid": "89691768-69cd-4a0c-a659-5992c15e2567", "comment": "Malware payload", "value": "cd5a2e5352fddb3e46c36fe52ce460e3fbcf79a26b5421509f4a9a4a4fbd7c0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305463, "uuid": "38af8250-9a0d-41a0-b033-98bde3d2ca1b", "comment": "Malware payload", "value": "24806318708726bcb884e97bfda172e378af8ca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305463, "uuid": "ade882f5-288b-4611-9677-1d616bcfb603", "comment": "Malware payload", "value": "d6b1dc082c56f0315e5ab42dc4a1f23c60dd5e964a747cbd0b23af3ab10a4ac23dce94fdb9faccce142f6b41595ea764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305463, "uuid": "cd984945-211d-4cb9-a566-d0dc1e9ed84c", "value": "T10F083377F157723CE05A8A3575B69220983FAD1199030D2A86ECF88DDF356702A3E793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305463, "uuid": "6863bc47-44d6-4e89-8081-f75d8ffd51ee", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305463, "uuid": "97c8d1b1-7f53-4dcd-98c6-f89872c1d3d6", "value": "1572864:iSyoUioZrM9ABcshf7MCQXuaKA+EHdggT86/TEk71ksJTVqLu:iLMias1TYKIHdggT8cpksJBqLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782305463, "uuid": "fe1aaf9f-0eca-45db-be40-32eae277ce24", "value": 82371830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782305463, "uuid": "03afd2d0-e4d9-47b2-a482-766fb62ad349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305463, "uuid": "0080f537-b05f-45c7-bfac-420bced1142d", "value": "QuickSuiteSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125679b7-6f98-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782283435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283435, "uuid": "b8378abd-d31f-4509-89f9-66c732e1e928", "comment": "Malware payload", "value": "bc5f24922f2982889c242e8a5251db32", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283435, "uuid": "a17a1f84-24ff-49a6-8f20-cdd3cc237b41", "comment": "Malware payload", "value": "ce34faf2ec7f139a2f532cf395d2f45a12c898c94e0482dcf9b170f972787d7a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283435, "uuid": "cb8a2793-16cb-45fc-bfd9-70dd31d7eabe", "comment": "Malware payload", "value": "cff8916dc1531ee6af5274ca598b55a772de39ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283435, "uuid": "344d00b8-2865-4ecd-8138-ac343b908c52", "comment": "Malware payload", "value": "ef12b88403beb517ca52d904b813650c15ac23686ebe6232cbe1a50140da79c3b7b35eb8ea26beb09958bc66e66fbca2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283435, "uuid": "ab102b05-df5e-40cc-9ebd-91966fce368c", "value": "T1B0136D6566853C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283435, "uuid": "917a2b70-d144-4a26-8d6b-ddd0bcd4ec25", "value": "768:7QdXRWNGxVBE9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:Mnlxrpco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782283435, "uuid": "227bd66c-294f-41bb-a152-222233992ab4", "value": 45529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782283435, "uuid": "a4778bc4-26f9-4068-a643-d808c707cc20", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283435, "uuid": "cc43b91c-f5ef-497e-a416-4eab207950eb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5723c72-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322793, "uuid": "22892b64-69f1-43ed-a148-8580bd860b5e", "comment": "Malware payload", "value": "342fee77354ff26d4993258afd930ef7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322793, "uuid": "1252ecbf-a5e9-41c3-9f53-1771438544e5", "comment": "Malware payload", "value": "cee907c40ab5b20ee6ee235e433134042b3803e9e3e84c3e2d3211989799098c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322793, "uuid": "43b83c58-b39d-4150-a435-223e5d171f5f", "comment": "Malware payload", "value": "5564169b17783b80f1e5d91b24b0a425c2629e48", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322793, "uuid": "ffd8aac2-029c-4fff-9312-6fd98028ea84", "comment": "Malware payload", "value": "c6fbf400aae511bf3820f3fb5903fb7893110966e8637cac690652b663c6e895d13056f8c7d46b8d44e368243f15193d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322793, "uuid": "522ea26b-c166-4c16-94dc-573276e61659", "value": "T149C60147FB448A5AC0F787F24933176126270E768B4397C769643A7D3C736E06E8A68C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322793, "uuid": "a7e33741-9779-4eb6-b870-c70bcc4fe7ca", "value": "196608:sTXRV1HSFEIs+gXkONXT+5UfY61/dc7/GQWADe+CcH3PjX/ROhwzQ:sTn1Hlh+gXDjkUfB1/dy/fKy3bRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322793, "uuid": "12bb2718-a012-4ae5-988b-7068f20ead60", "value": 12251348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322793, "uuid": "8d497d79-53e8-4ae4-aa91-4aa56506a874", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322793, "uuid": "d9d1dcd9-248b-4d36-b177-1c1f9589ffcd", "value": "notifier.lonce.app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b772f355-6fc2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782301751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301751, "uuid": "e38f79e5-f166-4d1e-a5c1-47daa8be16c4", "comment": "Malware payload (Vidar)", "value": "7c574d2bb2890a4bb12beedc47fd7116", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301751, "uuid": "ca91c425-3c7d-4ec8-83a0-6aadf807e051", "comment": "Malware payload (Vidar)", "value": "cfe903227ef28b4dd65ed53152788eb49ef09a6e517fec6644e6344d3607879b", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301751, "uuid": "bc35d7fe-b9db-46b1-be52-9c24f33f6c42", "comment": "Malware payload (Vidar)", "value": "c6ed98ee5aa67ca24ffc05a00f5a3b19e9d829d0", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301751, "uuid": "8d123525-2ba7-470b-bbed-becd864eb148", "comment": "Malware payload (Vidar)", "value": "6f5d30b8781dd2e1a1364bcbc1dcea42bd88b70c1dc9e8cca7cd50d71bcf9a2e820865c086ab873df3f1f6b987078403", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301751, "uuid": "6dff92d5-99bb-4c40-a8d6-345cb6da28d5", "value": "T174B502C3CAC21D8BCCD109386D6B8F745B75C89AF806CA539B32A6798FD73949C1A14D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301751, "uuid": "0b56ef2d-ce7c-4cce-8ef7-12cce77759fd", "value": "24576:wcP47M/5AKwhEUdH6wCY3nslhOPmukZ1uLTZ+l5PjblmCyx2PIHHW:5P4Y/2jPx1CY3nsbOPmuU1Qc3h1youW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782301751, "uuid": "66bd14cc-61c9-421a-b7a1-4e90e2505b84", "value": 2304558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782301751, "uuid": "0064499c-7d9d-4ac8-ab44-fce1357fabca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301751, "uuid": "7592a45a-669c-4615-bf81-adc683a14536", "value": "Loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac89c2b-700a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782332761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332761, "uuid": "4d72add1-faf2-4764-ab2a-95b92878a666", "comment": "Malware payload (Mirai)", "value": "b17532532560628d67674ca968c38b47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332761, "uuid": "db943ebb-e2ca-4c1b-9672-974c00789a9e", "comment": "Malware payload (Mirai)", "value": "d0310e982b671884e67580d627b1ad9dbaeaf2f68fef0611526615604ed93449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332761, "uuid": "49601ec8-f2c0-4f44-b195-0179280cfc73", "comment": "Malware payload (Mirai)", "value": "b0782a9d6eef2ce02f734a6e5e1d8e0f9a2b65be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332761, "uuid": "3584bde2-3fb6-4f95-b2dd-48436ce0e2ef", "comment": "Malware payload (Mirai)", "value": "30cd8e36a8a4528f31569b699d3eb7a1181b6496bdb001767a3093648d8bd111f0050f6daa47051f6a25b98fb1b2d82e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332761, "uuid": "b1a102fb-cf86-4799-ae4a-309163db9be0", "value": "T13063E75AF9819F02D4D620BAFF9F414933536FA8E3F97201D920AF6063869DB0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332761, "uuid": "1def8d86-5c51-4880-ba32-c6b930c27166", "value": "1536:19nLXBSGc3K5I8naya/9rJfV+LiEOfhOLYUc+/:bXQGN5I8naya/9ryJOfhOLm+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782332761, "uuid": "2389bbcb-d578-4781-8942-4b33fdfc2549", "value": 69544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782332761, "uuid": "14d7b127-839b-44a8-9e1b-fa83cf796f4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332761, "uuid": "c53696db-df08-4c13-9d84-51ad09b3b8f6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5f280a-6ff6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782324065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324065, "uuid": "c5f63a5f-02f0-42cc-ae74-2b77f59edbad", "comment": "Malware payload (Mirai)", "value": "70cc15ad411bd679c2650c72880f8d18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324065, "uuid": "8736dc5f-9d62-4671-91db-183203a1a285", "comment": "Malware payload (Mirai)", "value": "d0d085ef9ac0061f0ccb137d87d0a5b717f94d0fa619646b7502ca9947170df9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324065, "uuid": "08098905-d02a-40db-8619-21022928b0b5", "comment": "Malware payload (Mirai)", "value": "ce2c4a9e46e36030106414a730ae88c975460acb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324065, "uuid": "c0f400e4-b1f3-4de8-be93-41074e2b21d7", "comment": "Malware payload (Mirai)", "value": "d98f19fc6894e94e6c7328f264f755c9d8d3d2c1dc8395c64a9d49ea0ff940536cb024a38a86631876e472b043cc4098", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324065, "uuid": "99941071-3724-4d3d-bb0f-0d77d3e97b57", "value": "T11AB30952BE419B13C5C321F6FBAE42593B136B7CD7EA3202AD24BF50274B8DA0E36551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324065, "uuid": "1964f406-e1ee-4102-a8f5-1f2c12e89093", "value": "1536:iIsNPt74tuBdSzB4IMXHT/AuZkDofTc63urTdjmukzE9JgxNSZG8O0OMaBV1SSB/:gNFNBdz+Dox3uPhDQE9GyiBT8NU166", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782324065, "uuid": "78f2a02b-53c4-4af8-954a-5af7637a19af", "value": 117092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782324065, "uuid": "1e282ff2-30d3-4f54-b2a1-a3dbb20da3b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324065, "uuid": "f3201acf-0707-4c14-b656-758ef9e7484a", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421b8f72-6fa4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782288669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288669, "uuid": "b79bdeac-b42b-4dfc-a476-67fe9bf60fe3", "comment": "Malware payload (RemcosRAT)", "value": "7556863f1628506a4a2c2f65d901b669", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288669, "uuid": "c1b05746-154f-438b-8e32-e1ce5d893f34", "comment": "Malware payload (RemcosRAT)", "value": "d13f0a4ce47f11f16e95b36e6833b13406546644cb52bb96f2017b64de0c04c2", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288669, "uuid": "75ddf717-6f21-49f4-b2c4-0e87265d1866", "comment": "Malware payload (RemcosRAT)", "value": "c981753024346ee408f949a60f416533d1a2e6ed", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288669, "uuid": "f4136247-53f5-431d-9ffc-32c260537607", "comment": "Malware payload (RemcosRAT)", "value": "f8afdf2b32be2a7cf6ed9c75f062082abcbb3c88e47f9ee75b6fc37f943a872b8028b6238b4e7f8373710b48a8d513b6", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288669, "uuid": "d2b20612-614a-40d8-a9d8-59ca0eb8a0e2", "value": "T1CFB5233BDA839D9BCD1E0174966B6095791F1E22BB147E6E370C7B6A68B703083F590C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288669, "uuid": "7b5ca4c5-b6f5-4762-a63d-a6559b3518cb", "value": "49152:BmwNjA/jmSsKftqJoQmuo/OBMmwNjA/jmSsKftqJoQmuo/OBIjbVw2:V43lP43lV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782288669, "uuid": "e3f6e07c-ec3f-4395-82ed-131212e4ae46", "value": 2310656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782288669, "uuid": "7ccae348-08c2-449c-abb1-7a2d7f6cdc79", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288669, "uuid": "b099c55b-1dc7-40d3-bc19-44c55b286af6", "value": "Ekli Sat\u0131n Alma Sipari\u015fi \u2013 \u00dcretim S\u00fcresi ve Teslimat Program\u0131 Talebi.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0ac821-6fa5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782289032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782289032, "uuid": "acd229e4-cf09-4941-8b25-a160f86226a6", "comment": "Malware payload", "value": "6c0361c9582f7c7b75e8eb9421540e8e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782289032, "uuid": "587d9197-b436-4885-9d3e-901b97327e07", "comment": "Malware payload", "value": "d20720b6e1a673e48c47939243bebb8f26892f8f63c9fac94795282798be0473", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782289032, "uuid": "721e0482-41fc-4526-a2f2-403144e19f71", "comment": "Malware payload", "value": "c305f085786e54f6ee59c355717b5bc3383159dd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782289032, "uuid": "fd54f872-0af2-40d4-aa90-53f02201156b", "comment": "Malware payload", "value": "6dbf666fc7c6e37ffe74aa3f6c1a490d73ca6baa2ec5df941121147d832183a613bee70c34f673084bdaad96553b1caf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782289032, "uuid": "69b398ea-3d51-4b7e-8e7e-267093ffe31b", "value": "T1AE31458B00516E391612DADD77A3358CB04D91EB289FDBA4DC484EED82889CCB356BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782289032, "uuid": "de9a105f-c799-4cc0-b97e-f6e080a911bf", "value": "24:YZmToZ1beJQD2XC0zroRDyzl8TgeXUh39lVvHJ8YcIra:fTMeW10qTgnViYcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782289032, "uuid": "de95280a-d296-4324-8211-0d4cd158bcc1", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782289032, "uuid": "1031664b-3cbc-4a3d-8d1c-ab22f940a811", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782289032, "uuid": "aec38899-55c4-4816-a4e5-5f7c27c9daea", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be47e088-6fca-11f1-ac1e-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1782305199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305199, "uuid": "c44dfd5e-8827-4035-81f2-bdc5a91d3366", "comment": "Malware payload (OverlordRAT)", "value": "1a0a744c7cb1c146fc8786bc4c469f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305199, "uuid": "01e05f47-58b3-4991-9921-eb00bb954257", "comment": "Malware payload (OverlordRAT)", "value": "d2894f596a9d4440c61ec3c929c05591a4cafbb58599ab97fee1b92c618a3939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305199, "uuid": "165d4d13-5d61-4b4e-a8cc-261c8559d14b", "comment": "Malware payload (OverlordRAT)", "value": "a95a10d47493f03483a9d17e6f8c2e2ab62e2822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305199, "uuid": "56ab0a26-a993-41b1-83ee-1fb5259d7b5c", "comment": "Malware payload (OverlordRAT)", "value": "882a572112e9e75646529b6497634d40f6047378a76163ac4d010a62facafa264887a1b3092bb2cfd31e63f02a996a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305199, "uuid": "0d3bc57f-3ed0-4b79-8275-56ab144d7048", "value": "T1CED65B57F86605E4C4AEC571C976A623BB713C485B3023D72B50F6282F76BE0AEB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305199, "uuid": "837dd374-1fb4-4701-acae-f38f463eaa2c", "value": "91be9fe4e1719a73bee1338189045908", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305199, "uuid": "bfd43d5b-c19d-4019-87a9-8144bb61abd1", "value": "98304:8sXJ3/B+O9aV3BdF/OfRhSxRHQELv9XLUUs2RWDlGLKrom/Kw95am:8evBVQcRhSFIDlgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782305199, "uuid": "8e486b5b-384c-4a48-ac10-5485579426b6", "value": 12894720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782305199, "uuid": "33279c8c-d43d-4118-884a-2431ca6d0d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305199, "uuid": "5c0429a0-12c7-43c0-b7a2-b5e28a74a5b8", "value": "Fishstrap-windows-amd64-fd0ac5fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4a679d-6fa2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782287720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782287720, "uuid": "ca3e2952-348f-4690-98dc-3c888393bf01", "comment": "Malware payload (Mirai)", "value": "96c0e2bb194dbd7a2749f8ca8e43f60e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782287720, "uuid": "5622b639-e132-48c3-92e0-2ec4d70978e8", "comment": "Malware payload (Mirai)", "value": "d39591592b08b4b96ff9e7681e048c0803eed713dadc9eae469f205eb4cdf841", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782287720, "uuid": "d5c295a2-dd2a-472b-b26a-e3f8568f4770", "comment": "Malware payload (Mirai)", "value": "a1e57af0c4de3680630a1d86d1e54f72b0174193", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782287720, "uuid": "ec790645-7238-40df-8082-e8cf647d6389", "comment": "Malware payload (Mirai)", "value": "63f1f3e3b1ceec3e44360f104234953fbedd013b24e0715d12a20c6e760b09bdb0976acecbd15af6e2ac6eed2398e6eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782287720, "uuid": "40838849-8b11-4748-be8b-39d64a42fa4f", "value": "T1D5634A89E643E8F0DC0111B015B7FB7AA672C4641128BD57EB8997BBAE13E12F90578C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782287720, "uuid": "831735f0-1a33-47e6-8c1a-4fee777cccee", "value": "1536:fbybtOCfl22ah/D/mGRrMxU8m9ZJKhhThyhCjhDPbZu+NczQs4WQeYgW:fubtOk22ahrOGFl8mFoPtPbZu+sQzd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782287720, "uuid": "8a22fa6a-cca4-42b7-a260-56ad21e020a0", "value": 67248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782287720, "uuid": "13e272e4-076f-47c5-9b80-f34f6d603eeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782287720, "uuid": "e85938ad-0deb-4e5c-8534-118aa49e3135", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bd839b-6fda-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782311784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311784, "uuid": "38ec0052-9a65-4fab-bf56-2dfece9d088a", "comment": "Malware payload", "value": "dbacc4ce4e43a588b02dc435a2d2c8f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311784, "uuid": "11e74fb3-86a5-409f-a98f-e7f7cba7c6aa", "comment": "Malware payload", "value": "d3961de88685bcad6385becf06dad8772b0a1f9f572ece4238f943f077d46d0a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311784, "uuid": "1492e7c9-d90a-4913-a6ae-0316d6936dd1", "comment": "Malware payload", "value": "1deba14d2e141cb83dc718cce5f8ac5a18439c21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311784, "uuid": "f1d0e591-cfb0-40c9-99af-30b053ca30a6", "comment": "Malware payload", "value": "c3be8af2912675d0276edccf4e54cee62c33ae83fce41abbc1d35cddedab535c880759f073fcd210d460b73c03fdc812", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311784, "uuid": "215989c6-2ba1-494e-afb6-c7526f3730c1", "value": "T1C836339971BC92FCD205197080ABC923B2B27C7E56FE6E0B8B8049791D53F56B790B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311784, "uuid": "72dd0c01-b763-42e1-8aba-e699261d7aaf", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311784, "uuid": "be9b689c-f776-40aa-9239-a9a3bf96dcdb", "value": "49152:RnnMSPbcBVE1INRx+TSqTdX1HkQo6SAARdhnv:1nPoBa1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782311784, "uuid": "21350139-680b-4000-98db-94eadd4104b0", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782311784, "uuid": "ee80b96a-3c9b-4d51-8b96-36369d55125d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311784, "uuid": "4b6b1aa9-f0f1-44f0-a7f6-9384ac2566ba", "value": "d3961de88685bcad6385becf06dad8772b0a1f9f572ece4238f943f077d46d0a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0cbdcc-700a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782332575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332575, "uuid": "506862c2-2368-4a22-afb5-c4282261325e", "comment": "Malware payload (Mirai)", "value": "b7a3f465f14e50d15e50b04dd16cb8f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332575, "uuid": "11484b39-bcd9-49dc-8a0e-8e0fd9392140", "comment": "Malware payload (Mirai)", "value": "d3f573839eb3a0ca6c7f6a53085d1eb9b8cc258f63aa404946b4cf1c4e8db7cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332575, "uuid": "abc91d28-cf8f-48bd-bdb9-8edd322b201b", "comment": "Malware payload (Mirai)", "value": "6f689a1b1b9950a61a3d11a3993d2d0f213e5d05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782332575, "uuid": "4122c2f3-6175-4a6c-8257-ccaf2bcc190d", "comment": "Malware payload (Mirai)", "value": "715a0a2661de47907dc08197c6cc42a40353b6018371f8b058844347a803409ec05c36b90e059918df5ab0227fa9e184", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332575, "uuid": "eaf71494-9c49-45d9-9e5e-0844f497727a", "value": "T102C31A56B952DB12C1C321BAFB5E514D37136FB8E3ED32129D10AF60278B8DB0E7A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332575, "uuid": "49d5ed69-8c5b-4b56-bc32-a3694127fff6", "value": "3072:OhRUd97soHwQdD6sYU7mKn+vlRaVDFYHZDZBEUYdwE6:Ow/7tHwQA1K+v3a92ZDZYdwE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782332575, "uuid": "4fc10e6b-e8cb-4d31-b4b3-1a1ae1f3a85d", "value": 128712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782332575, "uuid": "7750e182-d329-47f9-810a-92ccd302e9e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782332575, "uuid": "9c58cc4a-2b55-4981-8eb5-f20730b3f821", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e551696f-6fad-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782292809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292809, "uuid": "ccd326cf-00a8-4006-9725-86bd14f84684", "comment": "Malware payload", "value": "0e467a42336dad929ca08e55e5e15506", "object_relation": "md5", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292809, "uuid": "1644b77f-cf9a-465b-9dd9-406cb17c7bbc", "comment": "Malware payload", "value": "d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45", "object_relation": "sha256", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292809, "uuid": "2ecbc40f-836c-4ac1-8065-09b5c800e389", "comment": "Malware payload", "value": "f7c30fb200395ec44b4eba7936786fa1515197a4", "object_relation": "sha1", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782292809, "uuid": "d1dcbbb8-0356-4b9b-bdde-b57c832e2516", "comment": "Malware payload", "value": "49595f5800330d031888d8d000b4f3de67e9566d9ce551fba114fdb8bbbb368006e1d5e5b58a0eec82ac8843cfac59f9", "object_relation": "sha3-384", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782292809, "uuid": "d961e83e-e80b-4576-bb81-4fbf57f2bbdd", "value": "T16AC294DE419F9D50E2271014198FF680C20DA7AEB492B68BD335BF1DF68D47812F629B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782292809, "uuid": "3afefc3c-efd7-4ac2-a64f-50f288e7c90a", "value": "384:Wfna0tQXtbKBgDnKW8ge0ZNvA9XBCAhAdF+O:WflyXFJKPgeGcAdgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782292809, "uuid": "8e049f74-6e5e-46b8-a01e-b885fbe4ae44", "value": 28148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782292809, "uuid": "2762948a-7ccb-4d4b-a35d-0909f3d9f9d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782292809, "uuid": "d597cddc-05e9-42cb-aeab-2ff44bde130f", "value": "check_bot_m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47256fa5-6fa4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782288678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288678, "uuid": "2c90acdb-cb03-49b3-bd9d-91727a53477d", "comment": "Malware payload", "value": "986f66510d4e0701f47d0c3b35d705e2", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288678, "uuid": "a3622deb-5143-4ea7-8f66-b9fd635efb30", "comment": "Malware payload", "value": "d5c9b643b5c7e4f1ca90f8f6ccaeb24f681441ce9fecbe5154416ad661143b2e", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288678, "uuid": "a6ce417b-9d78-4fd6-89f1-f5505e8209ce", "comment": "Malware payload", "value": "924f979eab2ae7329fe03edcb5bf7914919ade7c", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288678, "uuid": "9a8f4d3f-c98a-4a12-b549-0171a5a08459", "comment": "Malware payload", "value": "5f36d172155d1092158a20c9ec57e86a0910d4ed71bb8e78c954911b61e8e62f0e76371f0a0a4eab38d85f2b2b4e4dba", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288678, "uuid": "f0f16ab3-7e14-4712-a486-de5ba0e041a8", "value": "T13455012DDA02AA1CD22A943CC30F74D1D988A0637201E91F399DFD191F872E7975EE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288678, "uuid": "dff1d292-cc19-4326-a9f8-92e46851d521", "value": "24576:NLdoU9BiwIiaa9dAYWeSDz8aCea9YWDru8eRv0o123bT0o1K5:UqUziH9dAYWTDXCT9ZriR8pEoE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782288678, "uuid": "08044f74-4a55-4b4a-8244-d2d0a9e47ad9", "value": 1304461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782288678, "uuid": "1c83c22e-fae8-45fd-bb5a-84f50fb1cef9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288678, "uuid": "8bf08ab9-dba8-46f2-ae48-347d1c671b20", "value": "presupuestos_inhabi.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bd440e-6ffc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782326758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326758, "uuid": "27011da7-796a-4ea4-a1a4-6abd3fcb6d08", "comment": "Malware payload (Mirai)", "value": "a8efe3e957ec7a5503a4c1527e2a16c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326758, "uuid": "a66b0efc-f2e4-41ba-ad5f-77306ebd28b6", "comment": "Malware payload (Mirai)", "value": "d6189cdbc46765f124c982b97f99f7251afd1ed03d67829a76b003f31b2a88a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326758, "uuid": "4ca17b83-73de-4f4d-9635-4cb99b291443", "comment": "Malware payload (Mirai)", "value": "064464b4a5fffe73939d093c405e05e4bcba8043", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326758, "uuid": "641a55cf-86ab-43de-b1dc-66e48168f089", "comment": "Malware payload (Mirai)", "value": "bdac6b83937c5c4dcf67e0d07274ab7ec50ac469b3781c4ffc310a44c27a0f84d87377497e731dfbf33e64983a4f2139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326758, "uuid": "33bc0da6-dcaa-4439-894d-a62c28bdbf58", "value": "T183F37C87B7165CA3CC510BF94B875B8C6BA351418F6BC7D73D0DA6380E6A9CE9D0A381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326758, "uuid": "5475b213-f053-476c-9bc3-0bc7c42ef1be", "value": "3072:dZE96WmJQawxvikXlDkPoegg+qHr7vmm2cK:w96WdvFXlm8qXmm2cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782326758, "uuid": "175ab68a-4b7d-4217-ac55-5c05c7dac84c", "value": 160968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782326758, "uuid": "757f3200-f5cf-4d9e-b9e0-3a6f814685f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326758, "uuid": "315195e8-b9f5-4035-aab6-6e31a53c6477", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922e3542-6fcd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782306413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306413, "uuid": "4cd22adb-6fed-4f86-bf22-27acc35be4f0", "comment": "Malware payload (Mirai)", "value": "d61d772bdb34cd39ee180c4b8fb9028d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306413, "uuid": "f4b5c5f3-3241-4e69-ad4f-75207df61b68", "comment": "Malware payload (Mirai)", "value": "d72344923188c705addb8037bce49f6b3e3b14cc3d25801f8530a4170575f929", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306413, "uuid": "c9811614-86ab-4b86-89a9-81cfea769e52", "comment": "Malware payload (Mirai)", "value": "8fa99b431b9a267d356f9b23a8286c9ffc0f24c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306413, "uuid": "de8ad271-44e6-4c12-be34-6bd7963c618c", "comment": "Malware payload (Mirai)", "value": "a8bcd9879796f72e38ced6a2eb2a8f3a985c1104ff091234d3fba39ae6b2a3a3baa38a4380baac83167b9c3fb61266ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306413, "uuid": "f1c606ac-d48f-4a59-84a2-74e9bf5fdea0", "value": "T1A414874A6F228F7EF269877047F38E30975977D616F1D685E1ACE5001E6028E241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306413, "uuid": "b1996d03-4262-4983-95cd-a187dc6215b5", "value": "3072:xn0rgaaswzBdp4KBWEnS9QKoaou4HCxLAYD3uHCcbX7/P7lPQh:h0rgaVcBMKBWESHoJCxMe+icbrzlPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306413, "uuid": "2a358a42-c868-419d-a3cf-68e875551d6d", "value": 192800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306413, "uuid": "3c4a4248-c870-4206-8f2e-ed5c239bf879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306413, "uuid": "f5a10643-f047-4962-8054-4fae62f149cf", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0649ef-6fd7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782310730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310730, "uuid": "d756d307-0266-4987-83ce-0debfec1d794", "comment": "Malware payload (AgentTesla)", "value": "0b89f02c98dd80cb7fbc8956d23c806e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310730, "uuid": "f17d2288-1189-42e4-89b7-54c11b1a6c06", "comment": "Malware payload (AgentTesla)", "value": "d7a9ec8f2af174b5833e6315bff9c6c97d5142c0b126b12fcf29fa168fdd3d1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310730, "uuid": "a3d9b039-068d-468e-9e4c-c9758b995b2f", "comment": "Malware payload (AgentTesla)", "value": "153a7de7f8f7f3c210ddb9c4fb42995786c6aa70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310730, "uuid": "655a99cc-ba7f-451a-8770-7a02c2738704", "comment": "Malware payload (AgentTesla)", "value": "65958e0779671b475032f689498bf75e9397db7ecb2f79a641df17b234288ae76458df69a79deeb2cedb271dcad92f3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310730, "uuid": "92aca3ed-f27e-4868-8abe-475e424f2469", "value": "T1AF153A20DD28036A4F87179EFDA90B62CABDD109512B56F1E6DE070D61068FCD3BE26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310730, "uuid": "f7792baf-7951-4fa1-b128-f54f5c4bc9b1", "value": "24576:hy9yXyVyby8yayby8y1yUyvyKySybyUymyNyUyMykyvyyyoyWybyoyDy/yKyFyiC:hy9yXyVyby8yayby8y1yUyvyKySybyUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782310730, "uuid": "4755052d-7cd4-4666-a248-6419b37b23d9", "value": 901861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782310730, "uuid": "f182e9d9-ce64-41a7-9306-7c49b5e59604", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310730, "uuid": "b0146fc4-e528-418d-881f-bf7c27171860", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0456724c-6fda-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782311759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311759, "uuid": "d0a6b0f2-a802-44ba-9a31-3b8bb15cbe30", "comment": "Malware payload (WannaCry)", "value": "c96b8c08aa8c7177a82b22d898eb1d79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311759, "uuid": "ff4318fd-0706-41ce-bdf0-182880917128", "comment": "Malware payload (WannaCry)", "value": "d833fe282b1e263047428433c6f33f41feaa9ef7a58ed184298749f7ede4691d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311759, "uuid": "f54bafbc-9d20-4173-b6eb-a481aa293df6", "comment": "Malware payload (WannaCry)", "value": "534c1848e6d7c9e5c8339d9f675191d6e7fa14fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782311759, "uuid": "c5e06249-bacc-4ad4-8b79-2b7bebe72825", "comment": "Malware payload (WannaCry)", "value": "29bdd9874981f715b393619d3b99af92447c3c796fdee00d28778f3238a8ec6897dbf3218255483407ff5436ad68a49a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311759, "uuid": "55074c20-d50a-49e4-9217-a141c33eb0fe", "value": "T10836E115A1E82B64E7F36EB2217B871047797E45889B925E1760A04F0C33F5CDEE2F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311759, "uuid": "1fea1f47-93ac-4c42-98a9-eb16dbe5c6eb", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311759, "uuid": "3e03e8cd-f7a1-43b2-a8e9-8ad7b280c541", "value": "49152:RnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:1nPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782311759, "uuid": "35702150-3bca-43a5-a59d-85898dcb2dee", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782311759, "uuid": "f518a0a0-9a68-4bfa-8fc3-e18375a57223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782311759, "uuid": "ad8a9316-9ec1-4f3c-a070-22020f89c16d", "value": "d833fe282b1e263047428433c6f33f41feaa9ef7a58ed184298749f7ede4691d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209b2083-6fbb-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782298492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782298492, "uuid": "5769456f-c912-4722-afb4-a08b0fcad17e", "comment": "Malware payload", "value": "1808a922881c016afad04c1e2c62de7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782298492, "uuid": "488dbaf9-2bde-48fa-adf6-a4b10258ea67", "comment": "Malware payload", "value": "d94a6d8e3d54432fcdb888a4f1e566f35c9ea8fc04381956f5e836da50390ee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782298492, "uuid": "58df67cc-0e9e-4040-9959-42f7d3a642c2", "comment": "Malware payload", "value": "3483e103d1a13478f4b8df392c9cebc8c43f59a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782298492, "uuid": "5d19576b-bc83-4739-9f60-1a17736fa1b6", "comment": "Malware payload", "value": "2ef0ae5809accaf0a59cc3ac92503aba8b22637bd9e9553093fe35d6474c67cf73b664b2417c53339433752bcdeb757b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782298492, "uuid": "1466eb8a-632f-47db-b714-10ef5bdaebd7", "value": "T152F4BE5B76968E21D2880232C2E7120583E1654B7677E70E768523DB29073FBEE4F397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782298492, "uuid": "dfca9795-4b42-4f44-8a60-1f538a24bf84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782298492, "uuid": "0dddf8b6-83dc-4b74-aecb-3c4ed7d99f32", "value": "12288:K3yeOO4nCLEMAcbUxNEvGjnjz2UB1xoKgTeywFx0/Vd2JaCJu096hIKUDjGE:Gmcb2NEvor1x46x0tdSaCp3rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782298492, "uuid": "22553400-1c62-4fbb-8b41-dfa860e0c10b", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782298492, "uuid": "5bcfec46-3419-4bf2-a240-cae522084896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782298492, "uuid": "d6e2328d-2c92-4775-aec7-bce7850f350d", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.92739632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a275f2-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322904, "uuid": "c288c796-6433-4b67-a13f-46d1c7afacd8", "comment": "Malware payload", "value": "6c4faae928119a417617c77db1808ca7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322904, "uuid": "ad6191b4-33d8-4a8c-9eb1-0093795e31aa", "comment": "Malware payload", "value": "d9ddf328b6151bb6e2a74cd95c7153af969059ad0465dc3539a62a8069924a38", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322904, "uuid": "effde513-6a99-42c4-9109-0660a87e4d06", "comment": "Malware payload", "value": "96895eee6c0650d57f5e5ce7399feccd9edf6e24", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322904, "uuid": "a39ecb0e-2087-44a7-98b0-f7db76b80a51", "comment": "Malware payload", "value": "5531c664d38211144a1aa3d7f47b21bb48c49ea5e0530afd0abf728c26138de980baf5dbee51c590998863782d1fd7e7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322904, "uuid": "ae4dc76a-5bb2-44ad-89ff-afcfbc9f6043", "value": "T13796024BFB84882BD4F353B2417A5321554B4C668B438BC7AD44323C28B7AD46F9ABDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322904, "uuid": "6a498594-e216-4919-944f-040b429a5d01", "value": "196608:LrUZX9GasrObxh9ee4Er5Ga77n5XqdetC/POMWxQaq:nUF9Hssrh4Yca/n5Xq7POM5aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322904, "uuid": "f42cc1a1-f086-4ecf-8382-8bd0fec8cd10", "value": 8706447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322904, "uuid": "3072c4bc-5b0a-43a6-bc55-f700ad2fb399", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322904, "uuid": "ef280f9d-3968-46ef-b768-3fa4335f0300", "value": "PAINELDO7.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bf02c2-6ff7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782324356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324356, "uuid": "ad4f4e47-2851-44ff-ab55-e8c6558a9676", "comment": "Malware payload (Mirai)", "value": "c5723c08f643e49975d39ade9d7908e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324356, "uuid": "3e17b3db-1591-4146-9c92-92dc142b8a94", "comment": "Malware payload (Mirai)", "value": "db3decc3f228ac7982ed03612b7667e2a9edbadf777939a083b1ef7a59634aa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324356, "uuid": "3f91e610-ec43-47d3-946a-82a6e2acdade", "comment": "Malware payload (Mirai)", "value": "fec1e786f68f7ada72ac81235f3c19d69ebe13e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324356, "uuid": "a07fca7a-fc7d-4f8e-abae-10e18ceccc7b", "comment": "Malware payload (Mirai)", "value": "7b4850c3192c5f474717a6fa1b711c287db395cff84eff7c2b68cb47cb8de26a104660e082241bb14b4e62bc2d81585e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324356, "uuid": "d4395fec-1235-4f77-b795-a638293e474c", "value": "T149A3F945F8508B17C6C611BBFF4E438D7B2A1758D3EE72029D256F60379B9AB0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324356, "uuid": "06dbd74b-8c25-4b95-ae23-1518d196987f", "value": "1536:u36ZDSHEVQ5JRo/4VDu+7XBTl9dDOXC6+YS0dszldrwywF9cU9otMQsIcUqET:MiSHIQ5M4Q+lTDu3S8BIVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782324356, "uuid": "7fb7fb68-416a-46df-ab03-55d6bc7be95b", "value": 104812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782324356, "uuid": "cbfed2c0-f571-4136-8bea-b563197362b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324356, "uuid": "907c7e34-1d83-45ea-b2d7-0cc8c368a15e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a15b400-6fa4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1782288790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288790, "uuid": "7ef4a9a6-5304-471f-9d99-a13b632724a1", "comment": "Malware payload (AveMariaRAT)", "value": "ecd8c241eb9112a7d475ff5ac7e584b4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288790, "uuid": "311b015a-8548-41c1-9788-e618835876e3", "comment": "Malware payload (AveMariaRAT)", "value": "dc368da984106cbbe7fbb8faa31441513fa325aabfbce9045da5982aadf69eff", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288790, "uuid": "d1f395b8-1b48-40df-a956-c4725b0f1ea2", "comment": "Malware payload (AveMariaRAT)", "value": "328c9f94a242ab38140cf278938eec2fad46b7a0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288790, "uuid": "96a29af4-cc55-4a6c-a7f5-ac76125fe5a7", "comment": "Malware payload (AveMariaRAT)", "value": "dcbc6a3bcdc1d3575b5b25f154c5e5083d2e39bfdc9838d0344fa16dff7e60fd0ea210608ab8283ea1189ba911bf82f0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288790, "uuid": "34023d20-cda7-4262-ad63-beac5fe99c2e", "value": "T163E59D0BAC9048E5C4EA52B18CB721527B64B84A0F3537C32F60B7782F36BD19D76B95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288790, "uuid": "1726ad06-5cc2-4959-a5d0-2cf2b1592158", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288790, "uuid": "926ebfbb-07cb-4dc8-ad25-1a65f13b32b9", "value": "49152:0tx35AQ9dMYQz25atKowzWofDXf8yXy6H8hdaoWrbCjNGuAVnxsCVb:0tt4Q8spkygZzC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782288790, "uuid": "2aa13069-42b3-4084-bb5c-10a0dba04faa", "value": 3082616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782288790, "uuid": "7032ce20-7f9b-4d02-8c5b-dbd148eb8447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288790, "uuid": "7cc45c9d-ce25-4411-8c69-28c130155dc7", "value": "v49922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c2139d-6f60-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782259497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259497, "uuid": "ecb14abd-5ecf-4fb0-a69f-444e162cd118", "comment": "Malware payload (Mirai)", "value": "ada20efcff540ff37f4c0801e6aed04f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259497, "uuid": "28cb9597-b36c-463b-bbaf-f445fb4df5a5", "comment": "Malware payload (Mirai)", "value": "dcb2e53eaeb334e77769eede9700b4a544e013b70c337a61ebb0513243393ac2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259497, "uuid": "571856de-0f1d-4350-b780-395a3d148c79", "comment": "Malware payload (Mirai)", "value": "09465c01dc4e1f5248c9c2a34d77e4942ef1dea5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259497, "uuid": "204c8b3f-5252-4143-8941-1b20f274fe5b", "comment": "Malware payload (Mirai)", "value": "1dbbfaf4914924af83b275af1a5613945ef376fb690b663c40c62a5655d87e936ee9b59d8e1c245f541cf771fe1751fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259497, "uuid": "b718f3cf-3d8f-4b75-92ef-310284f9ac6d", "value": "T1D5311ADE46111A352602CADD77B3368DA50C93EF2C9BC3809D4C1EED82896CCB265BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259497, "uuid": "3c5a09ea-16ce-4be4-80a3-b4a4c4a22ba9", "value": "12:U076oR3U6776uBWbIr6Vvt7wi60kGai6aeEx6di6dmmr89a6ARI6RgnR/065Hd6y:d5Kt7HXxyTm+8pnh0YH2HN5rGBwBen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782259497, "uuid": "c671f897-9f39-44ad-87e5-b37f79ac4369", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782259497, "uuid": "f0be4588-521e-479d-88e8-f38ae5b32223", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259497, "uuid": "6beb4595-09df-4999-8447-c3ba0c32384a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783bdeb3-6fca-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782305081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305081, "uuid": "816077b2-1991-4103-84bc-cfa40bce16fe", "comment": "Malware payload", "value": "71958b77f68004d8388b7706ee6f4e2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305081, "uuid": "2ab851a7-bff2-4d66-b237-1516738fe5a1", "comment": "Malware payload", "value": "dcc81760e7f5db1f41c7211bb132715b02d255a630950e5007dac425d984fd1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305081, "uuid": "145c092f-d2a8-48d6-801d-9e2b22cbf676", "comment": "Malware payload", "value": "a6d32ca0e610c2149bd04c32ecebd759b024f9a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305081, "uuid": "b3c5bde5-4df2-4e9e-a0b1-0894f029e633", "comment": "Malware payload", "value": "bdf97e4c0218a28e1d99f8a82939471946fd943dd283292566d734f58f48a2c230466a82e23e97229b2a0578cb6591ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305081, "uuid": "7afb26bb-db2b-4b60-955d-d3627d23dfbc", "value": "T1CDB55B07BCD488A5C0AA92318DA692B17B31BC483F2127D73A92BB793F777D05979344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305081, "uuid": "98f13aeb-4eac-495b-b762-b689ad899e45", "value": "19061a0685d6c386564244409c0f32a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305081, "uuid": "2bdff9d1-897d-4da6-ba37-2b7493a17b6e", "value": "24576:Q0kvPfXjgtYI3oBDzVtbvNlf0MVRUXNeIbUdv5FKh1nZk:Q083jg60oZmUd3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782305081, "uuid": "e724b28f-7108-4d8f-9527-d0064a9323df", "value": 2298720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782305081, "uuid": "199e4212-408c-4bbb-a71d-8c4b814547c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305081, "uuid": "66bf45d4-6ff9-49fe-929d-6be5706793c8", "value": "wingup_ext.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc552a79-6ff9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782325382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325382, "uuid": "64d3dc62-f4b5-4d52-b626-8cc4a165add8", "comment": "Malware payload", "value": "fdbd1fb62742a3c73d83735cb02cde6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325382, "uuid": "90f9ab74-57d1-4b67-b227-2ca9e73f9277", "comment": "Malware payload", "value": "dce3c037e491b823b2a62546116bad572cc64a03441d47f19104dfe541c1e820", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325382, "uuid": "24220018-a2e7-40c3-927d-8739eae4c225", "comment": "Malware payload", "value": "1e0b2ef96707aaf9560cda2d148648da28bd434c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325382, "uuid": "f3620e23-6f40-4e1b-adc7-db0d57e2be6f", "comment": "Malware payload", "value": "9e54fd9719ed30df2f78442299fe220d9fbd6efe3e56f4211435d90ac45e051ed949613b0f8f35add97c9385c8dcf194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325382, "uuid": "e87db806-3e6d-4053-b87a-9ad375db1dda", "value": "T1E0836C377D785927C4C4A67E22E74330B5F7174525B8CA2EBC324EADBB006A02267776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325382, "uuid": "bb3d8cb2-9271-41a2-823a-2f8b668bd3a1", "value": "1536:Y7iMHMetxZecz9fj4SzGo/OrBj6uCKgsjo+5z:ivHtZ9b4wn4BjtCKdjoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782325382, "uuid": "47073a81-9398-47a6-824d-a5076a4ca0c3", "value": 83096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782325382, "uuid": "fd96d206-13c8-449d-a8cd-a6eab0305301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325382, "uuid": "15ec29b6-0d8b-4c79-a4c9-f3490996fded", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56b1d53-6fcc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782306123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306123, "uuid": "e3845e7d-f63d-4591-b3b4-a79e487c186f", "comment": "Malware payload (Mirai)", "value": "9eb4d4624f8f0ffb0b8b5295d603e101", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306123, "uuid": "423457b8-db61-4274-800e-2ac07d89aa54", "comment": "Malware payload (Mirai)", "value": "de8da3453b1c6ed190e72de07507671cb224bf0882e4475e95ffbb1c7a680d17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306123, "uuid": "92c16c98-ad28-4230-89e0-a24cad919ad4", "comment": "Malware payload (Mirai)", "value": "05fcceab0f6b1060bd9e24e73e42a59df7786c86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306123, "uuid": "d9cb1611-d576-4bc9-8421-91659cc7c3a8", "comment": "Malware payload (Mirai)", "value": "dd9c50c184b3b2d658d6167b369f955e25e80cd984c8d3a615dc55377cf9961c3a2c0e9380de52a2e0bc3fde4231463f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306123, "uuid": "45ac246d-fc3a-4212-9ced-9c030daf72d1", "value": "T139157D9DEBC6D4E1F26300F0025EDBF61534A12A5013FAF6FF46266774327916F1A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306123, "uuid": "5d586dfa-a88a-4e30-8569-efcf3babac7e", "value": "24576:biro2UhFvh593VIgLnJnkjmS7v2js/wQAOgKqfsS:4TUhFvh593Vni7T7Hgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306123, "uuid": "b8dce9a1-1608-49bb-8bac-8c8b240a2b85", "value": 956088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306123, "uuid": "dbe38cb6-95f6-4343-9b8d-75e1992ccc42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306123, "uuid": "44be7c5c-11bc-47ba-8347-a9634d4bd913", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a2ac0e-6f72-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782267127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782267127, "uuid": "4b99cbb3-a0e9-4c0e-bb31-375d98503771", "comment": "Malware payload (Mirai)", "value": "efc201a0642ae0c1a1733eebf9f92b9d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782267127, "uuid": "2c400dd0-c385-46bd-8046-41294cb742bf", "comment": "Malware payload (Mirai)", "value": "e052bfab59ab1e074b7f2a998190e6d6094979bef2e93b59f32ffef096a24d83", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782267127, "uuid": "595b68e8-8056-4d75-b1e5-226e8ca5f649", "comment": "Malware payload (Mirai)", "value": "e7114e32a05fcd1a8a286e175757f792a3fa21bd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782267127, "uuid": "588bfbf0-97b6-459c-a84d-e07f50497e74", "comment": "Malware payload (Mirai)", "value": "8c309ef78cd00d018e56a931f5333b28143e1d6d9f8bf3a9e365ebbdf4170a1c8f523bc10979c3a72e0e409e7fc2ed5b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782267127, "uuid": "73e55386-3a19-43ee-8297-599e1a41a152", "value": "T1293158C822B017FBCED4DD527932E9EE606D84D7BE5758E4640884E36F886C5FC182A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782267127, "uuid": "08f1f912-a2e1-43bd-9ab6-1db6c71f6c70", "value": "24:VBvHBq25vFBMxqBCoBtBzBdT4qBxjB5B4b0BTf3ByqtBUgByUx3BpubW:rvhXd7MECcztds6x9f5tyUDycx8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782267127, "uuid": "faa5b24d-3a6a-4823-a69b-9fc67cdb9f69", "value": 1515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782267127, "uuid": "783b2913-f8bf-49af-82c8-7bee127bf597", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782267127, "uuid": "6fd3bd34-f41e-4770-90fe-dea84e5569dc", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f718244-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322729, "uuid": "afd6f1ad-4f7c-4859-8fc9-c30af5ea39a6", "comment": "Malware payload", "value": "efa05e0f252416296b77b7c0eefee665", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322729, "uuid": "5929a395-179f-4b19-94c5-86773923aae0", "comment": "Malware payload", "value": "e0ed71b95a459126cef8c8d8627794ccb6aae93cc25a060bb8ee73b84c82a2dd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322729, "uuid": "2b3eb52f-5578-45dc-abd0-3a696ccc419b", "comment": "Malware payload", "value": "dc6c4cd6d9d799f7292f668297ff0f32c05be155", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322729, "uuid": "84a568f4-fa97-44aa-8c67-96b033352c47", "comment": "Malware payload", "value": "034d45867e5fa87b2d49c4dbbbcc6c6327b19e30380038769f03a59cf0d023671402867f8ab17cb7af5c1e5e92c82134", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322729, "uuid": "54eb32be-fc64-459c-b5a4-5d27a6dfb492", "value": "T152C60143FB008A5AC0F783B249371BA126270E668B4397C76964397D7D736D46FCA6C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322729, "uuid": "d1acabd9-1628-45d9-aa37-7a38c8b79fa2", "value": "196608:PIaiDkuViT6WW3xbX9bJd7Em3f0OkH/BrserOFsoeXkZaWTVWHVuqa9ROEj1bcUh:PIaiDkubFbJam3f0rZ42OFsBXkZpmVLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322729, "uuid": "b3c822e6-b9e7-4727-977c-5ff1648fdbcd", "value": 12279761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322729, "uuid": "0fc30b9a-9306-4199-a76f-eae42fd3f0e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322729, "uuid": "129571c6-e750-4410-bed9-fdff4bde2247", "value": "loce.tv.app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95aa4741-6ff9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782325317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325317, "uuid": "24004d60-422c-44d2-bade-f218f1c1601a", "comment": "Malware payload", "value": "7839f034cc3dfda89cf9da15cf009027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325317, "uuid": "62282e28-91d3-4e32-bd1a-7a11e0e6f7a5", "comment": "Malware payload", "value": "e132e56a921766f78e271a4446e5205b488c741a7719ae0f5227a43458e6f493", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325317, "uuid": "a333aa41-763e-4d96-b739-bc88e44aad1a", "comment": "Malware payload", "value": "10e6f35fbd0683b35cbd899767e0487c41af9412", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325317, "uuid": "55676d0e-55c4-4d2c-829b-b7a7cfd14e98", "comment": "Malware payload", "value": "c379e3a457999e24c6ae16ea3cddf56d21a5cb14763d5df1a8d8fb18c53695b292cb8580235254f236283ec33f793350", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325317, "uuid": "1ecd23d7-6aa5-482d-aa50-8e6e1119a6c8", "value": "T109E3D6169F510EBBCCAFDD3706E90A0639CC911722A43B753674D938F54E94B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325317, "uuid": "1de74c91-8b5b-459c-bbaa-f78b27f5c526", "value": "1536:euL3auKI6UtSwCbQZAIuiEa/H1A3mfu3nIDGwPaL/gcrTnyqXWLZQx+L2ir75W:ee2IKUZAB3A2LgcfyqXgQEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782325317, "uuid": "d86d9ce1-2671-491e-b417-4e683fa1bd60", "value": 144112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782325317, "uuid": "dfcbc508-95cb-4fa9-b870-ddbad8d5a434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325317, "uuid": "a550196e-f630-4245-b0c8-0c36ae0a077a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f13225-6fab-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782291847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782291847, "uuid": "b3a36b98-5b52-42d2-8073-a1e19f95c471", "comment": "Malware payload", "value": "21bf7fcfbf1f9d4474c923a533b38601", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782291847, "uuid": "1ddd6943-e364-4f5f-a43d-11097d833b1a", "comment": "Malware payload", "value": "e2447cbf6815ee3b12954566a897a7ade16bce0cca5c06477c9781bcf9d30c58", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782291847, "uuid": "05a4f9d9-0f64-4b7f-a39e-dc126427e3e3", "comment": "Malware payload", "value": "78401bb3200788712770e1a669f9afa3cc547113", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782291847, "uuid": "922d3611-919c-4f7b-b395-1d1010ccb0ac", "comment": "Malware payload", "value": "9c30280699806b8c1fbfef892753c0254c08e14c99471e667eb47b672c5ce73dcc5b4a974690162ad852cab98bd77687", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782291847, "uuid": "2892838f-0ba4-4473-ac41-e956cb55b9ff", "value": "T12CF6D56677528888F3BA15060DBC0974EA73F20E86EA230797242D6517BFDFF4921379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782291847, "uuid": "35148cec-22c1-425b-b1b2-9b7968c9361b", "value": "192:7+FTkp1ZecgSHc0gY62PmLbfyPqPxKoVRfVJoWtC1v0MiW2vdTO6v1RfrdruZHfA:zDfg/3BX7b5SMX3Y+6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782291847, "uuid": "9d64c5f9-8cc1-4a71-91b3-3a432d2fc14d", "value": 15953882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782291847, "uuid": "f8b73f1f-03a1-4535-b1b6-6ef83be3e5f1", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782291847, "uuid": "56f5234e-b5d3-47a8-b356-2b2450fc2cb8", "value": "DE00920020 Rechnung R-0209020026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f17834b-6fbb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782298677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782298677, "uuid": "54389479-fe4e-4d61-b124-c85c6ebc21a7", "comment": "Malware payload (SilentNet)", "value": "02729d88a009fbfd895cf9b5395ff8bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782298677, "uuid": "30372a27-a15b-461e-9b28-2c428bbb684c", "comment": "Malware payload (SilentNet)", "value": "e27a5045f2660cb54dff7d7e161e87dcb752a50c6ada34941615c0995349f0db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782298677, "uuid": "4f1cf9c1-6fc2-4546-a588-aa7d1a026a21", "comment": "Malware payload (SilentNet)", "value": "4203e1760ed2c7b39ddaa7f05a850efc74ef23ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782298677, "uuid": "60e53e99-57a2-4d10-a2bf-3e9b9991182f", "comment": "Malware payload (SilentNet)", "value": "288199d4bafca0f88e4ddce4db678bdf537fdc801c93a8fb8bdc552d35f10cb67a8a87b67c9275850f2741d0d8afdee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782298677, "uuid": "3f9352ab-fcd7-4226-b081-9729fa5eaa71", "value": "T130357C83EBA3C1D8C156C8B5535BF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782298677, "uuid": "f49a8a52-b641-42f8-9b57-afee41e728c7", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782298677, "uuid": "4a7fc606-9e7f-4715-8e55-9010da7fe510", "value": "12288:/Z+OE4MmD6/Oyspc5EEBBBHGBgzGerwGuvPqItNquB:/cb4M06WpoPrwFvP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782298677, "uuid": "be89bff3-e533-466e-8f04-461931c797a8", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782298677, "uuid": "74be5065-f954-4e23-8297-f0e9d12f1fc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782298677, "uuid": "a227d0e7-63cd-483b-86d0-ee39083d2519", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d5dc30-6fd7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782310793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310793, "uuid": "39efa41e-cd1c-4020-9320-62b7b3fb2cea", "comment": "Malware payload (Mirai)", "value": "fa083afe048a4780910de110179248f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310793, "uuid": "85fbb8b3-b492-49f0-a999-b5cbee270a75", "comment": "Malware payload (Mirai)", "value": "e2c35e35a5174b983a54bcbfab02f3d7569574bc3c5ad898fa69d2876ac0483f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310793, "uuid": "374ee56d-36a5-4303-a4c1-55cf0e6df03c", "comment": "Malware payload (Mirai)", "value": "99e7d602ace86245fb7f0ae1c9561b3f16f91d9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782310793, "uuid": "b7e981d5-327c-40cb-8f75-34558f7a0f58", "comment": "Malware payload (Mirai)", "value": "23a2dd0df505206bda9b53e8d03fcb816148000ec1589841c1326a866f204102ebad2bef953da1375774adb075940ec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310793, "uuid": "267e9802-58ed-4dee-a594-2e9ae4965575", "value": "T13CF31856B9419F12D5C325BAFF9E918933136FB8E3E931029D206F64638B89F0E77502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310793, "uuid": "1f961d21-bc95-4c2d-b1a3-22505be1aca7", "value": "3072:oVwY/fyq92QB+GSgKYHQnggOWNkOWhANAxfN+va3vf5xA0hsD+IPf/wX2Imerm67:obHyq4QB+GSgDQnggOWwyAx4va3vf5xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782310793, "uuid": "ba7658ff-6e83-4ce2-b55c-6dfe767912a8", "value": 166816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782310793, "uuid": "d881ebc7-ff7f-4af5-b51b-58782cdbc60f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782310793, "uuid": "00ab77ca-40a2-4e7e-a0d4-4f2d0d218664", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c014f81-6fc9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782304470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304470, "uuid": "1d231f8b-c209-4fdd-9320-9062cf1cde13", "comment": "Malware payload", "value": "c7443547e13f67380e9dcde6a2c39c90", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304470, "uuid": "6d1ae076-3fe3-4577-911d-83adcb2f6593", "comment": "Malware payload", "value": "e3d0cbffe67561de432b5b0e912328ed7c32c5fcfb3a5002515e34b517d7296b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304470, "uuid": "a575eb00-9f58-4ea0-bf89-4e3dc950a2d9", "comment": "Malware payload", "value": "c7bad5a4d232a3938bc6bc20735bbb67738c9a07", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304470, "uuid": "5035cd33-184c-47f8-b0bc-948cdcfe0255", "comment": "Malware payload", "value": "53dc411e77e945873701daab1a3ff1501bf652c782b9bcf8163e36b4648fd3852762453a0ea706e1957f166f1753cabb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304470, "uuid": "d9c30a82-b108-4131-8ae5-2a1a0948dac5", "value": "T153562281EF45D82FC4B785330EA743316666DD5ECA8B934758EC76282C3B6E44EC8AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304470, "uuid": "1a78a150-df94-4614-8caf-3739b2d1f832", "value": "98304:xtw2dixy1pkW0CInSRqiP21zaDgsLSH97OKaz2U6pvFtgmUxiqoJAFjb:xtldiy6WBomqJtvsLcOrF8F9mFFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782304470, "uuid": "6a9fca23-5581-4e5d-a269-e724c6f4e2dc", "value": 6372980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782304470, "uuid": "49c5a91e-77a2-4208-9691-0fb4f82beeab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304470, "uuid": "8e25b2f4-c781-4fa3-9aa9-c431d1d5f5e4", "value": "T\u0438k\u04220\u043a20.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e601c7-7001-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782328859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782328859, "uuid": "d827b514-0627-41ba-8b77-5426e1f983b0", "comment": "Malware payload (Mirai)", "value": "242773a1c75fa4419f84994f4098579c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782328859, "uuid": "66edf8bc-e76d-430b-8195-637691f5e05e", "comment": "Malware payload (Mirai)", "value": "e4697c702263e186097be61c198ffc5a148631b1d3db08f2b515c1b742f8e919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782328859, "uuid": "3af686be-d92f-4621-a07f-ed74bacd0f95", "comment": "Malware payload (Mirai)", "value": "f17f10b4c801a43a2258b53f96128291bb262431", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782328859, "uuid": "0b8a7056-65cd-490d-b0dc-b0f26d5a5fc2", "comment": "Malware payload (Mirai)", "value": "7292fc25bb372f3a3e1e1709a3cc49aa434a17201f96a851c010150be4b956f201030c95f0bdd1d4ee28bd80a7f0cb13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782328859, "uuid": "fd7a80bd-ba77-4080-bcd5-43e19e6ad74e", "value": "T19EB31A037D52CA53D1D227B97AAF95583322A7B4C3DB33029914AFF42F836DA0E7A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782328859, "uuid": "bee41679-ad8c-4dcd-bcf9-d4439fa8feee", "value": "1536:wsnJCdt1kOUl+h+7Mfz9culm+kQwMGiuLBFLbugiqw/K/X64zbJfNQsp:ZCdt1Bh3fz2ZLLBFLbpiqw/8lio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782328859, "uuid": "17967398-1c88-428a-b08d-cba0ff4302e1", "value": 117432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782328859, "uuid": "65bd5ff9-d6d3-4af5-89e2-27735ca40c10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782328859, "uuid": "f80973c6-a811-4114-b7ab-909df417b5e5", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53017b2-6fce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782306928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306928, "uuid": "840051db-a06b-4c57-a9f3-c38740df0534", "comment": "Malware payload (SilentNet)", "value": "1f1ec960be28e8bf64c592056a543f24", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306928, "uuid": "80cbbb4a-2663-4a1d-ad84-0e08bbf0a71d", "comment": "Malware payload (SilentNet)", "value": "e57d11b6dc7d2141cf8ac03c7708651dcde1bec21e40121d0a444ccb8f18a332", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306928, "uuid": "f9497ce9-2433-4933-90cc-ea8bf8a72fa9", "comment": "Malware payload (SilentNet)", "value": "366d1624eaa1b8c8f8bd5e5de7bafbfa746d3842", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782306928, "uuid": "8f02ca8e-6f51-43d8-a306-b422be51e4f2", "comment": "Malware payload (SilentNet)", "value": "39c05c402b71d6650fb8379a4a82e0c442ecd3881c81fe34fa16a99b86283a7ea465b40ace14031bce4cce0384f73b4e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306928, "uuid": "17b369c0-b3ed-4a85-b084-dc2a5e117dfc", "value": "T10D1633FE9C065E66EB7C353C935B84B4542C1764AA48E8362F35262F0ECE647CA4FE14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306928, "uuid": "111231a3-bd45-4b45-8be2-a80205c0313a", "value": "98304:SBmByursCDZZV30Zbw9eBiRjMNCivGtVJmVqcCrJqM:dBRrsCtZsU9fRjiCieHJmVKQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782306928, "uuid": "a56a0b25-b7f9-4e15-a583-8c5ffec81f91", "value": 4412935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782306928, "uuid": "0a9560bc-6345-49db-b305-9734d9ae634a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782306928, "uuid": "97962b20-ae5f-4783-a11c-77dbcb31e1b2", "value": "camerautils-fabric-1.21.11-1.1.2-injected.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09511be-6fc1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782301418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301418, "uuid": "c1357349-0841-4c9a-a8ee-9e779c29b46c", "comment": "Malware payload (Vidar)", "value": "86cdb9c9aed5bc74090be5d955162a2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301418, "uuid": "45d0c39e-dc13-4a2b-82f9-7398e2a5b276", "comment": "Malware payload (Vidar)", "value": "e5f8ab450586be710d9bd3b2a9e6f421a77567736b920833868045e1f0c7b44c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301418, "uuid": "3bbeb059-c762-431d-a739-c4f1f60e8c22", "comment": "Malware payload (Vidar)", "value": "ace8583dfc4769b9b6db1e93679ae06dd23c040b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782301418, "uuid": "b3f18967-96ad-4082-bb22-c539663b141d", "comment": "Malware payload (Vidar)", "value": "57c5f633fc8943bde6beef06a4b4a0fe20c6d97bb90fcf614c42feeff5b17658030eebb1039a060d49937470f2648f5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301418, "uuid": "b7691c71-4574-4bf9-9339-093642e24574", "value": "T10AD59D1B7CD249EAC8E953328DB721867765BC090F3A67D32A90727D2E36BC06D36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301418, "uuid": "f8f038f3-a821-4e51-8c85-bb18570acd01", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301418, "uuid": "8c80ce01-b7da-4ca6-91de-23bde163ad51", "value": "49152:CEmOmftMgQTEDwpwSV+OdYxkfmFIFMZSK0H4Srq:CEicEsPVHdYF2FMZSK0HX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782301418, "uuid": "fa7d8380-029f-49c6-879b-5fe55080dd40", "value": 2994560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782301418, "uuid": "9566f2fd-4d21-4f68-ac7f-7ec0536e269e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782301418, "uuid": "40de9338-2c8a-4d9d-89c2-bf963aa13074", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d625d69a-6f96-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782282905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282905, "uuid": "bffcfa99-a889-496d-8892-6cfc58a7d70f", "comment": "Malware payload (NanoCore)", "value": "173745ce5cd1f35d04444fa5333566f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282905, "uuid": "fa6fe8b1-6ab9-438c-9224-92e94b2c97b3", "comment": "Malware payload (NanoCore)", "value": "e67f88dbde61e4843243121ec1ae31b9f6b067bb7d2e6b947d8c90f6d670179c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282905, "uuid": "347947d8-b24d-4974-a318-670d5a6813c9", "comment": "Malware payload (NanoCore)", "value": "a2fc8d6721e7af50ba4c980e07fb25a1ff898b2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782282905, "uuid": "7e2da0a9-5b6f-4112-ada0-c55c143f023c", "comment": "Malware payload (NanoCore)", "value": "dd2078968d36c395af77d2a132181c72eb7d531b7cb63b75783262162a990aa6e1a7ebc8e2acbbe3f72d89671055af82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282905, "uuid": "02d02568-49a7-4784-82d2-d5f9ebee025e", "value": "T14915221C3B5D8A16D4679BF40CB2E57553797C8DAA21D6822FC6BECF31A8F012A18353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282905, "uuid": "2bdf622e-5976-4b2b-9d12-41a356e4c8cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282905, "uuid": "8b0e35a5-7832-4ae7-9a63-65e653b9c7ea", "value": "24576:oH4LKFhYqdoXn1QOt2ZY+4O6kMwwqi9pK:K4L6htpZYE66wd9pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782282905, "uuid": "8f16bd64-baa6-47ae-95c1-fed4b65db82d", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782282905, "uuid": "08c248b3-0407-4315-839e-8d94020b86c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782282905, "uuid": "dc1e3059-621f-4acb-8744-66c46289f246", "value": "173745CE5CD1F35D04444FA5333566F7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b1752e-6fc3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782302044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302044, "uuid": "86e4855d-807c-446c-a883-cd799d64995a", "comment": "Malware payload (SilentNet)", "value": "c306a83ef040b8d2551dd79a6cba21f2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302044, "uuid": "8d6091b0-fc96-4790-aa02-cadc0c5539a7", "comment": "Malware payload (SilentNet)", "value": "ea28b471c5d97b723c36e4989a6442ef32bef2fd8fc3b2b507cc913732c54571", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302044, "uuid": "8469c08e-7041-4147-8ae1-8eb9a650f30e", "comment": "Malware payload (SilentNet)", "value": "fceafd1f667bbbf4c9d87ff783836ae7fb252b31", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782302044, "uuid": "146f77b4-da38-44a4-8bb3-196c505b5c29", "comment": "Malware payload (SilentNet)", "value": "96bc4f58c08323a0ffa2b64354a98a43503d264da0d835703dc301b7aa87557b977e938ae0f3c9d16d73181fed317e01", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302044, "uuid": "a65f9ceb-93f6-4720-841a-f94c6705b1f3", "value": "T1A6C523B3B9CCD934E927F731E0610D32A61C5FC4E646D4AB02F15CDBA85F6D90B4AA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302044, "uuid": "03bc39eb-df17-4621-a6eb-294a00ae784a", "value": "49152:mKg7GDZbhkXXPcWzH0pXyZ5s+w21HljNhtLQ:BlDZNknEWzH0pXyZ5Pw21FNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782302044, "uuid": "957e6d96-42e0-46cb-adba-5f52fc71342b", "value": 2531285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782302044, "uuid": "9a980e5e-3941-4c3f-a42e-f73bbcc4a450", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782302044, "uuid": "f4fb5ebf-e0b8-40c6-8bbf-dde05a15f457", "value": "WaterClient1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb52080-7016-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782337735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782337735, "uuid": "001b49e7-6bf6-4638-9299-8fba981e3ce1", "comment": "Malware payload", "value": "d0821fdd5f3767799074af664853da76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782337735, "uuid": "cdd378fb-da93-48ca-9a18-7d6f4c7c48f9", "comment": "Malware payload", "value": "eb1fa0496503a61c43d02e4378556049b0301941ed48eac154b55aa2f8434b28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782337735, "uuid": "5d480d19-6cba-438c-af4b-22141f4a50dc", "comment": "Malware payload", "value": "e0d3f71447fb38bc7a2cf85d25ab28c3ff47f8c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782337735, "uuid": "30fc4d00-2143-476f-b11e-9ecc756d3e34", "comment": "Malware payload", "value": "66c829cba4383478d9c377b0d70fa124a7d8c0472ec3c23f571f3f83af504c7e4edea60aaed64045c7fe2e1a5d92d33c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782337735, "uuid": "b770dc35-5e0b-49e6-a210-3b48d2f233b7", "value": "T13B332903F943DAFEC55AC2B003EBB539A976783E013971A97BE0FE925694DD01E2D600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782337735, "uuid": "3b3e1105-ac51-47ef-9793-770b8e0c5b80", "value": "1536:IF41+mQu5fTAp8jDRgYBcGt46k9cstK+i:IF4sm3f8CRggcPh9cYNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782337735, "uuid": "a45279e7-aa9f-489b-bb84-6536e7bf3b44", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782337735, "uuid": "b9ef9b4b-faa7-44e3-a495-e19fe112bf21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782337735, "uuid": "813d02a6-041d-46cb-8bbf-d4143b8e5dda", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a92fd5-6f6a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782263818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782263818, "uuid": "9c0b73cd-36e0-4b8e-9e36-bf3e73708d08", "comment": "Malware payload (Mirai)", "value": "bf30bb430428b0b15a4bdbf8c90789cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782263818, "uuid": "071b6fe9-3bc3-4c61-8e05-36beeb34689a", "comment": "Malware payload (Mirai)", "value": "eda8c3988086e3f74102f462592383be649059aa3599d1ad46808db223cff58c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782263818, "uuid": "7124a3f5-baae-47ba-9a01-0516899f23a4", "comment": "Malware payload (Mirai)", "value": "6bb2716ba9ba43db5f91f17e9f23ee580bfa2297", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782263818, "uuid": "19b79ba7-8f78-42b0-b5bb-b1183b95a3d2", "comment": "Malware payload (Mirai)", "value": "2dabcecc791efc43416f78e36639a4c09480aad3dfcda462fe53c2a0132ddcda5b2d7eb652e1ea934bcc51f39cccbce1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782263818, "uuid": "63426417-b6bc-4a45-ba63-daff6d000106", "value": "T13334090AAB610EFBDC6BDD3701E90B0524CCA41722A53F7A7674D918F94A64F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782263818, "uuid": "db0d6c90-76d6-4902-8570-52a313d99851", "value": "3072:IzuE6qylVLaaWsR0FBh+s4dkawrSpU2rpeyBGmpA6lMnI:0uGyv2H/FT74Oo5rpXA2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782263818, "uuid": "ed0a5121-4cd0-40a9-9122-76350d5e85cd", "value": 245508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782263818, "uuid": "ea35d10c-bdc7-4500-bdad-ca24e19c7b5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782263818, "uuid": "0f88f6a3-d93e-4a53-bd73-0fc72ecc4527", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1f8cb7-6ff3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322749, "uuid": "7107d368-2946-4fa3-9901-218d407c8b17", "comment": "Malware payload", "value": "a0a8ac852230226308bbeafaef2d9d69", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322749, "uuid": "71f648b4-c3cc-4c80-adfd-19b054931627", "comment": "Malware payload", "value": "edb533e4dece48c883f149b911c2042ff897205b8d8cb370586e54ae145b77b7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322749, "uuid": "38655949-be65-42c1-b572-0db93889efe3", "comment": "Malware payload", "value": "291fe007cfa5e375c25090d564414e03d3133f88", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322749, "uuid": "1ab1fd36-4b41-4ad7-b2f2-5946b8a97890", "comment": "Malware payload", "value": "fb75aa4c6b7b948732043b2377ffdc770440f5d3097351d3e9ea9ea151305351940b487b00442db387d6222e5cd960d6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322749, "uuid": "8f31d11c-2fa0-4e36-bc3b-06e673b6bcd7", "value": "T1A3C60247FB088A56C0F783F259331B5126270E668B4397C76960397D3D736E06EDAA8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322749, "uuid": "83e0c84e-4eab-480b-bec8-a4301aeca8b8", "value": "196608:EWCVxQwYiq3a8zAsXWoOFR7Z5Vua85RUcFBCUdiM3JGldoHEw9B0irpRpNxnkZsR:m4wYiq3a8zAIFYlkRUc3CQiCJGb+Ew9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322749, "uuid": "6b92f0d9-a09e-45b9-a18f-74e5bb045f56", "value": 12254492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322749, "uuid": "204aace8-aefe-4b71-b2d7-8fb8c29504e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322749, "uuid": "b91a8621-653f-44fb-9951-be9882211f65", "value": "merger.lonce.app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42ffbfb-6feb-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782319436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782319436, "uuid": "f27e625f-a0e0-4801-887d-c4b3c4920057", "comment": "Malware payload", "value": "703c9e56520231b7ec9547d215dc6347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782319436, "uuid": "a195078b-77ea-46a3-abc1-1454d9abfb8a", "comment": "Malware payload", "value": "ee9e97d914a0745cd56f138517c8dceaab1626b5a8ec71103c731a28ff0097d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782319436, "uuid": "72eea251-4b57-43a7-982c-b6987e8a1b26", "comment": "Malware payload", "value": "4c09debd75a2d66dc2b88f168cb4cc5cbb8d4291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782319436, "uuid": "c07fa144-f54e-47f7-a052-7a16ffb7bd00", "comment": "Malware payload", "value": "b2e71f72fcdfe1c9efe9bef494f1976252c629a0ade2d6265f8d797c9b717adea24b45a0a9a255d2c51f29b2d6ddf872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782319436, "uuid": "ba068dc3-7cd2-4e88-bf5c-117bfd505dbe", "value": "T13B63AE97C46B2E44C94666F0B0B5CE39C703951092430EB71A9BDA7A9483DCDB68E7FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782319436, "uuid": "42c2a8c2-e888-4c78-a55a-d59a1a866b06", "value": "768:ZpF5opJTZSBr0Y6EIzUH9LnbxxBAuhXbfXGqLsNy7MKorLnWbCxPlwd:sIr0zEIzabHBAuxbfWW7MtrCbCxP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782319436, "uuid": "f3edff4f-944e-413f-9122-492c40e31ecb", "value": 68664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782319436, "uuid": "f7373ba2-2d67-4dc7-ba5a-fefa7c2c330f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782319436, "uuid": "f747d8e7-2272-4864-91bd-0adf39b5e90e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf22ad8-7005-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782330590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330590, "uuid": "97f6b4f3-b30c-4fc2-bde9-9fd957bf9386", "comment": "Malware payload (Mirai)", "value": "8fdc9d4bfd26b38399d5f96867ec96ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330590, "uuid": "42ffdb2e-7990-4a79-811c-5730e98119f6", "comment": "Malware payload (Mirai)", "value": "ef5d4d0fbfd73d3e50607ac5f62287ec6f9045ce6fb5940afeab6bb2601b0cb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330590, "uuid": "f93e98ff-0a27-4d10-a262-d31295825707", "comment": "Malware payload (Mirai)", "value": "b6aa8c03a62288c1f80a992f5b5eb06297a299ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782330590, "uuid": "82dad21a-01eb-4bb3-8fa2-a1cc05550923", "comment": "Malware payload (Mirai)", "value": "b6a41335f170fe646e180904f42667e83af97934c4babe4ccd5b04304457a274ba3ac24e614028b3cd0979404a7b69f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330590, "uuid": "602570e7-4eb4-41c6-adf5-7b6a5f280583", "value": "T1AE43E880F98BCBF1E41B09B081AAB23EDA30E92D0865C5BEDFA5FFE5D9635C56111305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330590, "uuid": "d45c882c-047d-4fce-83e5-d9f668de1ef9", "value": "1536:qdlVBi9XF0+oTYuvObBVlvm2QRk3N0S8UtKomN8m:qm91Jo8uv25lQG3N0rUtKome", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782330590, "uuid": "e516969f-a07e-42f4-a1d3-1b4636fb80a4", "value": 56020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782330590, "uuid": "c84ebc86-d217-43e9-9b5c-928b5bc911f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782330590, "uuid": "9a383e0f-d6f2-462f-bcfb-65fa33bdf67b", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9acccf-6fa4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782288662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288662, "uuid": "5cfbec91-f827-4eb7-8c33-c1d8704da17d", "comment": "Malware payload (RemcosRAT)", "value": "83b32693888e48b1bd61ea6038593533", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288662, "uuid": "0e2d83ba-a3dc-4b36-8911-a819a30788f8", "comment": "Malware payload (RemcosRAT)", "value": "f09f16cd70ae832d005e6c3d4b927106ca10c3a35cf0d6eccb429cda93336455", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288662, "uuid": "1fa1622e-8cb8-4270-9545-d65edf056ca6", "comment": "Malware payload (RemcosRAT)", "value": "c8ef5f20acabc35c38ae7379a32efbd138433c2c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288662, "uuid": "19ad0b4b-1a38-4421-aafc-893492116250", "comment": "Malware payload (RemcosRAT)", "value": "387c4415f6e886a133a211bf2223f435d4f3949e52eb5c1ccd1eab1739684d0c44b784d579f54b9a481d15e1dc44c93c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288662, "uuid": "ffeaf211-ce91-4bf4-a893-accbeba7ea1f", "value": "T177B5232BDA839DABCD1E0174972B6095761F1E21FF446E6E2B487F6A28B3070C7B550C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288662, "uuid": "4998a211-296b-470c-8191-57aafe8be90b", "value": "49152:FmsNjA/jmSsKftqJoQmuo/OBVmsNjA/jmSsKftqJoQmuo/OBKS:143ly43ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782288662, "uuid": "355a3b6b-3801-4a67-9c64-b0f413b62d03", "value": 2310656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782288662, "uuid": "88c9055f-0d7f-466a-8ef9-59028802721e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288662, "uuid": "fed17970-7b0b-4bbf-948c-bf55f271bbd3", "value": "inquiry (API-06-24).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052dbe1f-6fe1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782314767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782314767, "uuid": "5cd84d63-c96b-4c28-868f-982fc58555c3", "comment": "Malware payload (Mirai)", "value": "37163596030334865c1c847c535adc6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782314767, "uuid": "d27bc756-bd69-40a6-8caf-d4e620f4d8b0", "comment": "Malware payload (Mirai)", "value": "f12f7e88c75c1f45a157c4af7e6ed5c0cf63e8037a0c1658e1a201093076bb49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782314767, "uuid": "e1b1b9d8-b69c-4546-8736-0fec57b6f2c9", "comment": "Malware payload (Mirai)", "value": "4202d9d319427812b81a2170e507401eb6899edd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782314767, "uuid": "e457c66d-2757-479f-befa-873124e9a7c4", "comment": "Malware payload (Mirai)", "value": "a2d23dd3df82132d029d439d3f64f63e613b5205eb6c1f5d0d9be713e2bc9269e41314ee53ec0db1fddc98ff6712e4ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782314767, "uuid": "48219d58-fb94-4c12-8d7d-d2e28cdfa850", "value": "T1B1F37C83B72A5C93CC910AFA4BC75B8C5BB351518F6BC7D63D0C6A340E6A9CE5D1A381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782314767, "uuid": "35e0d6fe-68cf-44d0-9166-f4605f42008c", "value": "3072:AWi4vq1QqwWoA2r8nPVwXyPoZ667mm0yqoTVgaDqpzzrwmAB2ymrcK:AWyXoAO8nPVwXYoZ667mm01MxqxNymrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782314767, "uuid": "21692600-c2d0-41ef-9243-0d752365d529", "value": 161008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782314767, "uuid": "0ddb63fe-985c-4c35-aa12-e685cc45e505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782314767, "uuid": "9d707c36-dc91-47d1-a1fc-73d25d88551d", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bede1f98-6fc7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782303911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303911, "uuid": "cae6ef84-78a0-4699-b43c-f6b14fe13d9c", "comment": "Malware payload", "value": "70de8e89e2adf368d23fed815428d940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303911, "uuid": "461d761b-f481-4db9-9b4f-a3e3a37b68da", "comment": "Malware payload", "value": "f35118a8bdcd6792e644a6b1e77bd7e946be489e51afcee7b9fa5c12219117f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303911, "uuid": "1a109633-d93a-4f00-8509-6ff4f0fcaa60", "comment": "Malware payload", "value": "400681f5811acfab09ed1ddefc2f0dc1949835d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782303911, "uuid": "a0fae68b-0cbe-44b5-93e5-c0907391235c", "comment": "Malware payload", "value": "fb5c640170b6b823cfb71371b8d3b6d174b130d3e7a9b6423a75be79a7455a74b49418f027bc73885dfe36378199ab8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303911, "uuid": "fd07cf4a-ef4c-4bb5-b0fc-c278ea930707", "value": "T1EBF5330BB5C47CCBD8C19D38124D0B91CF173051926B6B8895BED2F824FA9856FB36AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303911, "uuid": "77141729-ea0d-4482-a3ff-bf5abac4d078", "value": "ae80905c26c5965a204fc5adfb15310e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303911, "uuid": "c92dd3fb-2286-4ce2-af6f-6a17fcd306dd", "value": "98304:W9ElNfFOZjg9iEs9AhThh+8S0P4lsWZW0T:W9I9OJg7s9A08SY0sWZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782303911, "uuid": "28e22523-3617-4545-8627-0a475d84567a", "value": 3383296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782303911, "uuid": "51d98d16-405b-4c5a-a616-6fc7e4fc1052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782303911, "uuid": "a13cdedf-66f6-4aa8-9764-428a17a71010", "value": "Ambani.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b9cb3d-6ff7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782324596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324596, "uuid": "ea5e4bd9-cb9c-422f-9f48-d327cf35bef9", "comment": "Malware payload (Mirai)", "value": "1380b8f5ba844f659de4ee16f12be512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324596, "uuid": "ed1abda4-43d4-49fa-b04d-9144f6df6e89", "comment": "Malware payload (Mirai)", "value": "f57630706be24a400ea068b5b0b592a3f5c864b178962d18bfdbca16e4674433", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324596, "uuid": "dda0330d-46ed-4fcf-84e8-e710a6c139a2", "comment": "Malware payload (Mirai)", "value": "b35472f9f828fe2400c2d31cd9cd13f6729d00af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324596, "uuid": "d0fd1dd5-992b-404b-aae1-b2ff7765d731", "comment": "Malware payload (Mirai)", "value": "0804f0a37cdfe0bf4246e4ac2e86683e91f4c9a1843ce3b93d6a7889b251013cf4bf05d069bb44bc9f4ba92232f1c8cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324596, "uuid": "69d18312-3638-443d-91b6-7c2e75593bd8", "value": "T19D157D9DEB87E0F1F26340F1025ED7F64534A1265013FAF6EF4A266374327A16F1A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324596, "uuid": "9554a019-dda9-4ddd-a296-82a1d55c2717", "value": "24576:TBnzMh3oh7XpVXlbKFpGixJbYajrpVJH:2h3oh7Xp3bKF17vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782324596, "uuid": "c5c35546-6950-492d-8081-b1aba4d7cdb8", "value": 930776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782324596, "uuid": "20ec3e88-27de-4a26-a9d3-923823668ab3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324596, "uuid": "fcc34d9e-8be2-4688-9653-d2a385b6e475", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9e1dec-7010-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782335021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335021, "uuid": "d616b8de-24c8-4515-a5c0-dde56a1219d4", "comment": "Malware payload", "value": "5a9a6d7d9f54d4fccc65d116d64480e1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335021, "uuid": "22169929-876e-4217-a0fb-3aad43e6216c", "comment": "Malware payload", "value": "f5952b1650e8d5e9a480c32c8c0b53dd4a14f4cdc320e8949d721f5881955f92", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335021, "uuid": "b307930d-b5b5-435f-8ef4-7f1bd79c0c90", "comment": "Malware payload", "value": "5a543acca58e1bc860f36aac7c83acbd97ffc711", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782335021, "uuid": "893206b9-711c-478b-98d5-ddd97e5cfec4", "comment": "Malware payload", "value": "61dc946e197d661bdd19e45846594717299ce02f91544ec97d1d1250c9cb05d395662bfea4873c503ade8ef09e954ce9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782335021, "uuid": "72175df1-9343-41a8-9850-8d4fa1f470eb", "value": "T110E0260999BDD8F0628AE11013D9DCCCA751AADFE13CF88D5A10CA840A299F847356CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782335021, "uuid": "7c2a547f-54cc-4455-8f1f-41e96db2a316", "value": "6:ZXv3oNiPL+7yS2wOARk2keOoVeda6UqKogA0Ezq8NUqKoaXvU8ARATqtF:acPaxHOARknAqMH93wZmHHXs80ATuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782335021, "uuid": "78fe120e-4961-46de-ac8d-80f29f226694", "value": 360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782335021, "uuid": "cbc7235a-4dcf-428a-815e-d3f8e8471d2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782335021, "uuid": "4debed74-525e-4a67-8d78-69309d078510", "value": "gRvidixkmlMIeXBedzwX.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088f56e6-6ff4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782322933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322933, "uuid": "6eb2cca2-c956-4f35-b8a6-21400c8979f1", "comment": "Malware payload", "value": "f0b53bf8c81ec9b8bd78ff6a57f8c525", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322933, "uuid": "8f3bc47e-c5e3-4297-92dd-c6513c61d1af", "comment": "Malware payload", "value": "f5c30c7628c9591190ebd779042b73f9fa4cb8e8ee252e77fccaf5049c9e7002", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322933, "uuid": "b860d8ad-67b1-42e1-9ad7-d9956e6a60c2", "comment": "Malware payload", "value": "305f2db644c5a52640f6347ed05539eff3ff3988", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782322933, "uuid": "3aa665ab-a219-4fb3-abb3-cc1c210d56e2", "comment": "Malware payload", "value": "dd585e902f5fd520f5a63b3834611fb5f7df4908edd5e4c0158894c7dd63fb9202d81bbabcf1c87a2007871ad691528e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322933, "uuid": "e22cfbef-e4d4-4baf-a070-d6b307ae3c09", "value": "T17147238BFB84991BF4F753B641369322C44B4C268B439BC76A54323C19B75D42F9EAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322933, "uuid": "c27baf5d-b612-414c-9b4d-ed9028b05010", "value": "393216:CseJ87DZSD6O448Vfv4n5EqsfSNAqUQ1FvBwmsOmw3gMqE/5YS4QaehOtb0atH2S:CTJ8fk9eve5E1QLCmN+MlT4HecyY2Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782322933, "uuid": "efea0e15-502b-44ef-b519-33df9a8337c4", "value": 25279573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782322933, "uuid": "4807a31c-23ef-4565-b8d5-085e0bcc8717", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782322933, "uuid": "04bab895-0732-4ae5-84ed-f84a15136421", "value": "Silver Horizon.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7447a5f8-6f61-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782259977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259977, "uuid": "47ce30b3-bed4-4b99-82d0-d7919a3201ac", "comment": "Malware payload (Mirai)", "value": "afcfec1f881035e049a44c177844ada3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259977, "uuid": "0ea662b5-504e-4fac-b133-5302b4133c4d", "comment": "Malware payload (Mirai)", "value": "f6d0e5142fd0d1a0f07e916c9c7432ffcbacc2a6d4eb0594f1524cb7661477ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259977, "uuid": "a10dec70-e817-411a-870a-00c0c9f687a1", "comment": "Malware payload (Mirai)", "value": "70edb89a14207ac732afaeac306ef2a898bf554b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782259977, "uuid": "96daf09b-84e7-4469-8f83-1b881979dac0", "comment": "Malware payload (Mirai)", "value": "26fc50e6f92e3da6cdb751e2b670c0d2edd6cb7617eeefd0e7a11e7c8d0630f71f69bf7597ab6b109498b85a2a9b1557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259977, "uuid": "c6f5e733-84f6-4691-9af1-b79ddad34482", "value": "T1CDD38EC1E743E0F5E95206F1103BA7258BB6D43BA43AEB92D7A93D32EC625508B1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259977, "uuid": "eee6c375-c7be-4f71-aa64-f2d29bf5cbed", "value": "3072:1RBTBmY4ImwNkDdOEKw8wb7zBvlpMZyBC:1RBFmYWLDfTLeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782259977, "uuid": "be3e424f-180f-4355-b1db-240b30f171d6", "value": 130152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782259977, "uuid": "931ef041-0bb3-4ded-b408-1ce704973405", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782259977, "uuid": "7475b882-2d42-4c57-b71c-99d778da7107", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498b43aa-6fcb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1782305432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305432, "uuid": "be5c03ce-f502-4bff-a5eb-17e7be456870", "comment": "Malware payload (OverlordRAT)", "value": "2e61b70714eea8bd56b9cc21381e8039", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305432, "uuid": "056e4412-174a-4c1a-9257-923746f10b5f", "comment": "Malware payload (OverlordRAT)", "value": "f787a3cc73b976e39f83689aa15ca4f73a2708a67f6b52902bd8b29b83778a4f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305432, "uuid": "9f469c78-3a95-48ae-9afc-5933754e187c", "comment": "Malware payload (OverlordRAT)", "value": "836f09bff1bfe63fc4f364afa194c09d4d1f0fce", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782305432, "uuid": "58d5160e-120c-4655-b263-469cf70a0e24", "comment": "Malware payload (OverlordRAT)", "value": "d50e7383c568b0dd77c71d9c0cd14219dca35d42a05841610cfe2945463248e3da07e4c4af2f14a7c5bbfad09c975672", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305432, "uuid": "c53fecae-e14f-41c4-b201-518fdb1fe6a9", "value": "T1D9F65B320697BDFC3B6D3C85E4052E485D5D7B0B1165828ABB8870BA63ED5B48F2CD78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305432, "uuid": "b338e1f9-42ad-4383-8945-d3f2c0bd88a1", "value": "49152:15TSbO3/0NERHgU3CLvTKU4/KyL7jEV5mry6/OFlo8hpNJgL8vHBeWUHPNniEdQC:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782305432, "uuid": "14c8abf2-99b3-4ed6-945b-f40e9c2b6d8a", "value": 16716160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782305432, "uuid": "6a1f3db5-2869-4d5d-88f6-049a7773e427", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782305432, "uuid": "b6b530d9-4393-40aa-b919-ed2771517025", "value": "Roblox-Patch-windows-amd64-d4e5298c (1).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c8cb84-6ffa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782325562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325562, "uuid": "98954322-2df0-4525-9e5b-636e93de6bfc", "comment": "Malware payload (Mirai)", "value": "9068444dd6167faa7dfc6155c2799d0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325562, "uuid": "e0a6b347-f277-4e8d-b29a-5d13fc2f39d9", "comment": "Malware payload (Mirai)", "value": "f7cdecce2caa3c5cc733c6738b59f9515f618e70ab339f87304833e62eb2bc6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325562, "uuid": "54e3cafa-3b1e-447b-bd29-2d5fcd42ca42", "comment": "Malware payload (Mirai)", "value": "73adbfa2c2b975910c975181435d97485b4a8ec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782325562, "uuid": "30febdaf-8a53-4e29-beca-e8c965083c35", "comment": "Malware payload (Mirai)", "value": "99e3a980fa8445a79dfd89a4e8f13d4c3f84496ab52ffe5f055960f3c4836b390dde9ea0e67b74740e9f0129bd48b573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325562, "uuid": "da262742-4df7-420d-bf6d-c254ec4e18c2", "value": "T164145B47EE890EDFC45BCEB086AF436B19E755AB48D1F1F5443C8C0D385D29A46E3A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325562, "uuid": "387ad138-0666-426f-af53-b5604f438fa4", "value": "6144:2snvMdv+htzOxW+GFF/QBwYrZbgmMfaLqLW9:LkglIW+GF9nhCLyW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782325562, "uuid": "7de7b28e-9a86-4da1-bd8b-23de6b00d985", "value": 204552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782325562, "uuid": "8dd6b3ce-e2ff-4b3d-904f-309f2efba629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782325562, "uuid": "15b0aa3e-cf12-4ea7-bc0d-764e62db5685", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122bc843-6fca-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782304910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304910, "uuid": "fa541209-272d-4ccc-8995-022fb79ec6f8", "comment": "Malware payload (Mirai)", "value": "ea9100355d78730d2c12c406b4182ec2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304910, "uuid": "a65dc666-72b5-4fad-a64f-d8a9e5eb54bc", "comment": "Malware payload (Mirai)", "value": "f883ceaa3bfab3e9842f6af0ac5292b162cdbccaac3c68486df22f9243c603b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304910, "uuid": "7de68037-5c3d-48ff-8001-9852dea604a0", "comment": "Malware payload (Mirai)", "value": "a9e426cd63eedb37d5d422f65d62ea0bab2c0778", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782304910, "uuid": "a622270e-9e4d-4bda-a392-e3837747271c", "comment": "Malware payload (Mirai)", "value": "c8ac1257452a79d74a62a4c36aa4086b466e5090d3b6f95d053d620d0d3792a482e9c827507d5e302bf5f44119458d07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304910, "uuid": "26f0057a-521d-495a-8080-5f42d06f0c91", "value": "T15614E70AAB600FBBEC6BDD7706E90B0129CCB85725A53F797574E818B50B18B49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304910, "uuid": "88b2d629-d621-4a5e-9bec-c0302ad58636", "value": "3072:EWVHwqXvFbuTmAHkH2ynrsuJfk9we9RgrO+e8:ELxTmAHkH2ctcwePgS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782304910, "uuid": "856bd9fa-e838-46e0-b81c-6ed0776c2788", "value": 196048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782304910, "uuid": "3f454618-1ae7-4fa8-aa99-dcba8d4a0622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782304910, "uuid": "655d71f8-fd09-4abd-9e2e-7eafc0482cb9", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34878713-6ff7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782324295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324295, "uuid": "e4974d51-5b04-4b44-9280-b8e7702c1756", "comment": "Malware payload (Mirai)", "value": "c98fe10af12aa999e6e31d2b35b7a048", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324295, "uuid": "2dc5bd63-f9f2-4e03-86e3-96f798f659cd", "comment": "Malware payload (Mirai)", "value": "f8f2f5914ac8f8864a1204a58c9a38e4ab639c43f8722824990475bbf2dba223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324295, "uuid": "973a8ca4-e6a7-4e81-a780-0694a12a0874", "comment": "Malware payload (Mirai)", "value": "97098815531806eb837445d5e0887cfd732d6cbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782324295, "uuid": "6d897c94-39ee-41fe-aba4-38a9bf108539", "comment": "Malware payload (Mirai)", "value": "c9de8848a8f82e373968da21034ea3af6588f8098bb4968eaa6b0f5e9fbf75d3082548cbe09aa3948bc7113a273d3e26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324295, "uuid": "2fd12989-9564-45b3-adec-a0d399c664c9", "value": "T136142C137B324FA0D366D5720BB38B5A59EB01811EE258D1936CDB143A20AED685FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324295, "uuid": "3d971901-fb2c-4e6c-9541-e5c906916472", "value": "3072:CLMCXp2oJjHRLgyrHwbpW/4cZUKb0Y+NLOt89siqA9hbav1p+:C/X8GDRLgySa4i0vN6ziqIbava", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782324295, "uuid": "95573596-3820-4269-bba4-b8f823c82500", "value": 204548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782324295, "uuid": "6aaa3332-e92a-4754-9ee7-71dd1684199d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782324295, "uuid": "b3354057-9be2-4010-bfb2-3a184a352955", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136424e6-6fdd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782313072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313072, "uuid": "91fc3f1c-bee4-48ec-b288-a2cc42561752", "comment": "Malware payload (Mirai)", "value": "36f33105a492b25aeff337c278900766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313072, "uuid": "7054ac0e-54e6-4edd-a338-53814f3fad51", "comment": "Malware payload (Mirai)", "value": "f90223b63203e06737bbe1e2423f842205b386a2596b1c7b30b5dccfd8b6b18a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313072, "uuid": "4bc1c9da-73ea-4a91-ae43-0c0ab19308c5", "comment": "Malware payload (Mirai)", "value": "423cd8e9bdf7abe2f0cbe711f74ce8eecf810855", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782313072, "uuid": "f53a8532-0c0d-477a-8bc7-3d9c573536af", "comment": "Malware payload (Mirai)", "value": "7b979aaf477f462d6ba1a21f9a260f409bf43d59f90b259fb8830663d802de7901a0d683319d8a8a489f6f894babbacc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313072, "uuid": "8101de9d-f2e5-482d-aedf-306daacdde89", "value": "T1DE244B47EE880ADFC85BCDB08AAE836B1DE7A59B59D2F1F5443CCC0C745E28A45D3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313072, "uuid": "53b22c7a-2904-4e8b-bafd-d7dbc3bf8237", "value": "3072:HuYKZVUekaXzGli6qOnIgv6koMYuP0l/OPIaZkAZDaZOfLs4hfxDq:Huz3UXlcgCkFh0l/OQIkAZ7Q4hfxDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782313072, "uuid": "3dae5903-01ba-42eb-8a87-c54223ccf749", "value": 229608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782313072, "uuid": "d53291e5-7da8-48fd-b084-f27e46935c33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782313072, "uuid": "7ec3ad22-0f56-4f3a-9530-168c6d7f8c20", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df43ff95-6ffc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782326729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326729, "uuid": "58dd1244-dacc-4da6-aec6-9ae807eca462", "comment": "Malware payload", "value": "e4f3bd3ab584605e8bdd0d24d06c80ad", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326729, "uuid": "16dfe382-7f3d-4977-8dd8-f2f6f1286c57", "comment": "Malware payload", "value": "f9557670dd45bda485da28f6683f31cce7bc38bf7495389089ee39a8bf3142ed", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326729, "uuid": "0b68c6ac-6851-4d6b-958a-0b60469ddf43", "comment": "Malware payload", "value": "98b80688e7a2e3242504febb05d5c41a0e8bf86a", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782326729, "uuid": "dfd8950a-b3a9-46f3-a315-3e5b89a0f800", "comment": "Malware payload", "value": "7e910f0400eb0d753f67fc0cad29cd9ba3c4eaed56cec0cc82d84bb791dba2fad143e509e7a2dacb53f7f29679df56fa", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326729, "uuid": "22b37ccb-409b-4b17-aca5-0611e457217b", "value": "T12EB78D0773E601A6E5B3A1398A9B4103E772B4575731CBDB325C43142FABFE09A7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326729, "uuid": "4694417c-2f10-4490-b79c-c1d620dd790f", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326729, "uuid": "c2b93264-33d0-414f-bf11-2ef69ce57cb5", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfR:fMguj8Q4VfviqFTrYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782326729, "uuid": "2f4e05ac-27ea-4de1-be21-5438fc24c4f9", "value": 49922885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782326729, "uuid": "ac153f7a-6c3f-48aa-9030-8e11c98f5840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782326729, "uuid": "d1a4d6d6-53d4-485a-8146-ba87c92a3899", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207f5b3a-7027-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782344877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782344877, "uuid": "bcfbeb57-e03c-44e3-84e5-4d92ee0f246f", "comment": "Malware payload", "value": "27988a7e5afee247366e8f560bd37e14", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782344877, "uuid": "2b7b4253-2551-47c8-8e6e-c56a17563f78", "comment": "Malware payload", "value": "faecc582b335ed2b680ea464419c30943a04c05117ba76cefdd453ec983febbe", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782344877, "uuid": "f7cf9372-2220-483b-a4e1-6d0c89cebf05", "comment": "Malware payload", "value": "d8bf3a711962b0f52ca26fe424d48678ae07a245", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782344877, "uuid": "e0173245-4e5a-44ea-9c3b-5c9f95be3150", "comment": "Malware payload", "value": "c758f8d43d87223ff576dbc6d89e93cfc61ccb9774ffecb4b50b6ea5af8246725d5cf38052fbe24e537504d7df481518", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782344877, "uuid": "59c37dd3-40bb-491c-a7e7-69fd2123398b", "value": "T1C0D59D077CE188E9C4AAA33288B762957B74FC054F3227C72E50B6782F76AD05E76744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782344877, "uuid": "e6a8d4e9-09c8-47e1-9fa2-d0f87b59f495", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782344877, "uuid": "a5a86b96-0486-4938-9d85-b4a7d07efcd1", "value": "49152:EW/tR0aedpqaP/BuPhfobLQAeB02wx4Q+H6i+plxR1uV+:EWlmZM02TQHbxmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782344877, "uuid": "e996aa3d-d45a-4c52-a1a3-f135814b08f6", "value": 2781568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782344877, "uuid": "b45fd47f-a218-4a90-a074-bc3be778d1a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782344877, "uuid": "1ab271ee-cf09-4927-a307-cddad3b6826a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298f59e1-6f98-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782283474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283474, "uuid": "95ffc03a-2e58-4807-82e5-a1f3661da4db", "comment": "Malware payload", "value": "103fe1df58348f16f61a80951a27d2da", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283474, "uuid": "f7508770-d12b-4117-a4c1-1d495ddfbfdb", "comment": "Malware payload", "value": "fb999926e5637145f61f9d33df9cf7abe6527c736a8149bcdd8e2366e5531ce9", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283474, "uuid": "2f6d5c38-366b-4236-888c-01df7f4ad2cb", "comment": "Malware payload", "value": "ddb723e5ac2a052ec0a916ac6d06271693d7764e", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782283474, "uuid": "23b09ae9-f72f-4844-a292-fa5dd49478fd", "comment": "Malware payload", "value": "998d31f6c8831b4631d8fa13007944a5bcd6994f787c149692ae8be4e898a418da5976fa715eef76095164cb1c6d8500", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283474, "uuid": "b8f45e94-c081-45ef-95aa-7e788d0e2a95", "value": "T1A3547D1AF7A510F9E97BC57CC9424906EBB27C124761EBCF03A14A962F236E09E3D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283474, "uuid": "ee3c0aab-8ba7-41be-97e3-b9678184916c", "value": "0aa6edab19dac5d940abc7a5173267b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283474, "uuid": "20c73b53-7fc5-4ccf-be59-0066bf2463fc", "value": "6144:iMigALlPk4wO9NVUaUUqjUaC4I7mcp2PT95oqagkcY3PSH9GD:cxRVx0I7mcIr95J3c3PSUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782283474, "uuid": "58a32cfe-7dbb-43f4-92ed-ef833486288f", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782283474, "uuid": "1d45a682-686b-4b5b-8142-0516c800f461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782283474, "uuid": "b8aae507-b5aa-474b-8954-0e348796fc5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361966f0-6fa4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1782288649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288649, "uuid": "2e12476a-d3c4-4f13-aad2-f7e826349520", "comment": "Malware payload (XWorm)", "value": "5873a091904bba25ec8af467d9d8edfe", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288649, "uuid": "b7ca7ef0-5043-47bc-89fb-703de0ccd7a0", "comment": "Malware payload (XWorm)", "value": "fe4a930a99df7e32db43fd5545ff08a1ff89bce1343bf0ef2af3fcb1b7006907", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288649, "uuid": "881c197f-45de-498a-8eda-ac93dc62a376", "comment": "Malware payload (XWorm)", "value": "b7af939b494e66fbbd8eca01ab25fd105b650254", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782288649, "uuid": "94f1def3-070f-4f12-af01-3a856d3aaf9c", "comment": "Malware payload (XWorm)", "value": "0849cf483ff0ef882b82da6e798da6d881b7d8ff7614f2ce8e7438072721f7b6b55f5f3941672592eda3c4f4b3d01066", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288649, "uuid": "d0623759-5b9a-4940-895b-96ed7665c2c3", "value": "T1EF75C59816DACA0BE40310C53EA7697F9CF582B1025F4D42435FF27286AFB0E979719E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288649, "uuid": "88cf2605-8111-419e-bd88-91466284b6a6", "value": "768:OcCGCviADeVGmLHS9WUYiH+alKMoBp4YoXzc6tXzBfheaBMBl:Ob48WUBjDBNq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782288649, "uuid": "b3070787-9e7e-4d10-83e3-fc9ad74f492b", "value": 1579750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782288649, "uuid": "c719a139-fa43-416b-aae6-dfdf483fed32", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782288649, "uuid": "7701c08a-c892-4ef7-b6d5-1afa057d92f8", "value": "SHN2026000000026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbcb48a-7002-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782329333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329333, "uuid": "f8dcd7cb-94d0-4c05-95d9-0a1110c94d7c", "comment": "Malware payload", "value": "beeeafede3af16339a59ac5b062ce9e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329333, "uuid": "ba38d4aa-3094-4195-bd22-ecc0b2f069f5", "comment": "Malware payload", "value": "ffb744e91515a6bdb0bf0588065455efd591250c882026b6c16f6afca11ca98f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329333, "uuid": "efe3494e-85e5-4a45-ab1a-a2ea233597c0", "comment": "Malware payload", "value": "32d96d18640d935edf82df346f871c1beaea2e99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782329333, "uuid": "49df4ba3-3cd1-4f18-b8cc-43be5ff1d05b", "comment": "Malware payload", "value": "02b1335f7b4f365ea8bd397d47ac855225d17cd940b7eb68fc9f73b6b426af6e921ade818f3caced848b23f13986d047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329333, "uuid": "a978533f-a3c4-4273-8691-20614be8ac73", "value": "T1B373F854F94784F9D80359B098A7F33FA770D9485235A61FEF89AF29DA33B06521238C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329333, "uuid": "5b521823-071c-4946-9b4e-48f3097d2751", "value": "1536:SBRyLmS6qPcISxxE3U/qZPNXwS7hXdh0hn4htpXb9VjZFMx1Sz:Sjvq6xxglXwS5Ocb9RZ81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782329333, "uuid": "021d5922-2dd9-432a-9a38-03b2eee6d54c", "value": 74704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782329333, "uuid": "e28649f4-8cbb-45e1-9620-08376165d5ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782329333, "uuid": "2afadae0-d0d6-4fca-8575-b66202b2d49d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }