{ "Event": { "published": true, "date": "2026-04-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-28", "timestamp": 1777420981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b214b416-76fb-4d10-89c9-b1580c03abd1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba070f9-434e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777414032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414032, "uuid": "38ce98d5-4cdf-4bee-bf5a-7188a8818304", "comment": "Malware payload", "value": "33603a9532d0444146db3faa05ada78f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414032, "uuid": "e763ef1f-73e3-4714-8614-5d6299d5ed05", "comment": "Malware payload", "value": "00418f978e8448a1702d67c31e004d08c73bffa654eb3f2a646dfeffe05c2b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414032, "uuid": "3cb88b5f-45d9-4cb6-bccf-4940af392b77", "comment": "Malware payload", "value": "15d13a869a7dbcc0196ae9bb89fd6d584176cb7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414032, "uuid": "03a78c2b-b769-4b8d-94b7-0b036672d8fd", "comment": "Malware payload", "value": "cbefaeaf2576d441612dbccbbe9bb8bd8a3d9c5a7ff795748abe0b058374e95dac9dff10882e2a97758f2d26d891c009", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414032, "uuid": "5a89e402-4801-4490-af54-826fc29be4e8", "value": "T1E643F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414032, "uuid": "7f797eff-30a7-49c5-896c-0468d535ca31", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfz/:5AG8nY5BZG2xxmLQLS/S7hHnQfz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777414032, "uuid": "d22a0f72-987b-4e3a-a5ac-6b6522544ab8", "value": 59654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777414032, "uuid": "6b9d4da9-3693-4317-9ff7-81a2fa14bba8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414032, "uuid": "61ea9842-a1f1-4271-9fb4-d80ec1388759", "value": "tokend", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194a81e8-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355402, "uuid": "ff0ee772-f913-4114-9f26-df6d18d28e72", "comment": "Malware payload", "value": "41f8393e5022688dc35c494473b8b9c6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355402, "uuid": "e675afe7-9dbf-40d8-8b59-7549253d946b", "comment": "Malware payload", "value": "0159e600b2c9d534710f8971b6434613e243301bdf13897d08b3901d5a493c18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355402, "uuid": "c058e775-74e5-4c96-ab12-7756480f1a1b", "comment": "Malware payload", "value": "e12fe15cd55303b6f94d9ad898424c0ba4bf90ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355402, "uuid": "49aac0c5-fb72-4c91-bf5f-3717901c5018", "comment": "Malware payload", "value": "1c7ff6f2a4819331f07accad160295e453acfc3bb3b41d6f40c69703d35f15f2a5a6d49d4d28d62ab83e349c35bdc58a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355402, "uuid": "76bff06d-9393-41dd-b33c-2835b0a2ded7", "value": "T1033723124ECD6E48CDD52E7D28F60D8F2FE949000134CD2593AE59EB5F8EE6B60B619C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355402, "uuid": "d5254ad5-ff1b-4078-a0c0-72bc729d02cb", "value": "49152:J/xR/xe/xa/xP/xp/xP/xJ/x7/xk/xP/xp/xdXAuNZ/xO/xi/xt/xV/xSXAuNw/n:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355402, "uuid": "78913bb6-e151-41da-b7b6-316ecc370bdc", "value": 23944476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355402, "uuid": "4815fdd5-68a2-4cb4-878a-db00a6aba344", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355402, "uuid": "5b65f176-5057-4874-8ac8-940241eb4b81", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47df5c54-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377814, "uuid": "49e2b38d-1f75-4dd0-82aa-54520a297b01", "comment": "Malware payload (a310Logger)", "value": "a8f65673529c7f5cb25a043f0108cc03", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377814, "uuid": "9ad8d515-72e1-467e-b5ae-0b54f08ac556", "comment": "Malware payload (a310Logger)", "value": "01f2457a0dd39f0adcb02d41e58ced5cdc3314f2bde7917c433c3f8e938ff44f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377814, "uuid": "b05323e2-54fe-444f-8e5e-fe2a54d5baf8", "comment": "Malware payload (a310Logger)", "value": "a982d34c09576fff5d28786aedccdcf13a65d5ba", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377814, "uuid": "9fdae4b7-e6f0-4f7b-9e10-3963f8a7cf67", "comment": "Malware payload (a310Logger)", "value": "cbc274c86094343f45f25daf93a009abb595e677af446176dd1dda0ae808b0269fe6747ba525a07edadf3550c3786c76", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377814, "uuid": "2698fa25-b99f-4479-9d7e-a2291f10ce76", "value": "T1AC95AE5EBD185F75A8004D5E661F8AB7DB25F82368F8A43C12EF5388C38D928471DED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377814, "uuid": "1cb5ee13-8316-4b28-a904-879c7ced1010", "value": "24576:vgHo9J7nPJSMDerBd3t2HJ1Vwmn3WFaO+UDSnP1zQ2nSelnYBs/eKwEmipW/aYiD:p+GNpnmsOICdg43kp/4ZwxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377814, "uuid": "1805693e-5025-4ee0-a083-00834f6f0bc3", "value": 2001146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377814, "uuid": "c8869b07-b65a-4f14-90c3-25130ebd53dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377814, "uuid": "30fa554e-ca63-40ba-b18d-3d16e87be636", "value": "ps_Iv3vdRDdfgY3_1774372550734.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89fe155-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777365118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365118, "uuid": "6983e11b-6158-48e9-bf66-9422879383bf", "comment": "Malware payload (Mirai)", "value": "9796fbbea21eacda3ea8195765957d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365118, "uuid": "7598d8cf-a7e5-47cf-bf5e-659e8392fc1b", "comment": "Malware payload (Mirai)", "value": "01f341229086f721006cb4d03476f7991d6dfb93ac34f651d36011115b856edb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365118, "uuid": "bf859ea6-ce9f-4882-a0aa-39d539f728f8", "comment": "Malware payload (Mirai)", "value": "c13960c9a2406793535a22732bf69e12406224ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365118, "uuid": "d20c4ed0-8429-4c83-a558-8183448fb7a8", "comment": "Malware payload (Mirai)", "value": "ec002c9b4284133fd9c9fe4e84c947bf03020d468f3a14ce2e55b1ab68c7411711f487a16c84efa1b2879bc2d3d153b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365118, "uuid": "2b1523a5-3db0-42c2-a5c1-2575e0d644f0", "value": "T19D73E942BA47CEF3D40714F041B7B63F8E31FD3A493285A9EB65BDA1CA235C16216368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365118, "uuid": "b4b66dda-a7eb-43ee-ad28-b6ae87ae1231", "value": "1536:SGl11IuDxOIX9GtkxBP4nIjzjR+sbUaWr8qabwnvbiXaGYDJo0q+A:SGl16uDx1XPBP4nIjzVbOIqabGjiXXYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365118, "uuid": "b28d312b-a75c-424e-a977-c86f02716bac", "value": 80328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365118, "uuid": "87cf8c65-122b-473c-96a3-61f2e44f3705", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365118, "uuid": "d059bb99-e026-4061-835e-2e60cf6e0b26", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2142ca87-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777377319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377319, "uuid": "8c8f7d3a-bfa7-45c2-b093-0efaac1c7422", "comment": "Malware payload", "value": "6ccd41e54b31ea3a1e5a457830b96d95", "object_relation": "md5", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377319, "uuid": "f62f1072-3863-4c58-bd73-c01907882342", "comment": "Malware payload", "value": "0213b5defcb1b4cdb373a592ecde647a5d50105703fcead1b5fd1108bf2bb8e5", "object_relation": "sha256", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377319, "uuid": "1b481b36-833a-4616-8eee-7d0c285ed0c6", "comment": "Malware payload", "value": "6850021573532ca462178502c3c6dc4c0f61bbe8", "object_relation": "sha1", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377319, "uuid": "91951b94-2230-4e88-95a5-55dfb946705e", "comment": "Malware payload", "value": "64516d946129e1d9237bc4c8862e744c1398be43c99486325fd502f0fc7224acb4865fae03d0b0559b5de5047c5e7816", "object_relation": "sha3-384", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377319, "uuid": "81684015-1481-4dd4-84a6-c1fe8881aab6", "value": "T1CF55335779EF6C74011EC3D3A2CB842A064B742DA82EA2D71F8786135DE5CD21A5CC7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377319, "uuid": "8d682e35-1e66-4685-9375-411433df1479", "value": "24576:swfoQxYfRE7zDuAmujKUgTAyuwFMoO70kiUk/lX3mmy3j2dCE/bK2onGtwM94rlP:zBYfREPKBujK17uwFMx0kiUktty3jLgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377319, "uuid": "05a76e5e-78a5-4b97-af0a-b29f0930120f", "value": 1326040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377319, "uuid": "7f2af061-e5c8-4979-91a8-67eb68f8eccc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377319, "uuid": "38d54b3e-6d07-49e3-8536-991c39f2e2ba", "value": "\u03a0\u039b\u0397\u03a1\u03a9\u039c\u0397_037BO35N.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a3d36b-42d0-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777359964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359964, "uuid": "13e0d60b-4445-479d-a9e7-d377c3a66fcd", "comment": "Malware payload (MassLogger)", "value": "778460bd6021b2ec09077261f55add89", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359964, "uuid": "f9d5c928-aa8b-434d-b16c-c54e69a538c9", "comment": "Malware payload (MassLogger)", "value": "03c5e69e23780d3e10b07c8cc1d0c70211a7a159430c5ea8fe31b881cc26f8a7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359964, "uuid": "9699c30b-abcc-4a64-a71b-6a092fd4e29e", "comment": "Malware payload (MassLogger)", "value": "165e94700a9fd6c4540a352769346d42a2dcc6c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359964, "uuid": "afc04cc8-d0e6-4fbe-a29a-77293050df83", "comment": "Malware payload (MassLogger)", "value": "267d86a97565fa5dee8345bf076dfad2c2bc21271ef0e9c6c7a1ae10f2c405f4b1249a36ebbc20a9c8aeb90ad90df714", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359964, "uuid": "80feae2f-119e-4278-a0d7-c46aca12500f", "value": "T11B75F11099C43FA4CBA91B1D50BF260EE7E00ACE5016694AFB23FD46BFF760096571B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359964, "uuid": "7de58c7e-9688-46bd-9676-c9f1f38d3d89", "value": "24576:FFoGlGaQ2dsvDX5yBnW2/igI9denLuYXL3iVlgt+7GA2rK3+OSMxaevjj:zlxoyBW3WRglXGyeMZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359964, "uuid": "b45311e4-dbd7-4ea3-b0eb-08ee10a4ddbd", "value": 1564344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359964, "uuid": "8a1df320-aeb5-464b-9e09-b8871715c513", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359964, "uuid": "ba169419-2fb8-4012-88fd-7a57ed94dbf4", "value": "FR240132-1-MRSB-VALVE-0006.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08db4a92-431f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777393599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777393599, "uuid": "8de91fb8-a65a-4da5-bd3d-cefd3d87ff90", "comment": "Malware payload", "value": "ae905128a39578e45d69bf2edea71ab0", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777393599, "uuid": "7d73ea27-f934-487f-8570-5497f8d20700", "comment": "Malware payload", "value": "0439d9a526e635920fb4f1c6de4949fad87d1efccbd3ce05e373e0a0e65a0fcf", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777393599, "uuid": "66a4f886-0ebf-4bdb-ba90-97fc7d31026a", "comment": "Malware payload", "value": "f6d96f1061d2ac2c275f9520cfe58e02542158ac", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777393599, "uuid": "e60407d7-de8e-4482-98d3-99d0376c622e", "comment": "Malware payload", "value": "e43b47cd43666835dd095689e6a8ba85b9a1205f2c66873f914f07de3f27d101d2e14266096f7bd02386034fc2251307", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777393599, "uuid": "cf2d7f9b-de64-4ee0-98c1-a25483441545", "value": "T1D5F60267D748A12EE0280D76FD31E5BC503FA66F791A480AB0F51D6CCB2B5627D2E243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777393599, "uuid": "44664914-6be7-4dcb-8dc1-dd0d67d7d9d3", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777393599, "uuid": "0c8ca4e8-49e3-4bab-bfb8-ede9e6790611", "value": "98304:kL8Ncwa6AEouGQGLDyR94UhsqwScBY4JSE2L6zBVM:PL8EQlnycUhYSZ4T2L6zBVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777393599, "uuid": "fd5510a6-08fe-448b-baae-5f652a44cde2", "value": 15291083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777393599, "uuid": "cd265d68-5a9f-418a-a177-abf00eac6825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777393599, "uuid": "1c669277-ecbe-4662-99e4-8af43d1825bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e59b7a5-42e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777368939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777368939, "uuid": "f0919192-03d4-47bc-aa42-377fddf5d471", "comment": "Malware payload", "value": "dc7640b7240006725a5c6a897298b85b", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777368939, "uuid": "ccc2a56b-f566-406e-8de6-21cd9f6a2e88", "comment": "Malware payload", "value": "04b2be899ff46dbd58bcd7f843eb3024fc334039940470591384d7d7ce84e475", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777368939, "uuid": "3583c2a4-75d9-453b-b1e5-c4cdaafd9fca", "comment": "Malware payload", "value": "62154294219d412ec33e2a6e7dca024944708eb2", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777368939, "uuid": "598ec253-a1cf-4007-ab7a-8784a3026493", "comment": "Malware payload", "value": "d951f1090cc2868184e4881f3abaa7696830c07dfbf017f9f4f070bfa12f120a97cde405819db8c9553923364131529b", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777368939, "uuid": "07231e17-7b20-4d9f-9c2b-4097b6826c12", "value": "T199C08014E6AFC146F312140650B0F5685C0E7A540CC1F0EC67D6DECB58CD4D0CD45957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777368939, "uuid": "1f456f4b-2ff6-4c35-860a-f1004303b2f3", "value": "3:HRAbABGQYm9KKJELMIYTMteNA6H51DdumyAiWHKs7V25YdimVVG/VClAWHyn:HRYFVm9KKKLMIYAtrU5Smszs7A54vVGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777368939, "uuid": "bfc9c1a0-d2cd-4251-b1f1-e2cdabd84ece", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777368939, "uuid": "47aa6dae-8e96-4305-b7e4-278d644956f2", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777368939, "uuid": "b93313be-a8ad-4da3-b3cb-718d68ca1317", "value": "Rechnung_2026_04_46220671079901.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235ed17b-434d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777413401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413401, "uuid": "b2af640f-6225-4505-9e92-4bbf9b64c982", "comment": "Malware payload", "value": "ceecfa3dd29601f46c631878426118f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413401, "uuid": "b314350c-a015-4687-a251-3f9b4ef45925", "comment": "Malware payload", "value": "04b96136e242da1c8f2b342f903d868e6f578a1d5952ff14d78b7c0e555bfab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413401, "uuid": "a2559d8a-3459-4eda-8834-b2bab4805e71", "comment": "Malware payload", "value": "3e7107670dcaa1fc8a47ed59679a5d3e435069ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413401, "uuid": "7afbee12-8585-4bee-abf5-f0f24f07a167", "comment": "Malware payload", "value": "f9b68b09cf78becafde450c564013f839db2fbce473984636be27c0acd8a32ed8b75fe0de2b72226081b5bc9918b3338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413401, "uuid": "10b8e1c6-94c4-40de-954f-60194d947600", "value": "T10C43F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413401, "uuid": "0119281c-0432-4e29-bfe8-e6f67754ecfc", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfzL:5AG8nY5BZG2xxmLQLS/S7hHnQfzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777413401, "uuid": "1d0a8393-aee7-4a6f-8c47-85022070f542", "value": 59609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777413401, "uuid": "6fd79840-1059-458e-b282-0fe5ad5028a7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413401, "uuid": "ec80853f-d688-4efc-952e-a0b559ee833a", "value": "pam-helper", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb8f1e3-435b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777419535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419535, "uuid": "64e6bc2b-257e-499c-96c9-a780c4cf6d61", "comment": "Malware payload", "value": "37ea9b4e721427cb7dfd6ccc8d1c2e15", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419535, "uuid": "3a8e864c-8a4f-4cb3-aa69-afc8d7e011b2", "comment": "Malware payload", "value": "04c2a86997a4df7a06c1ee500505e7c345f80c270ca41164e0a28864fb471426", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419535, "uuid": "2c57b4bf-8982-47bf-aac4-2cc2de02eb1c", "comment": "Malware payload", "value": "e6c238dd1fed6d3048b1081040cdadf258fd7637", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419535, "uuid": "23a1cda5-394f-4ad3-8467-2f0154d244b9", "comment": "Malware payload", "value": "fb458680af1f41f805ded826b6a2301cc95f8d1d1e69f117b24005c59c5dbd06cde6d345ef66170925fa7238b5076763", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419535, "uuid": "0bb7c193-aefe-41d8-9d25-51354c2ce67c", "value": "T177B67B0678D010FDC099BA3249F276967B34BC580B3267C32E95AA783E77BD11C7674A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419535, "uuid": "1193cdfa-180f-4ba6-99cb-e916fd274566", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419535, "uuid": "e6347e93-7718-49f4-b916-cfa0f32d3d0a", "value": "49152:5qpp/iYrcbzhHl+195s+s/A+nLqT9Sc18whttQj/I3i:5qfhrOD+1gzhcuwh3Qj/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777419535, "uuid": "9546595d-3764-47fe-a3c3-0eaf3a48d8a8", "value": 11011280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777419535, "uuid": "5bccfe9a-f328-4d61-9690-1d8f5863a095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419535, "uuid": "e0041f6e-d8ed-4edc-a6b2-ba526cc8d0c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f7422b-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377681, "uuid": "72a6e6b6-c173-4219-ac69-a00bd6150a1f", "comment": "Malware payload (a310Logger)", "value": "276eaab435688695db320ab24743752b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377681, "uuid": "9c9c7124-238f-4cc2-ba5a-1e998ee15c0b", "comment": "Malware payload (a310Logger)", "value": "04c8e71c8dbfb89dda30f1a46e49da456b725592bc7b2bd550405b4430c8e038", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377681, "uuid": "6469d330-f65d-40cc-9d49-4a119d164354", "comment": "Malware payload (a310Logger)", "value": "f4142dc56ffffebc8f5857d294361c41cdb027e8", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377681, "uuid": "b6e09a06-8f2f-48c0-8de9-4e5ebccc95d6", "comment": "Malware payload (a310Logger)", "value": "f7f23a54a7e91ef6ed7563ab8d639bdc2f305894b6ac9069765ed9751ac819d5b503e8d24103d8f3b2970cb304a2c25f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377681, "uuid": "a094f0f3-7d64-43eb-a0fe-e0ea2d3559b5", "value": "T1C9A56D43EA761502557742FB8FB4ECE42CD0EB39F617F8F97AC64C8346C6AB51806682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377681, "uuid": "ddc12f12-275d-4606-a0f7-fc8e8b4336a9", "value": "24576:+jaSHbmIieTVklzEpSUeAK3i2yHcPyMlSihEjj2jwByOAMeN/19O2q6YK9SAqIke:+/9Yy8Pz4iqj22yOAMeN28T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377681, "uuid": "978ffb12-4447-4571-8ff6-0ad75503765e", "value": 2266079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377681, "uuid": "e0d267f2-909f-42c5-91bd-69617b5b8b6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377681, "uuid": "a3466fa5-4670-4787-9679-328d9eadd4f9", "value": "ps_dWR98egPld49_1773069022803.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3ee229-42a5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777341367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341367, "uuid": "4064c13e-3565-4f60-928c-dd9a7b7c8102", "comment": "Malware payload (AgentTesla)", "value": "b87a9a5ff7d02a39e7a2a85cdb13e688", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341367, "uuid": "cc4bdcff-5d8c-4ec5-86db-44c5814459a1", "comment": "Malware payload (AgentTesla)", "value": "05195f07ecf2a40a5551537ffd328add87dabafe6392f5e858c42f51fb9ffbcc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341367, "uuid": "3df37ce1-5a8c-4aec-988e-7ab1577a6868", "comment": "Malware payload (AgentTesla)", "value": "9252e13a587021c7876e16c77bf7ec95d69e14a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341367, "uuid": "49a408bf-215c-4cac-91f8-49d52c910444", "comment": "Malware payload (AgentTesla)", "value": "8958a5ed746a300c4ecbaebec56fb527c3899e451ee5b0b3c0ea1590779c0dbd7b78123b50bf4536a68fb302f55a333f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341367, "uuid": "51a6405f-d3fa-4ddb-9a6e-b69cafc36eb5", "value": "T1A335D0109F4A6F18D56F0BB8C012186867F2DD139E96D7CB2FEC9CF57867B848A22513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341367, "uuid": "452f5405-7690-4e9f-9a17-831002a478ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341367, "uuid": "ece76a20-7eec-4a0a-b587-54ed679451df", "value": "24576:VhZOo04i0SMXP5NhFEgUVmpp5F50DbG3WNk1+jj++9:PX040ORNhFIVmpn6ag48j++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777341367, "uuid": "965f0d36-ba82-453b-9c69-b6940a124c15", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777341367, "uuid": "1ea20fc8-f7fa-430e-8f0d-7feb66db6315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341367, "uuid": "d0fd3761-376e-43d8-a3df-668bf8f94c25", "value": "ATF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f01a23f-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1777400535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400535, "uuid": "5b995db6-47a3-40f1-8813-cd69d10a87af", "comment": "Malware payload (DattoRMM)", "value": "7d97923ea7f467c0fb30be99a4d15d77", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400535, "uuid": "791643dd-7914-40c6-a2fe-f8baf9b4c51b", "comment": "Malware payload (DattoRMM)", "value": "059a6c5d95a86252859cfefa8afe51ddf2e97d4bfa15c7e80af12c3572da2d7a", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400535, "uuid": "aa0b79df-c980-4ebc-8dec-272a9dbdc1be", "comment": "Malware payload (DattoRMM)", "value": "454a2337fa796ee747c111526637c17870d5d982", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400535, "uuid": "c4a87c40-7102-4575-b5fa-f7a79494a4f9", "comment": "Malware payload (DattoRMM)", "value": "a0dbdc2051efb514e45da03b4336a97479ec75d92dc83580f2971c383919f05b0dbcc45ce8a65ee01c847da606ad04ae", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400535, "uuid": "ccab0b83-e483-4efd-b908-b1463b6cf5cf", "value": "T110B63347DE3BCEF4CB63463C89831A57124F598D8C47E4C9E0482A3589E399ADE38F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400535, "uuid": "98c1f28f-fe2e-4b90-8cab-ab02694ea83b", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400535, "uuid": "f0ff63ff-c90c-4124-a1bb-337bc6aadd04", "value": "196608:DaZk+wZbLGmnYZJukGkxGB8rM2VPFOsti7A95vM9sFp29XaIT030HyyG+zzDz:jn1nkGkx08rtE7AnMGp29qIT0WzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400535, "uuid": "1971e1d2-6c1f-4334-ac74-164148390431", "value": 11055536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400535, "uuid": "55f60cbf-d014-4ddf-ad2a-99da4f437cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400535, "uuid": "6500122a-70c8-48dc-ac64-79d4346c14fa", "value": "VIP_eCard_Access.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f336fe36-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403441, "uuid": "19500ca8-61f5-450c-b1c7-a816104c579d", "comment": "Malware payload (Mirai)", "value": "d23feb0d3a3bf101d8041b17dd1888c4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403441, "uuid": "d35dcc25-5ab1-416e-9b6f-a3b22d313e75", "comment": "Malware payload (Mirai)", "value": "05fa1f24e970b48a8909757c696b2fdb38e7eeda508c9fd6b3d9a46d8f4c6b54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403441, "uuid": "b5c9e22f-0711-4546-a116-343b03a13565", "comment": "Malware payload (Mirai)", "value": "906643edc52b788c6667efe0c4746f6399f36916", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403441, "uuid": "a7b60bac-cff6-481a-91ba-6845dd861b95", "comment": "Malware payload (Mirai)", "value": "8ce4c22a68bb320edcf5b68ef4c3d3af21ebc1e502741373c536775e8a638ee65ccd3de580b4e822d319d99900330287", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403441, "uuid": "ccaa7853-b333-4ef6-a8a1-4b2fa3d68798", "value": "T152B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403441, "uuid": "836e1f67-d790-4c0a-8a74-42ecdb8951d8", "value": "1536:TUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45ZvM:AixnUHz4Z+5ypkn3E8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403441, "uuid": "71df238e-593e-4205-a75c-36c607d99a82", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403441, "uuid": "fbb8977e-4536-41e0-8742-ef23bc23f9c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403441, "uuid": "fe8944b0-f03f-4f5d-a3f6-ec85993ca4a9", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65d9199-430f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777387072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777387072, "uuid": "60f19c5d-b862-4247-8299-b544f1f44cc7", "comment": "Malware payload", "value": "0fa895957535e2ab0431bfe961a8cf39", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777387072, "uuid": "020f0d76-be12-4e0e-bf6b-98396e8625a3", "comment": "Malware payload", "value": "0610f14dfa8685276e6eb915570b8fbaad22ccf5084354d514e96fc2c2f92d09", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777387072, "uuid": "6e0e379b-b7de-4980-9a18-d8793b9ddf3c", "comment": "Malware payload", "value": "04689646628411e9a324324cded9f2adc458c05a", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777387072, "uuid": "fca0e911-8685-46b7-85bc-ed32def9af29", "comment": "Malware payload", "value": "1895a3d161b672293cdc3c7f9b980f8dd64a3beb3d803c615e485e39ca3eaf2fdd4d071458073cae2baa92bc8efad558", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777387072, "uuid": "5e63ccda-553c-49b2-943c-fb9ab1a4ebac", "value": "T10017D049F51CD42BEEC9B0BC8D8B07D3B5627C151614C18B2822B60DFDB37D4AA66BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777387072, "uuid": "bab19b7f-b346-421b-9f68-65a8e775ddb9", "value": "393216:g/fJ63yiIz51dYbEzyAt9rQxCuKrW701QCF6:gp63XU1ibvgcFv46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777387072, "uuid": "7429ba69-a4dd-44b1-b539-c12686ec03ad", "value": 18864378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777387072, "uuid": "f0b3eb8d-f7d3-4031-8373-308b13326b5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777387072, "uuid": "28deda24-bc1f-4d87-981c-7982bb07005d", "value": "com.text.imessages.texting.sms.mms_1.43.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f045636-4342-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777408883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408883, "uuid": "7a90e1bd-716b-4d56-87f5-f8379c3c463a", "comment": "Malware payload (a310Logger)", "value": "4882cc3b894ecce9887726f51abf7ed9", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408883, "uuid": "ab459bab-38df-4d6d-89f3-ab46a0f7e3bd", "comment": "Malware payload (a310Logger)", "value": "0803573917ba44e808c7b4e1f8eba1106afd495ff1886c895f3a2d3fef51d6fa", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408883, "uuid": "0d39722d-5e5c-46c2-ae29-9647b1edf929", "comment": "Malware payload (a310Logger)", "value": "610b18fbf367fa9b92eef862d276e9a9a89f2a6e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408883, "uuid": "0639b19d-0f9a-44c6-9f3a-70dec746a94c", "comment": "Malware payload (a310Logger)", "value": "c618c22a82bdc60f6609296ed89f116a95f5749b95049487525fc75cc1d22eca9ac366d45657f62d70d5ba6e78cafff1", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408883, "uuid": "8c45932f-75c5-4987-9c3d-bcae85d6050d", "value": "T1DC856D0BED37298FDFAA3D698A0279C73464F3C599BAE8F11ED685C0905C38170636D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408883, "uuid": "2ab63566-699c-42af-9d37-6bb0bae7d42c", "value": "49152:n6pR0mbpsOmd4kRNbvHbSU7Fd0Ul+mHmOm/WpuVN:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777408883, "uuid": "37612017-c9cc-4a47-8258-26e3b3852ea6", "value": 1834141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777408883, "uuid": "18a7b96b-2ea8-4e94-a88f-0289fdc84b5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408883, "uuid": "ba892a42-d0b1-41c3-b43d-217e56f77675", "value": "IESIDSBTWN.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4313c1c9-430b-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777385107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385107, "uuid": "bde4c3cf-592f-4f58-9a3c-39a51d8ab21e", "comment": "Malware payload (NanoCore)", "value": "791890008091dc1ef331bcac5e20e10f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385107, "uuid": "17dc0cfb-5512-4b3d-8d13-7efffbe2b109", "comment": "Malware payload (NanoCore)", "value": "0985df3266e3ec4114de916f7803a8db2c6683355137d74044c1fe4001419963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385107, "uuid": "1b190d47-853e-4ea6-a1d8-e46214280deb", "comment": "Malware payload (NanoCore)", "value": "4586b2f0f60b8f5aa323e33f55eaed3447a1cb55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385107, "uuid": "772cf1c6-0c7e-4a8e-bec1-f5a6002280c4", "comment": "Malware payload (NanoCore)", "value": "a9b97d67bca3d9bafb0ecc686a3887ba4eac750b661b33aefe6f09ee37fa212026e8d3bc4cf96db2b76d1ad00e4dd7bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385107, "uuid": "9bb04d4d-7ca7-494e-882f-a446eac6aa4d", "value": "T14214C02677A94A2FE2DE86B9701212039739C2E3A8C3F3DE58D454B75F267E4060B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385107, "uuid": "2dbef162-de60-4d08-bc88-1062104741de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385107, "uuid": "4d4d7415-c650-400c-b340-236a4b3c0837", "value": "6144:sLV6Bta6dtJmakIM5TitzMM3/mpjxE7pzpTVr:sLV6Btpmk8itoxizpZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777385107, "uuid": "74affbdb-8c53-4556-a18d-5a0dd6d155cb", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777385107, "uuid": "d2f11976-c12f-492c-9846-797fc5dea158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385107, "uuid": "610142ec-28bf-46c8-8be5-d1e91b3456ae", "value": "xratssex1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1f20d9-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403270, "uuid": "e54750da-36e5-43bd-89f1-5be99e682c82", "comment": "Malware payload (Mirai)", "value": "53edbc32c1c443b961b30b144f0f0833", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403270, "uuid": "4a4ff617-6350-49fb-a665-7a153262140b", "comment": "Malware payload (Mirai)", "value": "09907416499aeaeece6a1b684eb86050fad13c413c8bcda0bd1509bf15ce0131", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403270, "uuid": "cdaa9df6-1c66-4940-8afd-ccb73a98af56", "comment": "Malware payload (Mirai)", "value": "fcd98d378a6304978afa1524678803e2b53ec646", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403270, "uuid": "db648d5a-c7bf-4144-9dcd-c3792db4173b", "comment": "Malware payload (Mirai)", "value": "f14a75dd9c3220517c908cf0d9276121218e66c8362422e91d6599347a8e473033f84b224111501e189ace1419836c04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403270, "uuid": "d5624b25-970c-4fc2-b94c-40b179c8ccee", "value": "T193E31A45FC909F26C6D612BBFF4E428D772A5798D2EE720389255F20378B85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403270, "uuid": "92ab6cf3-2d29-45c2-840f-f8de4b633651", "value": "1536:2mkxF0jdciO77CAUjQBQFUXChNGlPzBLLADgugvT0M0OEKnOc2HDN30pqUilQcwV:2mhjO77pxCN+lAVgv10NRx0gCYhXTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403270, "uuid": "5949fcc7-ec60-40fc-93e2-b2a3a99203ec", "value": 145964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403270, "uuid": "5ec78f7c-9dca-46b4-bdf7-1978a4c396e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403270, "uuid": "283d8d06-58e5-4254-8eac-56092cca5cf9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba90e1a3-42eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777371563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371563, "uuid": "f5726c12-0441-4cd1-8cb2-355c1b3b906d", "comment": "Malware payload", "value": "f84a34e02bc775849f33b2da1487bf94", "object_relation": "md5", "Tag": [ { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371563, "uuid": "54fea844-1cc4-413f-8999-ef9676b62cd5", "comment": "Malware payload", "value": "0b07e491fec9174843b458b231cc6939c45931ca6333f4c920d18353b0245c5c", "object_relation": "sha256", "Tag": [ { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371563, "uuid": "18e64395-9d90-4d9b-801b-8e286cb4575c", "comment": "Malware payload", "value": "0c4f0537205a92a97699291d47954625279e1105", "object_relation": "sha1", "Tag": [ { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371563, "uuid": "ce26b341-c27e-4f14-ac99-46e2ee11e55e", "comment": "Malware payload", "value": "e55f1649fd191072ed3c86997a09c5a4e444d35ce87fd3c87de2f0de82c9bcc3119cba0978a1f95fc4273482dbded117", "object_relation": "sha3-384", "Tag": [ { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371563, "uuid": "8638f641-dcf4-4cfb-9735-4ce0bd472b43", "value": "T16805E025B102B174D2121BB00CFBC169B23AAE58BEB5D4DF79D47F299F321DA111924B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371563, "uuid": "51a956a9-11d6-4118-8fcd-3e9be0a4df2e", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371563, "uuid": "2c745485-b1ac-4154-9850-35d7dcadaf08", "value": "12288:SANwRo+mv8QD4+0V16N4Jh1Wip01c0qlBVNVuda/Hf0BvcLhqjohIS9:SAT8QE+kGC19p/ZbudysShqj+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777371563, "uuid": "87535bbc-37ce-42fa-b316-352c8ee15374", "value": 812450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777371563, "uuid": "284e8788-bec8-4df4-b432-8090b494e88d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371563, "uuid": "74b801dc-97ff-4471-988e-8bfa16faa0c0", "value": "spam.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff6b467-42fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777379223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379223, "uuid": "bdcf5d72-a5ca-4f63-847f-1694495bbe4a", "comment": "Malware payload (Vidar)", "value": "7bcd47ce22143d687752cf6ec21ea3a4", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379223, "uuid": "ce020776-b030-4ce4-adf8-09b04e14b03a", "comment": "Malware payload (Vidar)", "value": "0bd85d17c40b65d4e5c77a80f384a7482fc946f36d8f4c18772313956a8501c2", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379223, "uuid": "c1c8d942-9952-4e59-bbc4-98900535f898", "comment": "Malware payload (Vidar)", "value": "c2a61f10f7e562d1ff39ff7475e4363168c37174", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379223, "uuid": "7f11e05b-ca36-4e27-95f1-d40d2ff0248b", "comment": "Malware payload (Vidar)", "value": "be406d0c39ea09e4a745b344c3233e0e815781aac870a78cd4db6d1fc7999d5ef24fe478b120737978d8b5b522226102", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379223, "uuid": "242ba153-a65a-40dc-9085-b1db08d3b663", "value": "T18B6618819A9208E4C3B45038847AB7393A617C2953F1A7D766F061313E33BE59E7BF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379223, "uuid": "233b5517-4b99-423e-8d7b-f1e687089834", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379223, "uuid": "0c80920c-5e9b-411e-9710-571cf78c5273", "value": "49152:mC8tsV0VsDzvxSzBgnl8l7RUqhCvNz5+4dA2sulYehp1J3bs:mCHa2BQSK4NzcCjsSn1Js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777379223, "uuid": "84f9c96d-100c-465b-b449-21062d625fe3", "value": 6540416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777379223, "uuid": "d964067b-1428-437c-91a3-704f273b4d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379223, "uuid": "87b0ea46-2a30-499d-9909-d617d9eee8dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c5801a-42dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777365536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365536, "uuid": "3eccb91f-f122-49c2-991e-ccd27fbe301a", "comment": "Malware payload", "value": "167538ca94ab799b6ae3b17fcd62d8a4", "object_relation": "md5", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365536, "uuid": "7916003f-b25c-4b0f-8158-4d79c695de4c", "comment": "Malware payload", "value": "0c1a4cf8f587b91f8bed5ee7acd2ad93cd315acf4d400e6be65f44f49fd66d40", "object_relation": "sha256", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365536, "uuid": "43224a01-511c-41e1-9c7e-b39cf0bd5e22", "comment": "Malware payload", "value": "cb2ad44fe4779ae5aefb6ad6600d78448827d789", "object_relation": "sha1", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365536, "uuid": "c03728a7-2f7f-4099-b976-9fdae61f9b69", "comment": "Malware payload", "value": "1e775b278fd83a4ea18ff99c9d0f159f43e2182a389c64a961c079af306f89fdf6ff80ff7d9791f81a44d821de4d5b1f", "object_relation": "sha3-384", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365536, "uuid": "5ce3ecb1-d89d-4739-9155-a81d625be91b", "value": "T1411833F3E6D4F166D2E15AF09A8B63138A762C850EF4205452A6BF3CD6B527CCE70781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365536, "uuid": "fd18bf1d-8d5f-48c8-a2ac-0648d89acfef", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365536, "uuid": "f6a00e5c-2903-43a7-adce-be02062fc4f0", "value": "1572864:kCL3JtfoVhojpE1IuhlU8wuaNBsviQ9hDjNNJXqofX/A2YAYZwQT:kCL3Xgoim8lHwuc4RWofvNYZGQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365536, "uuid": "1df86e34-2b72-47f1-96f2-2a4e9667625a", "value": 87172376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365536, "uuid": "3d453f17-ff3a-499a-a492-49fe874704f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365536, "uuid": "e9f6013b-555e-472a-8b24-bae266c890dc", "value": "0c1a4cf8f587b91f8bed5ee7acd2ad93cd315acf4d400e6be65f44f49fd66d40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b359ee-435a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777419229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419229, "uuid": "3a53698c-8d5e-410a-942f-521eef621bf5", "comment": "Malware payload (RustyStealer)", "value": "fdd882984a57b608b4d0cafd682a67cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419229, "uuid": "c7665884-16e6-4bc2-b9e3-6f02d87f6176", "comment": "Malware payload (RustyStealer)", "value": "0c8de947fb1b54efcc07b986f8c24807707876eebe74af7751efa277326c5e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419229, "uuid": "eb35f7d6-abe7-47a9-adda-ad1bc2886e4c", "comment": "Malware payload (RustyStealer)", "value": "b7bd45ed46bced243c02f46290c80fd7d223533c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419229, "uuid": "7b8165b4-ccc4-492d-b726-5262d5bb8ecf", "comment": "Malware payload (RustyStealer)", "value": "6a1952b3d20480dfb8ed93e95447c952298bc058bdb5bfd942e02cdc13c35e223fddde25f0af60e036eeb947d439cdfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419229, "uuid": "463c62a7-1246-4ae7-aa2f-4dab3a680b62", "value": "T15DC45C03B65515ECE0F9C13AA346A933BD73B85103287AFF06D44A632F54AE26B7E750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419229, "uuid": "69df8f7b-3a23-44fe-a41d-b230a0d804b8", "value": "187d06fcb051f46053b6d25c72db12ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419229, "uuid": "676f1247-d6e1-4a18-b7c8-05c1ecb34ac8", "value": "12288:DdIBmCMpQbZ35wQqqC2M9hFBs59Nutzl:JIBmTpQ9mlPnsZut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777419229, "uuid": "4c7720fd-34f7-4c3a-9837-0949f8dcd2d3", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777419229, "uuid": "94cb07a2-f939-4140-8c34-f8809507c99d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419229, "uuid": "19b5679e-2c99-4782-96f0-0b157adb39c5", "value": "2026.04.28\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u68482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01fd635-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777377666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377666, "uuid": "33bbf66d-c2f1-40a3-9337-8f5997497c13", "comment": "Malware payload", "value": "07379b75d389ae2d3cb03494955b1443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377666, "uuid": "4f511439-eb1c-4f10-96bc-be29bdb3075b", "comment": "Malware payload", "value": "0ce76e80399b4b281aba1687b761aaaf3f90dc3caf5a1aba8129968b618a7d22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377666, "uuid": "c316986e-abec-4b46-95dd-4bc7cd80587d", "comment": "Malware payload", "value": "14d84cbd7cbe86c3fba60197d9f1668f3feb28e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377666, "uuid": "558ad3ba-7c79-47df-a03e-4c28a2e649f6", "comment": "Malware payload", "value": "c1222faa21fc107018ea4bc15e0b7322797d6a3b105e7b2db87cf66e3b39c42458a73c9e93022d41ebab3c0803f84d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377666, "uuid": "ca188974-ba14-4578-9c33-b21287af1c5e", "value": "T19444B003F65180E8D16AC17457EAE633E727FE481235B31B2F92F72A2EB5750A94D318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377666, "uuid": "0f070fef-157c-4f4d-8cfb-71bbcf3f84be", "value": "a1a76e5600e6d5875aaf49604e9f6a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377666, "uuid": "b4ce0c8c-c669-4a14-9b76-b797b78d6412", "value": "6144:Wcito58BoS8LU35alSi4rqkj0B0jCecb:RV2CLBlSDz0B7eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377666, "uuid": "c57c95ad-3d4a-44ac-a0f1-e431b661014d", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377666, "uuid": "4855ea2e-90eb-4638-b14d-47a7798ccb12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377666, "uuid": "8089e40f-75e1-4092-ab62-980aa00eef52", "value": "dopuslib.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c753633-42df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777366144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366144, "uuid": "df224ff4-4ac5-4acf-93e5-dbc89fa307ec", "comment": "Malware payload", "value": "939d9862492f91dee4fb3ea6962cf45b", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366144, "uuid": "400f7847-2641-409f-8da1-3af2f28a5ebc", "comment": "Malware payload", "value": "0d5cdb763b621764c66bed0832bffc48da7441397e8d2c6d954a6802e375cc02", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366144, "uuid": "30b17576-d2e1-454e-99a4-3e4f62fa35eb", "comment": "Malware payload", "value": "5fb5f9838fa5e781e176233cfd1c19a0e549a331", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366144, "uuid": "46792623-2193-439f-a6a4-12a4ab6d2b68", "comment": "Malware payload", "value": "e2fa56d82d931796cf427578daa7a9a9ad93f206f0f2d0fe4d89d74567098416a97dbeeb55579a82ea47502b48c16e7f", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366144, "uuid": "7485b5ba-0625-4583-9862-c0ac08f8cb0b", "value": "T1398533FDC1C86ED74AB5EA178B2408404DB05BB0A439FF65545787702D493FB2CAEB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366144, "uuid": "ed32dd13-2515-4089-9a70-fee649bcb61c", "value": "49152:2KqJkLTpnZJwgCAKfNvbNNZbHM/X/DvLCXARBTaSO8R:2YNZJwgCfNvbNsP7jCXAPd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777366144, "uuid": "9488c910-f0ed-46e3-aec5-71eec2b18a94", "value": 1826048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777366144, "uuid": "dee50df9-d842-4482-82d8-e96b553e8618", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366144, "uuid": "b062903d-1368-4207-9463-48b3a8e9b20b", "value": "9030a6c30c3ff3480ea312e3db50f8bbbb03c956adb231d26dbcbbc7d008cebb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec602c04-4308-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777384102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777384102, "uuid": "64df5fb1-cb20-4ed7-a1f1-da7fb155a278", "comment": "Malware payload (RemcosRAT)", "value": "49030f6cedf4545e14bcc45f74cdd4cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777384102, "uuid": "548f458c-f69d-48d9-859f-8cba619b0c42", "comment": "Malware payload (RemcosRAT)", "value": "0f0b92a937983eb9d9d622978d7192bb6c94d4923adebd162305bdff00367190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777384102, "uuid": "886183ed-d94a-453e-91de-825c14e53e53", "comment": "Malware payload (RemcosRAT)", "value": "625aee838dead9b846a3945aff537bec6a9a6d2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777384102, "uuid": "687594ff-8b25-46a9-b60b-a2500865c687", "comment": "Malware payload (RemcosRAT)", "value": "376b4efbe9a51f7faefe7a6cfc87f6d48ad2154ea71fe22c4a3ce49534e4033fec3cfef4c1457242cc149d948014f4fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777384102, "uuid": "e6c1dd41-a49e-4f06-b502-b7b534cc16cc", "value": "T184448DDF26AA2F21B665D535E399CC3E9F1EF212372F2DD01874279A6E070A04049B7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777384102, "uuid": "0509ac24-6627-4b75-815b-0248b88f58d0", "value": "384:Errrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrra:V329nb4k8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777384102, "uuid": "f4b062a4-908e-41ae-9326-8bd7cad62b3b", "value": 262720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777384102, "uuid": "9c50d25b-88c6-4e4c-93c3-6131d35363bb", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777384102, "uuid": "eff2db8e-de41-4d20-b742-1de7ea145d0a", "value": "givenmebestfeelingsformybest.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d876cb4e-42dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777365601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365601, "uuid": "a6d6eff1-f1d0-4c8c-b8c7-c1e607e65523", "comment": "Malware payload", "value": "474a4cadbcddb053adc1f0d9f69bc0fb", "object_relation": "md5", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365601, "uuid": "c1f79dae-08a8-4027-aea9-9b08f2ceb90e", "comment": "Malware payload", "value": "100658233e9f15e1c25721be61ba784ce1d568502d85874d1cf39d2b519755e5", "object_relation": "sha256", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365601, "uuid": "01cf0351-2224-4ad6-8583-7240973dbe86", "comment": "Malware payload", "value": "9d88025ac826b79e1b494a09abc007a02f3cbf53", "object_relation": "sha1", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365601, "uuid": "d9d56d2c-3ea9-4849-8ff1-b17c9add8ecf", "comment": "Malware payload", "value": "5c031e22e62cc379112ba5dd0a28e51828ede1ba4addddba8c4c898281b4ce75457dc53166e830dcb0d457475f98f0e3", "object_relation": "sha3-384", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365601, "uuid": "2656c622-d63a-408e-b479-9d60fe66ce34", "value": "T1951833F3E6D4F166D2E15AF09A8B63138A762C850EF4205452A6BF3CD6B527CCE70781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365601, "uuid": "4a8703b9-7839-4e1a-8238-b19319471300", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365601, "uuid": "659580f5-0d23-4661-94c2-5c107964e408", "value": "1572864:UCL3JtfoVhojpE1IuhlU8wuaNBsviQ9hDjNNJXqofX/A2YAYZwQW:UCL3Xgoim8lHwuc4RWofvNYZGQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365601, "uuid": "f06d8107-39ec-41f3-8089-b58470e0319b", "value": 87172376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365601, "uuid": "d2b162f1-349c-4b25-89f4-594a55d107a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365601, "uuid": "f29f6e92-a768-4678-8a66-0ef9f3092d67", "value": "100658233e9f15e1c25721be61ba784ce1d568502d85874d1cf39d2b519755e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c1aaff-4331-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777401327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401327, "uuid": "999a2b08-edaa-4dae-880a-a75a49692a74", "comment": "Malware payload", "value": "dde74eba74c078772dd36f8b2fc10d21", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401327, "uuid": "e3584a58-e357-42b0-8048-e5f2a0696bb9", "comment": "Malware payload", "value": "10a319480edbb86bacc9585d6d97bd2ea1ed6e152665060a16129644a9b2e311", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401327, "uuid": "e8560f34-7f4b-4359-85f9-2849e4d49f72", "comment": "Malware payload", "value": "22b3ca05e1e63c3f2b5ead9efb9755b143f99641", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401327, "uuid": "dd2edb7c-c141-4f46-afda-6b097203f8d5", "comment": "Malware payload", "value": "841f8e483f3c503ab62bb0289376b727a4fbe25d6ec7310fca6a31c0677abdb18f3fdddbefc926dd5ee738c646fcdbcb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401327, "uuid": "5e64cdf1-b333-4402-b2d9-b8996e14e641", "value": "T11B872217A2E61154D8BAD138CA6B9647FB723C06433066DF12A4B61A6F73BF01A7F314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401327, "uuid": "1c56a6f6-d377-4fc5-b348-7741c5b17d7f", "value": "786432:kfBBz66DIpCRkxjRlKjP1UrZ21G7KulNNm:kfBF66iGkxCtyZ2E7KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777401327, "uuid": "d556e7e7-542e-4587-bf30-ef75ce2e154e", "value": 37085184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777401327, "uuid": "4ed29973-ee54-45cd-a647-c4a4640e8070", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401327, "uuid": "42bc2a2a-9ae2-42b9-bc60-6770872796c8", "value": "LogMeInResolve_Unattended2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbc4618-4349-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777411864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411864, "uuid": "f6f231b3-cd1c-4e6d-aa88-b272e5935259", "comment": "Malware payload", "value": "108d734b3dba9c09080d96dd918980e6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411864, "uuid": "ff2cacd3-2ad4-4f02-9181-893cad9b554d", "comment": "Malware payload", "value": "10b818dd55d5328bab5cea8924fbb3357a1582dbd48f333f81f69862ac866d3e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411864, "uuid": "e4184632-8c03-41bc-b558-79f12bb6bd62", "comment": "Malware payload", "value": "3bd39fff6786a1f878ead20fa1b99be2d9d23a24", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411864, "uuid": "049ef71b-305b-485f-90ea-7068cbfce6c6", "comment": "Malware payload", "value": "0614a7ba217ef32295e7707d6516ce173bf1f590a1d0e902cb0fadafef347a3ca61c2ea51e74164db04c39ab1bf54526", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411864, "uuid": "ad426678-295d-4771-af2d-a8e56054231c", "value": "T1DC2110857AE6A73285328B084E46E394C51F123720A7250077EC8341FF7869FC669BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411864, "uuid": "3bd3a793-cc42-450f-a51b-21de1e142469", "value": "24:2XTody/GELm8hLNnLak88WFiOIRIbj23OA5WQxoUWTV/0kgC3:2jodKGYm8FNLVWSinNKWSWuC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777411864, "uuid": "42483cbe-ec58-4bf0-83d0-24d721773b1f", "value": 1374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777411864, "uuid": "3e14e457-7aaa-4869-90d2-5a43c8f2070b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411864, "uuid": "d1ca9443-a972-4493-af74-a347c9911749", "value": "i2zu5dq5dlh.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52fb3c6-434e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777414182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414182, "uuid": "3c9e75ee-de3f-4c92-97dd-ac3837595cc9", "comment": "Malware payload", "value": "011dcdb98911e6403dd9bccd8ccdcb6f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414182, "uuid": "5fc729d9-f5ef-43f9-bad5-5d74d90d98b4", "comment": "Malware payload", "value": "119e65a3d183698d071d5cfb38f991327f25bb489461dcc1e2cacc2ef402655c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414182, "uuid": "d821e84d-58b8-4533-9364-d12932654ab9", "comment": "Malware payload", "value": "4148facf7372d5c24987c74e5b4e496452d47eb1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414182, "uuid": "e77bf315-3174-4efd-9d9f-b44dbf6093ef", "comment": "Malware payload", "value": "93f63aad6c9ede05f5c0b3ca231f6041d79bfe43a4392ae65d938a4e1ab02566c3f3da8a9d10b7fee7bdce8afd35cc86", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414182, "uuid": "d01b5e21-01e1-45d1-bff1-e788a3e6d9c0", "value": "T1F2D0973BA2C612DA66FC0CE6408C6D9EA5B2681440800A4C337402A86128008382EDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414182, "uuid": "01e19828-4536-42b2-9831-b4ca26ffef02", "value": "6:iay2AOzckHHy7nhrdfJMJ1yG2M39+fLNmeH03n:iQFkZ6+MN+41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777414182, "uuid": "d139a783-5d9a-4213-9b08-384d887d05a2", "value": 241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777414182, "uuid": "c00e8cae-aacb-4f21-a3ec-7f598b510efd", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414182, "uuid": "ed70fb02-fe6e-4093-be12-18aa86ba1f27", "value": "66.94.124.248_1777414165197759_hello.world_ADd_allow_url_include_3d1_ADd_auto_prepend_file_3dphp_input.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e64932-434f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777414400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414400, "uuid": "67d5e59e-b21e-4752-8e8c-8f541e25acc3", "comment": "Malware payload (Mirai)", "value": "393082b0256380c59c76a543982eb51e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414400, "uuid": "f8b34155-7d55-423c-8687-4012aece70d4", "comment": "Malware payload (Mirai)", "value": "1255c0ed3ac53886db6c7a0caf31b551df41acc2ffdfdab2faa65d418e8a2249", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414400, "uuid": "2a6c1414-9e9f-4dfc-b147-dfc5dff87491", "comment": "Malware payload (Mirai)", "value": "b495de576d06ef5bca28b7e173fda03e650c983a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414400, "uuid": "9d6a5f95-cc1f-46e6-9328-3cb425ae815d", "comment": "Malware payload (Mirai)", "value": "b63527789fe441df653786ff0f732ecc593517ffe470296bcfaf3931e88c0e78584e7f54ebf1cd5ea0b228e7a6a338e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414400, "uuid": "5dbe465e-2d3d-40d2-93d3-7bd0485f4761", "value": "T1CDD2E1C526DF172BE9849335859FECD264F4D512865AFFCF73034A428D8A1ACA0BC8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414400, "uuid": "aa4ea343-9931-47b1-947e-89106ff0a7b8", "value": "768:3E9Vr0FvjhfMkUDi0xt246KRVNuMnPDmXBEOoejExQu:3JT3VWtnbuMPlOouu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777414400, "uuid": "a9621cc7-6a38-4299-8456-b4db4db514ce", "value": 29412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777414400, "uuid": "daf655ae-7e6f-4986-a96f-f8e5b5f8e36f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414400, "uuid": "84e6f0b4-14bb-4526-be1a-766e59f14e76", "value": "asuna.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2044c590-42c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777356272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356272, "uuid": "034fa92e-51b6-4a0b-9677-a8fe4ecf704f", "comment": "Malware payload", "value": "59b2d53afe2538040b2c7314d329faeb", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356272, "uuid": "5ce563f4-7e3f-4494-b4a4-4361cc3c81d7", "comment": "Malware payload", "value": "14585514750fb57f79dd30bd577428f16addc4cc5f3c7a85abb0ccdf0cdcbf14", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356272, "uuid": "05a07e47-331b-4b8e-b7d7-840580af24d3", "comment": "Malware payload", "value": "04e06e60690b8bb09df26da6baafde438df1895f", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356272, "uuid": "b0f778bd-e94c-452f-a472-b2bc39f99e8c", "comment": "Malware payload", "value": "5c019f609ea489de2f9360467984e2a50d750d546e40a96bc937c5c07d0d0caa4cd11ce0c5c91172dfa6a42283731427", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777356272, "uuid": "632d6d39-80d2-4633-8b34-3a6b1da0918b", "value": "T1E916F7212549C43AF9620DB0D52C8AFA53D86F258B6114C7F29C3D6A3FB7DC21636E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777356272, "uuid": "41c73fd1-ad0d-4f08-9979-6bf48f69cc13", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777356272, "uuid": "5d87eee2-bfa4-4cb3-81fa-0a33edcbef8c", "value": "49152:/WbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l5qYgbPAELcpB2MpFa:/r99u4kc8Hao8eRjYBU4UAir2Y5Ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777356272, "uuid": "70dc7813-d150-45b8-8d4e-d314643dc6fc", "value": 4209664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777356272, "uuid": "3d04a9dc-3c94-478c-bc55-3cf6b8fa002a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777356272, "uuid": "adb76d1b-536b-46b0-a6b1-15d876de4b24", "value": "He is coming.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc49fbba-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355272, "uuid": "92b5e180-946a-4cb0-a7ad-fb293f47c133", "comment": "Malware payload", "value": "6391d4e96ad347cdf2ba68810ad1277b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355272, "uuid": "8575a45e-1fe1-4f07-a293-2dca950da618", "comment": "Malware payload", "value": "151d8629990a4d5cf2f30a2f17580eb76b74e826d0e131b1419eb843618cfba6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355272, "uuid": "c84608e2-5ae4-458e-a4e0-1c1bd4a970a7", "comment": "Malware payload", "value": "4f815975b39e342bb53b34612be46fe445e32471", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355272, "uuid": "b94c0ece-26d3-4b7b-8983-7f7a76160379", "comment": "Malware payload", "value": "b1508dfabebec1f3bf0ab7bce119e02039f62ce8cf5d7a19224d40631a5b09e95629b9e6f6e20caa851d0cec473aad4f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355272, "uuid": "ea31c354-aa7c-4d1b-9f07-30561c04ea8a", "value": "T12D37232D4D7BDD1907DC798868B99F0F20C25E00E561B7533D7F2AE8A4BAE28947F148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355272, "uuid": "39b88cdc-09d1-4acc-8fa4-fae7dfec0590", "value": "49152:os0mdgrs0mdgKs0mdgks0mdgTs0mdgfs0mdghs0mdgGs0mdgas0mdgWs0mdggs0U:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355272, "uuid": "0f5ae5d3-5ce5-43f9-b2f8-af007edda384", "value": 22903946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355272, "uuid": "4c31dd71-06a1-4bd6-b242-8bbe577cc784", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355272, "uuid": "84e6b970-6b78-47a1-90ee-439adfb1ae65", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265dc844-4330-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777400950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400950, "uuid": "89d26e19-9e40-439c-be0f-afce005f35f5", "comment": "Malware payload", "value": "92c80968506cbf3285ecb4344eacebfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400950, "uuid": "769b7440-f397-4be5-ba52-dff57e7f2c45", "comment": "Malware payload", "value": "1551b0b3d4a7757d5eb6f5c799c750f944035bd05fb03b4b180f33c68160d45b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400950, "uuid": "11ea996d-689b-41eb-855c-e28c4352c8c4", "comment": "Malware payload", "value": "e630941851992de6a3e48a3c048b5116ed6ce13d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400950, "uuid": "21209727-7169-45eb-a5be-60cf5cfe69d0", "comment": "Malware payload", "value": "fa142d055156b852bde1a1cd18a2b1df567f01b5ef62f4e4733458a7390aa41b4ff304989bc3b9e3c306a4babc3af64e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400950, "uuid": "15bd8a14-9278-42e9-bec7-ded7b5dbd5d2", "value": "T130564907EC9514E9C0AE953089679253BB71BC881B3123D72B50F6387FB6BE0ADB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400950, "uuid": "51facb23-c01c-4328-b304-e3be5105b576", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400950, "uuid": "60cde906-cd7c-4cdf-b166-5b21116c3d37", "value": "49152:+p+PUSy2fGnwPvCt8r4ERMDZO25kOKt2NDNJGhayrYXscsiADmyMGnGKQK1K6h7x:+pldojCrTJpgiADJDhoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400950, "uuid": "e5a6a415-c420-445e-b560-653a41556633", "value": 6252544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400950, "uuid": "63f9be11-3287-44d7-b827-9537f0e70cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400950, "uuid": "4352aed8-b5ac-4b37-868f-30944d17d0e8", "value": "SecuriteInfo.com.Win64.Malware-gen.18529795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8a3ff9-42ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777371998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371998, "uuid": "55a74de1-9a7b-4a2b-9e44-1e13ba44acc2", "comment": "Malware payload", "value": "ee3ad9c019e6a0645855293f21b72990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371998, "uuid": "940f77d7-896c-41fd-9f6f-f1465339e247", "comment": "Malware payload", "value": "163cf00168d6fd28366db6c88a1216f95b10b8bb71359d161b542a67c40bffc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371998, "uuid": "3c39cd9a-ef9a-4431-a6fd-1b80eea328ce", "comment": "Malware payload", "value": "d946e596fd531ba3247ad7237e039ffabd596a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371998, "uuid": "461713d9-a8f3-489b-9e68-e69bb6c8f9b9", "comment": "Malware payload", "value": "f11c4188a9d758c028a8c7eabb14ca5b1d22cf1fd266352732a47256d7396955231e416f0dda83c83c800b6b0a90efec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371998, "uuid": "8bb97fb4-cc16-4633-bb35-f84ab6bdbefb", "value": "T1F754E701E20951B7EDD78F3C45730ED1DF3639027F51A88E134C2D6B5E6BEA7899AA80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371998, "uuid": "4c243b60-9d32-47bf-81be-6b2566a9455e", "value": "91757dd152f1f40c06d2b568f2fd94bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371998, "uuid": "3837186f-9f57-4664-8118-22224a150f63", "value": "3072:9CYgNdy9H1FGkuU0DTPgjaiiZ6E3MJ4rywmmjNbplbo26XPbrj2v2XMikwt:uI51FGJdPgja1s8lpl77vLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777371998, "uuid": "742472a9-a1ba-4ee5-b857-94d7421c8917", "value": 290200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777371998, "uuid": "3d13be75-92c0-444f-bab9-01de11a148a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371998, "uuid": "232209bb-af75-4145-a9a7-149319f36193", "value": "_1_1_6_163cf00168d6fd28366db6c88a1216f95b10b8bb71359d161b542a67c40bffc0.file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19c78ac-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355201, "uuid": "4227091b-4d44-455f-88bd-599b4df91780", "comment": "Malware payload", "value": "7a4707b56ae1f55d76636280caf68b9b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355201, "uuid": "3f65dfa0-7990-41e1-8c4d-1620fb771c0e", "comment": "Malware payload", "value": "17958f9d84cccfd38d2d93107d7bce238336d6fdfe50e4a01ad25eba5201cdac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355201, "uuid": "99be6377-49a6-423e-a4e2-1f98c33226ab", "comment": "Malware payload", "value": "7516bbe051e8d702e9beb0edc46e8378c2f00e5a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355201, "uuid": "03bec9bb-8b71-4b15-8168-661151db5bc6", "comment": "Malware payload", "value": "932fc3d5b0ffc965aaf0c038996304f0ba1fcf3040f2c71072c8817a0356e84fe7c67bb55df6b0f45eb7c3d8bde2b5d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355201, "uuid": "71917adf-3200-45dd-99d5-d8b1d9c3cc44", "value": "T12337220BDC69975FCA382264C46E288F71F5A71800513A87D9B634BAED8CB243D5F19F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355201, "uuid": "6da13426-752f-4973-8a9a-01ac66b65c9f", "value": "49152:5RDRtR9R5RaRoRCRrRbRcRhRmfWRYRNR7RnRsf3RDR+RCRcRbR1R1RsRdRBRRRuK:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355201, "uuid": "c50e7c8f-8a3d-42da-928f-4e260d433c3d", "value": 22903958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355201, "uuid": "55b16b2a-a8fc-47e0-b46e-ba7d1929f14d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355201, "uuid": "ca4c0f39-f7ee-4dc7-9f77-d9f4f6a6501d", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d9a0b5-42f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777377065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377065, "uuid": "64f5f1e3-8e09-4d85-88ff-0b9e499b16d5", "comment": "Malware payload (Mirai)", "value": "30b3e494cf10cca82707c856ccbe9625", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377065, "uuid": "d2febff7-9913-4f7c-ba8c-e33988696c27", "comment": "Malware payload (Mirai)", "value": "181f5fa8bceab0a94ed17e573c9624b2c480a149c9bd865cb0a16f36e4cbb71a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377065, "uuid": "38e71c1e-6f4f-4595-b30c-02e5d743b343", "comment": "Malware payload (Mirai)", "value": "e3998c16d21a01cbe7834f813e4daf546765be64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377065, "uuid": "154a0719-46a3-4332-b83e-d0eab5a9d456", "comment": "Malware payload (Mirai)", "value": "6b406c056a5474cc24fe4e787d26fd90aaa05969c9ef4f873250a68a233bd53aa615990379e61f959e0dcaf49ba62aa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377065, "uuid": "c7535421-bd99-4d8c-b97e-0f3073de9588", "value": "T178D2D0A8C4745436CA2AE274A77F2AC9FB7FC8C9C77CFB2A27C28442D5B34605959841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377065, "uuid": "ae9cf506-d196-428f-bb13-7987e7f412d8", "value": "768:NSdI/6tNMMg5f5ECxxSUb+3pgwbA8bgO/5fT:2laMqBRuSw8nOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377065, "uuid": "f60c46cc-81e2-4e38-b6de-58ae7233bbba", "value": 31092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377065, "uuid": "58a17152-ec9e-4e28-986e-a3792ab90ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377065, "uuid": "6e0daa45-fca5-4105-9eec-1939ef84591e", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115001e1-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389318, "uuid": "0a359e6c-35e1-48cf-b5fd-9fa8a4e21d10", "comment": "Malware payload (AsyncRAT)", "value": "1709efd44d0bbcb436b8fc5dcb946a02", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389318, "uuid": "cdbf1374-ac37-4284-aa3c-b7d14bcf6b5a", "comment": "Malware payload (AsyncRAT)", "value": "1874515028259be1483fa4c47f10ed3e740e4578a96223a6c4339001de3ba7b6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389318, "uuid": "56354e93-66de-4dd8-b7cf-aad7f6e3de70", "comment": "Malware payload (AsyncRAT)", "value": "98cd5c9c2b06f334bb4bb9de8242bf51f302a879", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389318, "uuid": "de51ff08-c4ef-41e5-8694-775597749952", "comment": "Malware payload (AsyncRAT)", "value": "e02d15e0546f0619960310822453a47a37bf5d3816f67cef65b9388d164c6819db9614484f045cd77ef7d480a1a9d581", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389318, "uuid": "789aad29-119a-471f-b0d5-3bac18070d3b", "value": "T1B91339007BFC1625F2FE4FBCA87951444236F967A932C74E1CC4518E1AE27C1AA91FE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389318, "uuid": "93faf70f-f6f1-4a8d-8905-7cc1c72f1d5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389318, "uuid": "769e0006-101a-4177-8672-3cf20aefd179", "value": "768:rq7x+CXuMnxIROkY4n9Ho+ZMxSvSRCf/uRbheuoVNtlGLvRD+:KuM149HJZMoqQHuRbguINyLvRD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389318, "uuid": "5094a91f-808e-491c-9ad4-787fac12c234", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389318, "uuid": "cc18f299-76ea-4e67-8b0c-19bd23e9ac90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389318, "uuid": "ed435827-ae11-437a-941e-d3bc8f61027e", "value": "1874515028259be1483fa4c47f10ed3e740e4578a96223a6c4339001de3ba7b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51597b8-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777378077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378077, "uuid": "2629d188-cb8d-406e-8e0a-872f89b171dd", "comment": "Malware payload (PhantomStealer)", "value": "1da7cca877a0654be3b93d6579f037ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378077, "uuid": "f7c371ae-04a5-4e6a-be03-6e293a6c460d", "comment": "Malware payload (PhantomStealer)", "value": "187e61266b08b2ffdd9886f729db43b70430806d18d2260fd07fd7bcfc266500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378077, "uuid": "48d4100e-f5e8-4cdd-a942-671da1a83fff", "comment": "Malware payload (PhantomStealer)", "value": "36dd721f88b3b9486d5b17500745a7f9cdcf334d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378077, "uuid": "1eb66e14-8871-4fda-8bb1-09a591961b1a", "comment": "Malware payload (PhantomStealer)", "value": "1eef47736ef40f1ce961995f5d46a9bc6a8a1484d4e5f685c3a380ec2c71a2679e107f644b77b2eaf2cf67e45b49aeba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777378077, "uuid": "206d5713-2c64-4ed5-a1ff-2618fd368f23", "value": "T15CC68D88970C867D3B96DF5D2675D9D0A98E219299CECB10301FD270BA5EC43E78B4CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777378077, "uuid": "427057e3-f766-4ed8-9136-3b64f43dac20", "value": "196608:2vFK6WFg+pwkEh3DuQ19BEd1ME4gVICsHc8p48gJldtqX1PA/vnv3ki0lIEfjF8w:oWF8k6DuQC1MngVI88uRqX1gvvU0Efjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777378077, "uuid": "2b6b7e3e-e82c-460b-87ed-808e316ba2fe", "value": 11573784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777378077, "uuid": "9bf1af3d-5561-4d70-a1c4-c6d11664c58e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777378077, "uuid": "7a4fe0ea-b964-4d46-8183-1f1efa312023", "value": "PO-2026-0542.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bf0ac2-4317-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777390460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777390460, "uuid": "cf589ad2-ff71-4968-829e-5cd89a9a7162", "comment": "Malware payload", "value": "a305d94c3d91fed46146992d8de566d1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777390460, "uuid": "75e28b70-85cc-422e-8364-c3eab724edf9", "comment": "Malware payload", "value": "18e5fb8b1771a0be2104029a8f9626811472bbe5b0a80821b10ca1d59655d4e1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777390460, "uuid": "a25181ae-8d2a-4d2b-a6d9-4d0ee72d1ac3", "comment": "Malware payload", "value": "916ee6b475f51fd446705282636cda287dfbb670", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777390460, "uuid": "da31568a-fe93-447c-9ede-6281e334bd5c", "comment": "Malware payload", "value": "56a3ceadd8ad595f1c1715a6c3d5ba8934444f53d0f0c782d933707c2b0c42fa58dd88c82e3cb91e2c5230c9d8951d8c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777390460, "uuid": "6653ff9a-1e10-4676-9ca9-26174121a0c3", "value": "T14D137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C4969CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777390460, "uuid": "c6da96ce-1196-409d-8024-1c5c774624cd", "value": "768:bG+y9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bG+Xcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777390460, "uuid": "0d70c815-1d87-4d33-9f89-9e61faf872ca", "value": 45433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777390460, "uuid": "0b55b22c-1e9a-467e-b0ca-7e09dc314268", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777390460, "uuid": "c4a6de1f-a303-4e34-9abc-92e8b56544fd", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98baf8ec-434e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777414027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414027, "uuid": "88383e24-4247-4a30-9688-c345f527c705", "comment": "Malware payload", "value": "6055da6ef6b7718403307fa2a2b80918", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414027, "uuid": "be8ad333-65ce-4039-a2c5-58efead1d9cd", "comment": "Malware payload", "value": "1929ebcedc1418514ee1a81dc310cd7a574b215ae44acb6e22f7e9b173f93d8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414027, "uuid": "56b716a7-2cc3-4c20-92a5-3e1ef573c9c9", "comment": "Malware payload", "value": "1392792b805d5f5cbc3a66ad5a108d500fa22441", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414027, "uuid": "0143a89e-4d06-4510-b924-213ce424b98f", "comment": "Malware payload", "value": "346e1cd1255db721d293d7bef56eb9bfa92e1f6d02dfb4fb94593749636d4e986b551659e46634a764d514d499e94f61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414027, "uuid": "0026e316-fe80-45d5-a651-c39aa4ed3dec", "value": "T1B643F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414027, "uuid": "d1af0eb8-9de1-4466-aa21-8cefaa60a63b", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfz7:5AG8nY5BZG2xxmLQLS/S7hHnQfz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777414027, "uuid": "4ddbf748-3a39-4e4c-88ce-0fd3f2e8429e", "value": 59645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777414027, "uuid": "86edaf02-e5e0-48ec-a16e-4075a3eb6789", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414027, "uuid": "5bcd7981-94fe-4266-af77-f7fcdc649e4b", "value": "systemd-cgroupwatch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fe77db-42d0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777359847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359847, "uuid": "819ccbd2-5101-49c6-9f65-c37ef5d4cba4", "comment": "Malware payload (AgentTesla)", "value": "c5f5b4d5ed2d2562f3a0a773262a4a37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359847, "uuid": "9af7a7b7-4abb-4eea-a897-348d63251280", "comment": "Malware payload (AgentTesla)", "value": "1aa4452c755764663adc252eb19674b7d8c2e316102b30f3415f0c22866c7eb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359847, "uuid": "430a5d37-825c-49c1-936a-188395f34c40", "comment": "Malware payload (AgentTesla)", "value": "77365119defeca76f1b71ca2e07f147de2f0d9b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359847, "uuid": "ff3f258e-0a35-4a97-a165-36d601c21cbb", "comment": "Malware payload (AgentTesla)", "value": "49fdcfc93f1a4113222fb52dd9bc379b9f0ea8001df1ede6efd1df997c081326da6fd5686d0a5a589b804952c8bfb2f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359847, "uuid": "4355ca8f-50fb-4ba2-8e99-fa95b4be059f", "value": "T17CB5FD1D7A63CA5EA4292F2EFC2878F8BD49510E5F83EAEC795C44B649D0489E7C4D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359847, "uuid": "eeecc888-fe86-435f-a7bd-eec7b96b4f14", "value": "768:422222222222222222222222222222222222222222222222222222222222222Z:qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359847, "uuid": "9effb65f-e3a6-496f-9595-9f31befda6fe", "value": 2370528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359847, "uuid": "c1b015ab-ae20-431c-9f29-c08fdee114f6", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359847, "uuid": "d3175d1d-bf27-4f91-abcc-baf63c51d06c", "value": "PI FG00947001 TechnosoundREF 26008.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f60025-4342-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777408890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408890, "uuid": "d2f0379b-80d4-4f8a-8d8d-66f22f47fa65", "comment": "Malware payload (a310Logger)", "value": "8f6d1d78e3753f2bd5eed0ea21bd4e67", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408890, "uuid": "a50dce50-cea4-46b5-ba9d-318cad0b2e36", "comment": "Malware payload (a310Logger)", "value": "1b4299592093365ce15615444fd5e7cc87a1a150134acb94f05bab16760be524", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408890, "uuid": "0cf2281a-8652-42e9-a8a7-8097ce011466", "comment": "Malware payload (a310Logger)", "value": "c31ce11de63498e6a0af580b761b3dceaf7933d7", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408890, "uuid": "5ccc450b-2ebd-4ea7-9224-3374d208cba4", "comment": "Malware payload (a310Logger)", "value": "27eeb4f0e771e8069d129f9a9b3afa1f62862b2867d7df0d078f17caf79c0a9887377fbe4dd1060819206a9f959aaa86", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408890, "uuid": "84a4e2b6-2b2e-400a-90b4-effea174a67d", "value": "T1A395AFB24985C4C3E4F366D5B27737862F72A4A30B493D66EB77744524FCACC22629B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408890, "uuid": "96c4c4c8-777c-468a-a61c-a1fafb450019", "value": "49152:02YsRlVQMOEptcWmA5QYNR1RalI+t0Dq/2x:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777408890, "uuid": "3b9ae402-edec-41c9-a578-5fe8316e1f1e", "value": 1882651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777408890, "uuid": "f6f480ee-bd3b-4bf7-ae92-c828a653ec11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408890, "uuid": "38389dfe-aab6-4af0-bb76-2b067cfb8038", "value": "ps_npzM5gKAK0AQ_1774343006078.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22742df3-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364866, "uuid": "5729cfc2-c295-46f6-b8aa-e56c9e7f2a35", "comment": "Malware payload (Mirai)", "value": "afa2f7ce3574387975f9d29a72f6271f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364866, "uuid": "793d84d2-0a77-49f9-b469-99465c0f1b0e", "comment": "Malware payload (Mirai)", "value": "1c2031fda743220e3a25a683e7452604635c81f29035a3c32f68a34c346936dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364866, "uuid": "0db52430-1585-49f3-93a8-354772fb5a19", "comment": "Malware payload (Mirai)", "value": "4156cb08c5075033b45d4bbe8bb6c1c729fa7bf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364866, "uuid": "ac29d46e-ab6b-4027-b7ef-19a8c9761c62", "comment": "Malware payload (Mirai)", "value": "c82bab5456f2d8be8a61d8fabf51447b25e791ec620fe0c862a8347b01375766e99b4b7de3707f91474ed6a069f540db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364866, "uuid": "fa26decd-158b-42d8-9917-4c26b5c237c5", "value": "T125C44955F880DF62C6C52976F65D829C33174B79C3EB720A89254B343BEB86B0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364866, "uuid": "ec9e6701-2c77-498d-b5b1-a76c5bd8eccb", "value": "12288:kDMiBgjl1sF91zWtr+JkJvQrfJg9X/oLolzgpMhtMp:f1sF90ttvUJkXwLo/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364866, "uuid": "2f32039d-60a1-4013-b2b4-bbee83cf2488", "value": 578856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364866, "uuid": "4a295541-45cf-4338-962f-0e5606c04af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364866, "uuid": "64b7cac4-6f4d-4059-8c9c-6f9ca6f5a729", "value": "agent_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e723303-432f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777400507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400507, "uuid": "9f8dd0e5-17e5-49ab-a2fe-9c186d65e446", "comment": "Malware payload", "value": "5cf11ac3e100825f22e6888a69d501fe", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400507, "uuid": "7c126eb4-e29f-43f4-b32e-c33bffe0bfef", "comment": "Malware payload", "value": "1dd351193973528697e783cd8855eb96b606caabb82789162420d95da00f6199", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400507, "uuid": "89e977ae-ea85-4377-9cc3-e007ba63e391", "comment": "Malware payload", "value": "41e034c568deb6c68edb13db9dde251a81dbab39", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400507, "uuid": "d3a0f94e-3558-48fe-adba-2e3ab65b9a23", "comment": "Malware payload", "value": "f3eb6481f25fa51665ec60780a10f4eba49f26eb4cc0ee412fcafba15a638390b23707f0c6a63dd57d5a9ed38f6bb7ad", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400507, "uuid": "3935722e-26aa-40f8-aa9e-ea4c9ecdc413", "value": "T16831654FAD4EF63845B2C1564DBB6E9CEFA10A1BA5D480EC3C59C8112308ABD8D951D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400507, "uuid": "405f2d4e-1250-49d9-99d0-96f932a2b217", "value": "48:f4XQ6MBwCPi7tePymJghnVcAGSREY85QV0/A8Awt5M:AgZecB46/A8zt5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400507, "uuid": "441dc727-d286-407c-9a14-c4c8595eb4fb", "value": 1749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400507, "uuid": "3824374b-63a3-4773-a498-798bb25cf2ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400507, "uuid": "ae580fc8-5982-41bf-983c-a4d92831adfe", "value": "tfkviewpoint_IV.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d933a6c3-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355294, "uuid": "c1623221-c9fd-4736-bf04-d4a44ce561cf", "comment": "Malware payload", "value": "72cb6c1b746554c7336fad944fb90151", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355294, "uuid": "48bbbf4c-950f-4e50-914f-0431c74b884f", "comment": "Malware payload", "value": "1dfd35edd14f10aa52b3b4d785ac0d29ebb96292087189a0f479e5be873f03c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355294, "uuid": "dfc02f6e-a003-4776-a12e-badb84e229ad", "comment": "Malware payload", "value": "46eb752b6638007e513de9bff990e4d3b53c655f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355294, "uuid": "6489ceb7-2830-4f36-af45-5e2ba337739d", "comment": "Malware payload", "value": "cb925899e27ed63eeef5dfa993957d0138d7e42d85d6d14db18614e6efec02c44e0523742971e1b8904f13ecda2b3b91", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355294, "uuid": "2d959fd0-458e-4423-9fef-2dd0b9a0b839", "value": "T1723723114EBCE91FDABCA84010BD2C577E950862D78D5FF766162DAFCA4EE1218C318B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355294, "uuid": "d32da734-2074-4739-9b13-69cf20eef187", "value": "49152:K3Ur3UF3UM3Uf3UZ3U33Ua3Ue3UH3U73Ut3UZ3UQ3U/:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355294, "uuid": "57e4c6b1-0d7e-4bb7-8f29-d9d2a45fd0d7", "value": 23684327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355294, "uuid": "2822fe6a-ee66-4b68-af6d-8a811f20c9e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355294, "uuid": "bce4f4e7-8ef8-4fa7-aeb7-775bb5e11f5c", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c30bde-42b6-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777348542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777348542, "uuid": "dfe44da1-7494-448a-8c97-297a07faa9ce", "comment": "Malware payload (RustyStealer)", "value": "5b517454f35651512c913cfd719a4007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777348542, "uuid": "2c61a968-8da5-4d54-b23a-fe04f1047d43", "comment": "Malware payload (RustyStealer)", "value": "1e0229d2616423c9e0d9f7a461e93c8a351de065b5ce1111c821dee9e75794d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777348542, "uuid": "8f69cc71-52ae-48d9-8900-7bc691edb0d9", "comment": "Malware payload (RustyStealer)", "value": "42d15c9c72e376b07b4c19ad12d5863df82d927e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777348542, "uuid": "fded294a-4c63-4647-a53a-c7842a6c0e8b", "comment": "Malware payload (RustyStealer)", "value": "17e3af67e752f70f4d045ff52ebb14cd1ab6bae6b4245f6b3c371c76e46ebf69b38b30e3a6a7ed7d2d89b87418e401aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777348542, "uuid": "33dcb820-2f87-42b9-809c-4e0f237170d1", "value": "T1E436232124BA65FCD05AC834420285777EB3B5C70B32B9EF02D592752E9ABE82F3D745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777348542, "uuid": "0c05d97c-83fb-4915-9a77-84c7f130e0e4", "value": "fd38f0b210d7cab6b1e8d350b553b279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777348542, "uuid": "a74e882e-f559-4c02-8ee8-46b08789c6ce", "value": "98304:/EdIpfs/l+Vc6ArtLEK8nQI7WGro8HtdFB1u3Vc6ArtLEK8nQI7WGro8HtdF:leQcrt09dcikFcrt09dci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777348542, "uuid": "9c6511c9-d7c7-4792-9571-e03e5bb111f5", "value": 5002752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777348542, "uuid": "f8e09fc8-f22b-4f84-a840-e7ef0932b3ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777348542, "uuid": "b406339c-fe86-43f3-85a9-dba18d43b72e", "value": "-\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u5305-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8508a7f-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355266, "uuid": "65e3a65d-6e77-4c11-b513-a0d997301087", "comment": "Malware payload", "value": "3a4663332e379aeb01a4ea1e8a80ba9e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355266, "uuid": "761a5739-28ce-46e6-80ae-c07462f8a55f", "comment": "Malware payload", "value": "1e3e3e3f4c9c0a9412baf29beb8ee3d1df5a3ad1550c98197073f80e545bf08a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355266, "uuid": "eb86f1e4-ae57-428b-9c2f-58525222ee31", "comment": "Malware payload", "value": "297f24a73e6a2fdeff2927ef41e10287efaa4af5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355266, "uuid": "e98cc76f-2da1-483a-8aa9-8b7c83fd21c2", "comment": "Malware payload", "value": "364b16769cda9f15dcb9d34731abfc6282a442f55ee46152c3cf05d4ad8fa57076765bfd5a76fe420e3562a97bc132f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355266, "uuid": "c3e44819-4714-4cb3-a4ff-6865903790d7", "value": "T19B3722558C2BFE7A857922ED58DD020884F5CB4020ECE38AB2DE2D1DFBBE910156F756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355266, "uuid": "7231d1ce-d6ed-4537-b23f-64e01b8d6d06", "value": "49152:C5XCr65XCrC5XCrz5XCr45XCre5XCrE5XCrz5XCrc5XCr95XCrl5XCrC5XCrSA7S:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355266, "uuid": "a572915c-9bbf-4b37-bf74-08c17c87726a", "value": 22643829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355266, "uuid": "81bd4acb-5f80-47f8-8ec8-85aa03f3ae71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355266, "uuid": "9cda0075-3448-4e87-9524-29fc2a84772d", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba133b49-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777397762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397762, "uuid": "1059b9f8-e18d-4708-9f23-b58525eaa564", "comment": "Malware payload (Mirai)", "value": "e7e0bad75b4fff485c043d6aa9d47fbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397762, "uuid": "5c179c6d-9e7d-45a8-a134-be5c53d5b8df", "comment": "Malware payload (Mirai)", "value": "1e8ac95afe95e2a360a140cee5ed07f73e951db044acc4e942978a579f781ae0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397762, "uuid": "ff238177-c2b1-45f8-abb0-29e91c6214d3", "comment": "Malware payload (Mirai)", "value": "1422923c3cba06d38441168bfa3702da1f8c95a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397762, "uuid": "c43aa8ee-9f50-4e46-9c8d-38771e88302d", "comment": "Malware payload (Mirai)", "value": "fa80d6ed3b568ca37213917f1288a09e87e2f70c42c3f8409c6db0aa97d77988152b4ebce47529f498228f641c5557a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397762, "uuid": "2cb61d38-050d-4809-a4a8-609db2f53de9", "value": "T13B561997B9D25943C4E43A3BA8BD81C533630EB98BC752565D04FE383ABE1D90E39358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397762, "uuid": "3e0dedb5-fca8-4c86-bf47-5c957297eb56", "value": "49152:wmnqBIjYx1Cx7TqMlvhlOcMEK3SFHPcmlAHOJaMaFk5EB:r50x1C1qYvhlOcMEYSUHeaM/EB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397762, "uuid": "34e1d056-5acb-4156-a52a-e4c97657b69e", "value": 5963938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397762, "uuid": "02bb9d97-edc7-4566-a66d-f1b7bd246f7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397762, "uuid": "33163187-3c6c-4304-aa13-67d037be037d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ceb5dff-4321-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777394707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394707, "uuid": "2652db6f-1bde-494d-9016-4f84beb7e677", "comment": "Malware payload (Mirai)", "value": "567a37e0db374c6a684e530295633c47", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394707, "uuid": "5f58da12-f615-4099-ab1a-13184fa32972", "comment": "Malware payload (Mirai)", "value": "1ea7b557005259758905440a6f7be96ef88f358703d84fef5b3f38b807777379", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394707, "uuid": "8794caa3-7b00-4b36-9495-5d721a75c28c", "comment": "Malware payload (Mirai)", "value": "1233af3eb5e1e494d164d0ee358caacc65acc2ca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394707, "uuid": "a854b802-5d94-4a9b-a7ac-333f6f941541", "comment": "Malware payload (Mirai)", "value": "7654437bae94c4690d04ce8ff8e7408b5378f24c81e1049509564bb883ff512b08829c03639018345b855544e38da958", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777394707, "uuid": "559529a7-4fa6-4acd-a4b1-b33cd891dd0a", "value": "T13931C3ABA36041F3C4A1ED63FB6100E4D18F91D751D2ABB8F66D4872485818CFDB1A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777394707, "uuid": "53418918-586f-4055-b727-3537a3346343", "value": "12:rLf2Gie7xQeogZR87xGZR5ksxMMBNx7uFNIh2xFNIhDODu6aNxADu6auALxV4VHP:nOJv5SBnONIiNIwKPMKPlrQHZFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777394707, "uuid": "fb70bacd-3d03-4c93-a491-e3b9a1520b5a", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777394707, "uuid": "21284f82-d8e3-4586-be00-829df0190788", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777394707, "uuid": "445753d3-ea99-4fff-8a61-c090b7f1d2ae", "value": "1ea7b557005259758905440a6f7be96ef88f358703d84fef5b3f38b807777379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de04903-4320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777394037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394037, "uuid": "d80d0bd6-e22e-474b-b249-5e914181e349", "comment": "Malware payload (AgentTesla)", "value": "765d7a8efae958deb063e5888e6281e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394037, "uuid": "e37b6adb-df01-4c50-b3e7-d1cafd3ffdfd", "comment": "Malware payload (AgentTesla)", "value": "1ed47310c92f94b4645e7119126cb35e49a1fc4c5c5cffbbc7ebe9720a692eb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394037, "uuid": "7d8b0d75-68d5-4481-b532-c96d9a77a8a3", "comment": "Malware payload (AgentTesla)", "value": "8100a1603d574b9429161b2eebbf6a4e57a85744", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394037, "uuid": "bb3c9837-e9d3-4938-b315-b3893ede5411", "comment": "Malware payload (AgentTesla)", "value": "53c20ad828cdaa17bf3fc8d781b42e5ab488dcab229dde71bdc9be3f7833dd5153b26fe1db35aadcf5f701991f7f602c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777394037, "uuid": "8937658b-58ad-4fc3-b628-f3888e83bead", "value": "T138927248CC56DA6CCA73677C9DEF0BF3A8BCA208D17EAD2576DBA3746000254D52C6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777394037, "uuid": "170cdd14-e62c-4e6a-84fe-44ca77bb3c74", "value": "384:39UCsVzIBHBZf2fUlPo1m4vD0k4gLzR5PYg/fyKpWwpfOUG:tzgzIBQMlQV15ggn3P4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777394037, "uuid": "efeb5bf7-20cf-48a3-849d-f9f86c817540", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777394037, "uuid": "1e4b6df2-c96c-49e3-b63e-57be247e2b7a", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777394037, "uuid": "996f22ec-2b0f-4deb-9c38-35c735324ca3", "value": "SCS0503-042826-0305.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae5c7d0-431f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777393656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777393656, "uuid": "cb0c4f0a-7716-4370-8858-f06aed8bdfdd", "comment": "Malware payload (AsyncRAT)", "value": "feb317c2579a13ea1d742782bada0314", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777393656, "uuid": "1db017a0-9046-4774-b862-6cdaa7242019", "comment": "Malware payload (AsyncRAT)", "value": "1fe3a0ff5d48f0e4f3c85d202e10768e766c6961e66c0fb6c31aa466adc38fcb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777393656, "uuid": "348a863b-a733-4366-85eb-ccd5085dc977", "comment": "Malware payload (AsyncRAT)", "value": "6adb31d28de6a7cf691908e39293e88f298cb00c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777393656, "uuid": "ae22a631-35a0-4566-a9d6-cf3eff73b6ec", "comment": "Malware payload (AsyncRAT)", "value": "22b7f5e36c882088313ba5371f8915dacd06a04559e482d3d55e0d9463a1fc627cf12213d5e5d2e68c01e9143435d314", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777393656, "uuid": "595f4eaa-2466-4221-ac4c-a09bfdf9a0c9", "value": "T1CE96BF86B3C8AFDAC445DD7A571AF63281A3A9334DBBD0C56DA7074A4DB6B110F38E40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777393656, "uuid": "cc4741f7-0ef7-403f-ab3f-abd3133a9ff6", "value": "5f2b120e5aca92b173bc6fa756afbaa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777393656, "uuid": "09edd546-7140-4a77-a141-27fef47ca356", "value": "196608:eYYOooGGZJtHSrdTNOEZJPO09Z4guNLdUvfuObcqA7SP6/+gVZsHcaOBc7iK2Nde:HloEZL6xEEZJPl9Z4DLdZ/3R+zHaBc73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777393656, "uuid": "c1dd5f64-bc3f-4351-985b-5e6c68d74207", "value": 9370112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777393656, "uuid": "30f5d369-39ff-4d9c-89c4-6c9f3cc8a6b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777393656, "uuid": "8f27cfde-3dae-430b-b73d-22a1e597caa7", "value": "Secur32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03aae08d-4336-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777403469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403469, "uuid": "cc532d9f-2dd6-4475-a67f-f48cd66da3fb", "comment": "Malware payload", "value": "1904a7168d08625d3321d0d0eef80e5a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403469, "uuid": "709d44db-71da-4c33-b91f-2833a6b1871b", "comment": "Malware payload", "value": "200de10e6e45eabb7a6a1f1f9ab5da40054c52eb2e84e4b9332a5d703016e930", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403469, "uuid": "2dff81bb-19a4-4505-b88d-5c7fbc66a562", "comment": "Malware payload", "value": "3f8c108521e9357ba55a35319bc450fc230121b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403469, "uuid": "557d025a-1a0a-46d9-a38c-5f0e3e41fcd2", "comment": "Malware payload", "value": "ed4531c829de1121d97e6a8033442ab1684d231bde37781f535c9544ea307d42fa6d6bc8f177348821a56ec7c3a2df4f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403469, "uuid": "158db169-919a-42f7-8070-49028ff25238", "value": "T1EF31EDCE60F5A142C5DECE0070E58DD86396959373DA2F3AED813E66C4C9D647029B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403469, "uuid": "b6812ec7-3925-45c2-a63c-0beec7c08872", "value": "48:sf97VS4q1N1lOL5EGaDtrd8Zxfo78k2qLp+F9U:au1Qv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403469, "uuid": "18a3999b-c62b-4985-81f9-6f07270f64a0", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403469, "uuid": "1eab2f11-f6a2-46d2-bce0-bf35d01b77b7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403469, "uuid": "e046c1b8-b44b-45e5-8f96-8a5ec88fc49d", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799bd1eb-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355134, "uuid": "9ae4397c-977e-4cd5-ab39-8ef69355ac67", "comment": "Malware payload", "value": "a29bc3cd4c9b9c6c6de721ba2065d48b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355134, "uuid": "113b48e4-3ece-416f-826a-c718f5a0a855", "comment": "Malware payload", "value": "20c7b5f5d9d7f06f799630681494b2cb72804a54af8f69e82b80b6cd8d4e3649", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355134, "uuid": "8acfec25-f662-40a6-beda-217f9c862c24", "comment": "Malware payload", "value": "03598291a7003dc6aee5aefabeb4e906f3274cd9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355134, "uuid": "164750b2-e80c-4708-a489-b02c65775285", "comment": "Malware payload", "value": "44d3766c88653ef8f1129e534e3bb8578815e7b3a71c873dc4288217f3621f808fb645f6eba820ae012c2105fa52dea2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355134, "uuid": "2c41b95e-9e54-4084-9fb8-ad30aea81c7c", "value": "T1DC37239C8A3D4F2FCDACA8BE83F83F0C56D081168DC6F2EB169E4E571A57C5247A1518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355134, "uuid": "679f6f6a-8278-410a-9511-7c0d781c2104", "value": "49152:8/X/L/C/b/x/T/W/t/o/0/T/pfSi61F/m/E/l/Z/XfSi61U/W/K/M/R/j/u/6/RU:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355134, "uuid": "c11087ea-6a03-4894-9d80-07a2f467478c", "value": 23684329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355134, "uuid": "0960e298-5c19-4c83-9373-e83801535c7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355134, "uuid": "1423c370-0dbf-48bd-a68e-9f4381f4241b", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f78dc9-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777355740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355740, "uuid": "1c5e25fa-03b0-4861-b84c-e702478b372c", "comment": "Malware payload (RemcosRAT)", "value": "efb349a2ec7b8c292297cdd19be3cb73", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355740, "uuid": "54d7406c-5399-45af-8709-ce6d4e93804e", "comment": "Malware payload (RemcosRAT)", "value": "2133264772fc804b84cf4017f13f31c9f0b0a320a188c832f476fafe8f6782a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355740, "uuid": "bf2e2021-a9d9-4142-8ae0-6f150f2df3cb", "comment": "Malware payload (RemcosRAT)", "value": "d26086eb26fe2a1aa25aa30ad5b0197a861cedc6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355740, "uuid": "8478ee5c-a8a9-4b79-b226-dcdc9baca8a7", "comment": "Malware payload (RemcosRAT)", "value": "63cdceefeb2fbf986cdc33f0b1259b1d9c76d1c061ed6ab91ca7c27c1ae6b49ef85ffd9af462f55f8f255e95980a8a15", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355740, "uuid": "63107e86-8994-4c65-81fd-b66559d8894b", "value": "T1AEF25B35A7858C90881BE7C1E6B749F2FA2D016B7C4B6851F2EB6A317FA50314B13937", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355740, "uuid": "f4a4301d-8957-4bb5-b4ba-c5accd10a40f", "value": "384:3SsFnBhHO1mxQlz+rAzWz2z15BtO1Pn1gVG5U+R/1D8jothEFJUP:KFJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355740, "uuid": "fa9a8568-dc83-4f5e-a21f-2c0ef8759e59", "value": 34441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355740, "uuid": "226e7572-2558-4fdc-8212-eb420308ddc1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355740, "uuid": "b86defea-173e-4a0c-8f6e-52ad78d9862e", "value": "PEDIDO Ingenieria Higienico-Sanitaria, SL N\ufffd 2100176 6720221 ABRIL 2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85593798-434f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777414424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414424, "uuid": "b1ff2afc-15db-4a3f-b2c2-818f2d6c1959", "comment": "Malware payload (Mirai)", "value": "a2401fc3326d56d5cf9d44ebf32d8cb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414424, "uuid": "41213155-8017-45ce-9111-1eb23fdad529", "comment": "Malware payload (Mirai)", "value": "214e6a9d3edd15cfda9ef9a613d6b9a6a4025d62407a55d6ffe672c3a3f1d2a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414424, "uuid": "ae4eef2c-baa7-49e8-bd17-df9c919f569a", "comment": "Malware payload (Mirai)", "value": "84304ba5083ae62f181c6b855e17e8f5e9d7cc69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414424, "uuid": "84e9df75-880e-425f-951a-907d05d69d52", "comment": "Malware payload (Mirai)", "value": "0e8ff181828ba4d3ed21f0c8daf033c880db099bd9578cbfa67962c4e25ce4c59fe61d4f1745e0bd2d354041cec7d00f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414424, "uuid": "2530fc71-fcc1-483f-84ee-6b2e1100387e", "value": "T1BD434BC9F643D0F5EC4A0AB52476BB238AB2D1FB2218DE47D778A531DD12613A425ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414424, "uuid": "2d8e9d97-04f5-4a3c-8586-a0f38cc8c085", "value": "1536:OWwApRflrGbpUjHZH9c/DX5KUbanuibjodSP0:OZURflSgfc/r5KOsLnoi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777414424, "uuid": "6c39b816-6962-40c3-87b4-a17e76cd0ca4", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777414424, "uuid": "a72901dc-9139-43da-a303-6da5d1532dab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414424, "uuid": "cc0e12fb-16c8-4eb4-a18f-b91e7fbda41e", "value": "asuna.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23a3c15-4340-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777408084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408084, "uuid": "639bbfc5-1ba1-4aac-b710-b9855e5c4b17", "comment": "Malware payload (Mirai)", "value": "d54ce466bd157f0073915f5a9b97427b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408084, "uuid": "91308f8a-39c0-47bc-aee8-acf28eb5ff64", "comment": "Malware payload (Mirai)", "value": "21ea43fed93fe779e954ed8157506bdbb60f53c05ee7af3a6dc1b56dea911468", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408084, "uuid": "202a9de2-5a86-48ee-9617-149409aa402d", "comment": "Malware payload (Mirai)", "value": "60615e32b7292203d9aa34e80bd9b81512daa8d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408084, "uuid": "afe8f331-9828-4c00-aa9e-ae5ab22b95fd", "comment": "Malware payload (Mirai)", "value": "b29e5de8ca1fe46e03e9683dd297458eda3cf843e71f545b70095bd52539efc78ecffab36e7db0276ae5f04867988a67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408084, "uuid": "a2904f28-7d56-4614-b3e5-845ef1bb24e7", "value": "T15D436CC5E68FD8F5EA5706782037E33767B2F139016DDA97C758A526EC12A40E22339C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408084, "uuid": "8c4c0212-ba6e-4c74-b5fa-d78e881028f3", "value": "1536:rZf98HjaKC3cQLT6nhDkbl2szb4iJ+6jZyF6e3/3+9:rZfeDc3cQ3DblRzb4m+2yFZG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777408084, "uuid": "33cd966b-53f5-46da-802d-564c3bb8330d", "value": 58548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777408084, "uuid": "3c9dc1ef-86ca-4029-be20-711d033e0999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408084, "uuid": "4ccfbefc-7e28-43b2-9e5f-9465b1b75765", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f268162-4336-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777403542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403542, "uuid": "d24c1ee4-7639-413b-853f-05ff7d9c8293", "comment": "Malware payload (ConnectWise)", "value": "6504fcb60cb6a559519299c05ec9d188", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403542, "uuid": "d75a52bd-bf17-4f3c-8a8b-aee616265648", "comment": "Malware payload (ConnectWise)", "value": "22418fead4bd7ad88a8488aad80f0aca9f758110a2ad35134cdcaadd251f8f38", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403542, "uuid": "8c1e3439-9e0f-4b87-9ef4-54cdd5699d81", "comment": "Malware payload (ConnectWise)", "value": "53a553219257841b5076382c34ae54976dfb7bc0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403542, "uuid": "b9afaf7e-d962-4cb1-8ea0-afde496c8b6c", "comment": "Malware payload (ConnectWise)", "value": "0b1667ee970e5d460dce67ba8660020409e7bad86e36879d41cc80b92e4931c18b3435433923538275ff6a8cd0c08525", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403542, "uuid": "19cabbb0-2f39-4516-b385-8cc20e8c5e92", "value": "T11646E101B3D695B6D5BF1638D87A52A56634BC048312CBBF5394BD3D6E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403542, "uuid": "a89b8cbb-418f-4c32-a855-54ad32703f24", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403542, "uuid": "141a356d-1665-40ae-9b7c-d11b09c3f434", "value": "98304:hzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlp:hhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403542, "uuid": "770ede4c-3848-4198-b8ac-1c9177ac5180", "value": 5720464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403542, "uuid": "8f476dbd-937a-41ee-9ce6-4fc3778b5364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403542, "uuid": "e7718568-cd0f-4e84-aca6-d389e77a8e0e", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1b361d-42db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364538, "uuid": "7a2881a2-7a13-4423-8b6c-dd6020738097", "comment": "Malware payload (Mirai)", "value": "04530ec89a004b86363e6b7aa396006b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364538, "uuid": "d801800c-34db-4307-9dcb-4165f6250a95", "comment": "Malware payload (Mirai)", "value": "22753fee4f319addacd02755978a47336743a2a50e09fa651d2f5a19ca721816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364538, "uuid": "dbfddc06-7bcf-4908-aee9-741fe7d5422b", "comment": "Malware payload (Mirai)", "value": "30552de559879ce295f0fce1b061c13430b00e6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364538, "uuid": "40b7a729-e240-445c-a12b-46c178695368", "comment": "Malware payload (Mirai)", "value": "9a18916a74098e8fdb5d4901e1ea628ad3455ca383f7e7fa0323e780ff45fc92e93495ef4a7fd54bc3221356e824e30a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364538, "uuid": "e3b87b76-c0f0-4971-8f48-0bf7d4cc9320", "value": "T1C19319227E761F27C4C2A4F652F30B30B5B2AB5B28B8864A7D715DC96F246C032477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364538, "uuid": "c5581d25-37e5-40c2-83ab-a9e72770b961", "value": "1536:5S8MSzlPyzhCJuWsZIJH11SYxJDZtzGgENWq5kDnsgthMtQj:5S0A2j/SQl53ENlk44j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364538, "uuid": "4153d03b-1385-468b-8eae-e3d454f5952e", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364538, "uuid": "da2ffaba-fff9-4568-8233-4425404a167c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364538, "uuid": "4eae22a6-6939-46b1-b025-97500245f1d8", "value": "SecuriteInfo.com.Linux.Mirai.9838.29688.6683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa79454-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355323, "uuid": "116b871f-ba1e-4738-a182-003c3b7c7885", "comment": "Malware payload", "value": "856d47f2b80c9dcc2f2387a911fbe347", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355323, "uuid": "f348a8f6-2ae8-43d8-9bcc-628b68c59e01", "comment": "Malware payload", "value": "22e08ab6c48e21f265bb2c28862dcb99f0fd75ee0d3752fc9a1a3cdb4b9fa0de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355323, "uuid": "2afd7b98-5dee-4be3-830d-8d0a7c1b6cc2", "comment": "Malware payload", "value": "60599de58a4d71193950f4ff2e069b72791cce42", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355323, "uuid": "4b2df649-4aac-4fa8-b9ee-aba5c3446f5f", "comment": "Malware payload", "value": "81fa2ad4d253776fc874ec0c12fc7ed6607e18b46acb70d87552c7a838753448962bc6173fc9a519775e41537dfdcfba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355323, "uuid": "0ec072ff-0c3d-4dc3-ba2a-53a86cfd7727", "value": "T1533723C75D0D4D2F86EC1CA0959B0BCB0FF85D5062BC2CF262991C8CBC6AD27A16E56D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355323, "uuid": "26899c79-ff43-4ef3-8466-bc32661b5e9b", "value": "49152:Kc8Fkjc8Fk3c8FkWc8Fk6c8Fkpc8Fkvc8FkFc8FkQc8Fkkc8FkXc8Fkec8Fk3rI/:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355323, "uuid": "648501d8-4a52-44d0-9abb-de16482b061c", "value": 22643819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355323, "uuid": "d97c74d0-c92d-4308-8b6c-047cdbd62674", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355323, "uuid": "34a16988-9a31-44b9-ab98-0d118b89af01", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25dcccf-4296-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1777335123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335123, "uuid": "982d35df-32b6-4915-ba6d-6e96c1cc93b2", "comment": "Malware payload (EternalRocks)", "value": "550bd4ac2eee13b2570c639553cf3de5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335123, "uuid": "30c4fe26-9380-4d9c-9efe-fdd38a54d29a", "comment": "Malware payload (EternalRocks)", "value": "24c29115a23f50e52fd214d77de80fdf185c6c97c21673b09ee88f6bcae3eb4c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335123, "uuid": "52351c74-c0aa-4078-83fb-35c0551e941d", "comment": "Malware payload (EternalRocks)", "value": "0f42ef208120336f05baafb86f0b5edf5fc08fda", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335123, "uuid": "370cb846-e0e4-45e5-85af-f2e8b1852e6c", "comment": "Malware payload (EternalRocks)", "value": "66bc703c3b7d61bae1703e0217b685c9f0c912bc2d26761e949939f8cccc127653e017b8a3882000d41974ad215a6416", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335123, "uuid": "a0d11f7b-0148-4881-a384-4d9c24942fe0", "value": "T1504633557E6C1CBC476CA339B44F6F180BC50B44981D216687DABCE342EEB61583BEB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335123, "uuid": "44dbaed8-01df-4a1f-bdf7-04eae726f79f", "value": "49152:6vi37EO/FA9LRvbLvZc5qfezVMYMKiv0apXAHiyMhl1g1p/3j60PTSgkVQYSfJT1:Mk3kAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777335123, "uuid": "77a432d2-3340-4596-978c-602804204ea1", "value": 5790211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777335123, "uuid": "ad6bf410-72b0-494f-85fe-26db2a7096e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335123, "uuid": "600e137c-c2d8-4eff-8efa-9c8e963fb737", "value": "conhost_e911.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22de310-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403440, "uuid": "af490c0a-8e4e-4aa9-98de-7a1bffbc769b", "comment": "Malware payload (Mirai)", "value": "010bc81c9a1ae8ab7705155e54487c47", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403440, "uuid": "6f704421-ee8a-469d-aedf-c5cced12abad", "comment": "Malware payload (Mirai)", "value": "24d4bb543bff23d96c0f339ec7ac1248bb44c60b96b23c3e60af662e5242cb26", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403440, "uuid": "478ee564-e724-49a5-b170-d52936973777", "comment": "Malware payload (Mirai)", "value": "f144708d094205b1e50b05633067fc6c438bf429", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403440, "uuid": "feaf022c-f882-4aef-beb3-11f88fae85da", "comment": "Malware payload (Mirai)", "value": "be8cd7a9a0dabc62bfadd8436a8bc96a9e96b4df8e05c14331e2f005656881e30d423a0ce07e8c9d811f6a977250cf2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403440, "uuid": "b619ba89-9c18-432b-9aa1-b799743802c4", "value": "T1E9A328A3CC762F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403440, "uuid": "1822c29d-f028-47ae-bf6a-77c891d0993e", "value": "1536:71ufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAr:wbU2RC4kPCtSzWu3/3L1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403440, "uuid": "cb14810e-4b9d-4c8e-9553-00a0b00fdf6d", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403440, "uuid": "65ae0e5e-4770-4bbc-b63c-10bba29c2c60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403440, "uuid": "566ad5bd-dab8-4fb2-9654-dbd6e77f8633", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002c64c6-429c-11f1-a769-42010a9c0008", "comment": "Malware payload (Dynamer)", "timestamp": 1777337321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777337321, "uuid": "a72fbae6-6b11-4a55-9546-a99ed4f6b267", "comment": "Malware payload (Dynamer)", "value": "c5b90733548836aeb1dd7d02c9f27bf7", "object_relation": "md5", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dynamer", "colour": "#353371", "exportable": true, "hide_tag": false }, { "name": "sicoob-menujuridico-com", "colour": "#0D50B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777337321, "uuid": "f856174e-f92d-4e3a-943d-c16172291ed8", "comment": "Malware payload (Dynamer)", "value": "24d90293b65891ed6bf2ec432aa395110873654215831daa173aba9f59c9d86b", "object_relation": "sha256", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dynamer", "colour": "#353371", "exportable": true, "hide_tag": false }, { "name": "sicoob-menujuridico-com", "colour": "#0D50B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777337321, "uuid": "76fe7b04-7427-462d-ab7b-338080bca6cc", "comment": "Malware payload (Dynamer)", "value": "f933b89cc611320bfb00ad201ff89912bd6bf0d0", "object_relation": "sha1", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dynamer", "colour": "#353371", "exportable": true, "hide_tag": false }, { "name": "sicoob-menujuridico-com", "colour": "#0D50B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777337321, "uuid": "995405d1-902e-4005-8d3c-03a3770f1d3d", "comment": "Malware payload (Dynamer)", "value": "c5bf3659be5c9914f522d6775bef7656c72cf089265ad80ca710e292d77f906c30b882fe9c27c62cf37db3a6b73dd8c2", "object_relation": "sha3-384", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dynamer", "colour": "#353371", "exportable": true, "hide_tag": false }, { "name": "sicoob-menujuridico-com", "colour": "#0D50B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777337321, "uuid": "aa6ee167-8040-43eb-95a8-d3e91e2ca9cb", "value": "T1BAF63323B286653FE46E4A364A776329A53F77F566168C1EDBF00C4CCF254402E3A687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777337321, "uuid": "c2e23dff-0a12-4651-ab50-d86e14a9e7f9", "value": "9df2a9117e5c7ad907577037fde1e137", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777337321, "uuid": "13ef8d2f-5003-4091-80b8-9e8b64b96d5e", "value": "393216:GvrQGZehlKP/yDl91Y4+6kgUdfhzx5EtdTYzKr/DHBcI4Wz5f:GQge1DG45Sfhz7iT7cpWzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777337321, "uuid": "2cfbecb1-772c-4c10-a4ae-64fb43793ab3", "value": 16452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777337321, "uuid": "e83f498e-9273-43b5-8291-4b16c215fbeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777337321, "uuid": "73975beb-d877-4d47-a978-51c55264c28f", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5a9354-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355063, "uuid": "5b157761-14a7-41ac-b724-73bd72917fed", "comment": "Malware payload", "value": "abf1bb0354cc02477e62d865acd2723a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355063, "uuid": "e6fc622a-810d-41bc-b047-aed0420384a1", "comment": "Malware payload", "value": "2647132a3a6f1c0a6c0bc1523b625475f7551cf545d41bdba3398e35db9fe922", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355063, "uuid": "5f267e7f-140e-4faf-8d0a-dd2cc9a77219", "comment": "Malware payload", "value": "a208d2dbbc3438335579ba3ea779671da01fcb3d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355063, "uuid": "362dc412-ee79-4a63-8042-3857e000d034", "comment": "Malware payload", "value": "c98741df31b020ad31e86d3edca60f387cfe18afe06e977be005d17f23e774788d072d0aea3e7aadd5f5223701931993", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355063, "uuid": "9c84a1cf-b9e9-44c5-8e72-237f16d04392", "value": "T12B3723894EB4BF1F876820B8387207CFB7BD08545BC86E9BE7153C96461EA5253CF096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355063, "uuid": "b5138402-c034-4c58-9225-57242989b524", "value": "49152:lWtWgWQWGWhWTWkWnWmWCWxWdWAdWkWEWlWlWUWA2WfW9WKWCWsW2W0WNWWW+Www:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355063, "uuid": "dbdc46ee-4daa-444e-9531-839ed87601e0", "value": 23424221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355063, "uuid": "82bf1b76-ed17-4235-9909-a55cba35e06a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355063, "uuid": "c82242ce-9a67-49d0-8898-78100ffca155", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75309d6c-435b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777419551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419551, "uuid": "be9e07ee-103b-4374-9892-7eeecd70126c", "comment": "Malware payload", "value": "83067d8404be27a7a082164c441fee6c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419551, "uuid": "b79b471b-8dee-4196-ac74-91717f4e5a48", "comment": "Malware payload", "value": "2808d9e36b3dff6ab5f549eeae5305cb1b721b12d127708b3c77f29861416872", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419551, "uuid": "05a445f7-474e-483d-82f7-0770405352c5", "comment": "Malware payload", "value": "63847743684e462707cdfc29866917c1957cecd0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419551, "uuid": "567cf16c-4a1f-4a1f-bf98-52682ceaea92", "comment": "Malware payload", "value": "89c97aaaa26c660eb722714e0f1169aeab04c6d38d3977f9e9a0cc8d139fad28cceae96df02468099bf639383afe94da", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419551, "uuid": "698fee96-c9c0-4d5a-9ea3-7d9e1db272e7", "value": "T17AC57B0278D004EDC09DB63288F276967B34BC580B3627C32E95AA783E77BD11D7675A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419551, "uuid": "403ab689-b5a9-468c-b289-3efe6d161114", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419551, "uuid": "525d4b46-d519-4f24-9d41-10c65de64919", "value": "49152:5t4AEYNdKalhIzOCKzlkCNAqlDaXHdLyaxifwoEEE3De:5tXtPuqCEkCXlDOhjgEEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777419551, "uuid": "ef116a9e-64d5-4b0a-89e9-93c6f5bd8a7f", "value": 2633416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777419551, "uuid": "87400659-d786-49d5-b15b-e2f99ef2d3ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419551, "uuid": "5390c921-0fea-474a-8c7b-31d43abb173c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467ca044-4297-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777335291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335291, "uuid": "dfc45de8-27a8-463e-ba7b-0754cb132c98", "comment": "Malware payload (Mirai)", "value": "9a964e45a17fc23802464ce1796e999f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335291, "uuid": "d5f026e5-93db-4254-9d12-d5b13b1f6cb2", "comment": "Malware payload (Mirai)", "value": "2849dbfb60f5ee047ffb5c91f00d029349a95f31d8afe17cd3892136da2b5690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335291, "uuid": "d5a0f912-5d72-4517-9233-c562ac1ba7ff", "comment": "Malware payload (Mirai)", "value": "43eb1db34ead8e40554ec6daabd4053e72512baa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335291, "uuid": "26c8202e-8595-44a6-98fb-501899aab43c", "comment": "Malware payload (Mirai)", "value": "5f35f7d0b943d9ca6230b2af7e6167efd715379363cf5c5087f0750f97751419d2cf71afd258b1badc28ddd4960dfd91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335291, "uuid": "3df0f5a3-dcb3-4a0f-9fa3-73a5510c6a4b", "value": "T1D7534C42B70C0947D2671EF03A3B27F5D39FE59121E4EB84790FAE4592B2E321586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335291, "uuid": "38e71e15-9d99-4085-8cea-d1e9b8d2d0f5", "value": "1536:c0IRxRxRxRR6gLpYmiktuGRNJlIVxar/CkNqc4HIYrxvcIxj:cZ6gt8VxanNwP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777335291, "uuid": "711078c0-c613-458e-95dd-770c3923a681", "value": 62912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777335291, "uuid": "6197cb4b-01ba-426f-922a-31336c78e15f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335291, "uuid": "5966b87a-af4e-4cb7-b19c-88e57588c05f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909f34a9-42f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777377077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377077, "uuid": "16244565-f738-480b-8cce-e92d4f605506", "comment": "Malware payload (Mirai)", "value": "2a1f90e03d92668ff3dced4cca7dec01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377077, "uuid": "2a95fac4-7028-4391-ba7f-cac3df3b88eb", "comment": "Malware payload (Mirai)", "value": "28682b51c72f1f9f7d7401b1db5ce0cfc5febfaf4f6102ecbd56def8d9a4deaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377077, "uuid": "db5bdde4-75ec-43a4-ac5e-a2e671b6c40d", "comment": "Malware payload (Mirai)", "value": "66481539bacfa39301bbf76af40e8aede48618cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377077, "uuid": "07f2be18-4377-4817-9180-20a770e441f0", "comment": "Malware payload (Mirai)", "value": "fd88ac6a2c4e732598cf56655d2d9ca0e6f23be754cdcacd2c9811d4f60419d685e3adeb23e7c8a28ce27cb54e3b9a11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377077, "uuid": "e6479e45-f6a3-4ee7-95bf-5a61096867c2", "value": "T165E2F1A5473BA367C15DE6306E828A960E215D529F878F3D4D3D7CC21D5A46F4332E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377077, "uuid": "c9d065c6-7ac9-47c0-8354-2148401e0038", "value": "768:z8hrjbxF5tqQ40et7Qz4Pm6x+zhENYlWuAen9KkAa+MisRy:z8FjbxLkP0y7nPyhENYQgnEa+MHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377077, "uuid": "33302925-dfff-46e3-a934-cbd8cd8cd240", "value": 34188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377077, "uuid": "d35976a1-3b99-48ea-95a4-50f5b98b1d12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377077, "uuid": "c4258715-9b9d-4e97-af70-b7f457400c59", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841aa898-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777365030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365030, "uuid": "6f573db1-5034-479a-a427-7929c988b1b7", "comment": "Malware payload (Mirai)", "value": "f29a59cd1521e5c291d582d895d824b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365030, "uuid": "c717eb56-948d-40f4-b9af-1963d356659c", "comment": "Malware payload (Mirai)", "value": "288e2a5bce14464a1ca4f945f69e9e8cba06ab8b66dbe8b47e6fda906e7de7d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365030, "uuid": "caaf7be0-acad-4441-965e-38c3878ccf2d", "comment": "Malware payload (Mirai)", "value": "890dfdd48fbf6c2ce3b45ee305b92bb65ba02e23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365030, "uuid": "b14c9161-6690-49b0-991d-45fcad1cdf6d", "comment": "Malware payload (Mirai)", "value": "05593ba760925201434d2cb7ad25fe2191fd39394852abb6bbc4c82ca3e8009763a38839ee75754d481a33c66cd22c5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365030, "uuid": "b01d548b-3ff4-4ecf-b2ce-fdd51c1eeafe", "value": "T13FE32A56EA418B03C0D22779FBDF425533239B68D3EB63069A28BFB43F4279D4E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365030, "uuid": "0906ab82-1ab4-4091-9926-4fdb39ae2add", "value": "3072:pau7sQU/0giFZweU1xzd6ehaCSjc2MPoM/9D2aAAmqwSHNxIF/:paszU/0giFZS1pd6ehaCSc2MgM/9NnmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365030, "uuid": "620fad67-64fa-43de-8f64-2c6b34d7250d", "value": 152222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365030, "uuid": "075a4047-33ab-49c0-874d-e7c2b58de84d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365030, "uuid": "2fcdb9ef-be37-433a-b4c6-b95d80c3e311", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35a4f07-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355231, "uuid": "9252c9f6-768b-4360-9931-f6e14b8aaea1", "comment": "Malware payload", "value": "b20c01b442ab04f87ca7d09653552525", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355231, "uuid": "09d9f58b-0692-412f-8ab3-f360bb3e7b28", "comment": "Malware payload", "value": "2a80f0923570125f7de7febed584dd2bc7b84c2b954d062aede4303b48178abf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355231, "uuid": "956835ee-d27c-44ac-aa0e-c8bc5945e07d", "comment": "Malware payload", "value": "5aaa7f98eeb6eb4cf0c1023b804a6c101fafd790", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355231, "uuid": "8637e3fe-c177-40af-b987-08b1c46cd3b8", "comment": "Malware payload", "value": "4b68459866f5ce52e928f73ff5b21ec6bacfa1f519536792ec660ca18d873f7e1fec4a5614ed48f303112cb2987279cf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355231, "uuid": "c5331813-792d-48b0-aa7a-c88e290c86e4", "value": "T1033723536F9E1F7D8638226510EB633BA5C8DD5B44449CC992A37C8B8E4FF16285F2B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355231, "uuid": "869db50a-a44a-40f2-a235-27f499f3d3ce", "value": "49152:W1K1R1M1m151r1C1P161w1J1991f1q1a1y1EG1F1F1Z121p1H1g1l1+1n1d1511D:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355231, "uuid": "813b8e7c-27f8-4aea-8b2b-67b6aab35bf1", "value": 23684329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355231, "uuid": "2d3aac52-fa20-4892-9569-f09525fd41e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355231, "uuid": "83a83f32-2100-4cb1-9194-7e7485f0ba22", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474730c8-42f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777376095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376095, "uuid": "efd2a2a4-911f-4ba0-b427-050bf047fee5", "comment": "Malware payload (Mirai)", "value": "c5ee08a4bcbdd56cd6ba81851ca015bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376095, "uuid": "ce54d43f-ba9f-4269-8b65-a6d28bc77fd7", "comment": "Malware payload (Mirai)", "value": "2ae304f2c1572c7dfdc7828615a4fdfe46d2641c5e2d048ece66ff8a732aa376", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376095, "uuid": "b666910f-806c-4a6d-95cb-f87e9c542d43", "comment": "Malware payload (Mirai)", "value": "6c881ff38c02266390424db1be6eb835995589dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376095, "uuid": "e3d9f14b-8fde-4d42-a021-7a4feabde677", "comment": "Malware payload (Mirai)", "value": "e8a45aafe5f3a18a7c3d4ccdc7adb6a942e2eb48348d569df11dcf7ce898981a2e36778676917fd32ba92bf41212b852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376095, "uuid": "46c0e36f-880e-4ea4-9e3a-64321dded485", "value": "T1C6D2E1B1E168D24FEC276EB627A05FEFA4BD0C478BC55780384D9BD51AB9092831DD0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376095, "uuid": "7baef8cd-ce49-4dd9-aa08-4e611daabc5c", "value": "768:7qhc6aviVg4cv0GYdoo3QyWiYIUuBQOwiOUZJ7FXC:72scg4w0b3GiYLuB5r4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777376095, "uuid": "26b2be6c-2388-4cf4-955c-f9058b19f414", "value": 30652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777376095, "uuid": "84fb7e3c-c94b-4c0a-8974-0472123e50f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376095, "uuid": "864fe155-70d7-45d9-ab26-91ae8c227341", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8508fe63-4299-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777336255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336255, "uuid": "3c0c41ad-9473-40b4-9190-a620e0298228", "comment": "Malware payload (Mirai)", "value": "721d4a706b83262999cca01d10cb8a20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336255, "uuid": "4f950898-c1f8-4981-a9ba-779e070b5220", "comment": "Malware payload (Mirai)", "value": "2f677ea54ff98b9976e5a057cd8e94d4498856d7aa5a6bc777b8d085b7429929", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336255, "uuid": "e8ae4a15-a557-491d-b70b-5d8769f9b7b5", "comment": "Malware payload (Mirai)", "value": "9d08986259e1a2b28c2ec9ce8be8e8bb0f572d73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336255, "uuid": "cb26bc36-578a-4fb9-91c2-5f2d64bcadb6", "comment": "Malware payload (Mirai)", "value": "df394559b970f1c3552827f577424cb887415dff8cff5fdf743d6656557f42988a31e16b195e39498181f3ab6d6a9e07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777336255, "uuid": "f88670df-eaba-4aea-ba44-0c3f899db275", "value": "T10D337C02FB83C1F6E85309B14637B31B9632D92A9071C79AEB59AD32DD13901576B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777336255, "uuid": "ceb4f429-06d8-4fc5-81d2-c90853a782f7", "value": "1536:QVa6O/hWv6YcmlayR2DdOlVJcygJU5vpcmdg:QVdhSElai2DdyBguK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777336255, "uuid": "6c90c041-9940-4ea8-a3df-f14c46118ecd", "value": 54376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777336255, "uuid": "e5a2510d-a212-48ff-b859-0b1f0d73b5b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777336255, "uuid": "69739b55-f5d3-486b-9cf2-b4ade04f1b24", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2956e11c-434d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777413411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413411, "uuid": "09e9972c-65de-4bca-ad8e-08aacdb5e2a8", "comment": "Malware payload", "value": "233c484135b2007f7ae36bf4f774f012", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413411, "uuid": "cd3539f2-ca95-4917-9a62-3af1f3235a5a", "comment": "Malware payload", "value": "30096886b16811ed428cc48191004b2046930c79ee23a9ed03189616406177a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413411, "uuid": "296d8d96-ba86-4e87-8c0c-747b3fd7f32f", "comment": "Malware payload", "value": "fb5327265c1daba0135a79cc2bd6968ed3e4283e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413411, "uuid": "961e5d62-f2b2-4264-bd30-0f3447330fc3", "comment": "Malware payload", "value": "181152244eccef29b29833bbbccde5ae06021b333d0cbbe2a6913f13fc3180572c5758df11e872a5f5d5ced6b77931fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413411, "uuid": "2c7cc8b7-a7a8-447a-8bfc-094ce216b85f", "value": "T1C943F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413411, "uuid": "75190d4f-874b-4071-8190-1cc5a9b9cbbc", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfz6:5AG8nY5BZG2xxmLQLS/S7hHnQfz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777413411, "uuid": "69008b97-bf40-4544-8cce-bb1d935d8a33", "value": 59512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777413411, "uuid": "989e177e-2e6c-45d9-8f08-eccc03f0d239", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413411, "uuid": "2db8cba7-908b-47cc-8024-062e0c44a271", "value": "tokend", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f1dc97-42af-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1777345603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345603, "uuid": "e88cad1c-7c26-4b0d-989a-85b4226c5a4f", "comment": "Malware payload (SnakeKeylogger)", "value": "24b08f5d2ba8f3f971738757be82d0ea", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345603, "uuid": "8d595afa-b696-42b0-a9e1-04af05cae780", "comment": "Malware payload (SnakeKeylogger)", "value": "31ee885db60cd91170f384856bcdda68ef7fd3014149d4905eefcccd6f0ee906", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345603, "uuid": "6b9a0569-1c8e-41ce-ba3e-70bc34fd22b1", "comment": "Malware payload (SnakeKeylogger)", "value": "fc904090a5bee50e80fcc48f03642e75fd44fc51", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345603, "uuid": "bff0e90b-a7b0-4263-bf82-fdc27451e2f9", "comment": "Malware payload (SnakeKeylogger)", "value": "ef1fd8a72bee7819f5c7b122c08407ec9aa9e5a3cf86a45cf252d04e2eb61fb40bc908f9663b80b5d071d19f545e54ef", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345603, "uuid": "a8bcc246-4985-4296-8b17-9d5ef0db5756", "value": "T18BC423216FA8B6EF03581FCC79AB7F4625447F6B4DA82257B3CF118A06B9340639F605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345603, "uuid": "107de176-ebe6-463c-a163-bf8ab83c1e56", "value": "12288:82O+h2zn2myIKIb64ouuBibo0fY2HMEf/lY/LKVNF:8z+cz2xImAwibPfvMnuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777345603, "uuid": "399a0c40-a2f7-492e-96b7-694b2e97a83c", "value": 583307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777345603, "uuid": "a72a8e1d-f640-4601-a898-3abf6ed989bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345603, "uuid": "ea44972d-578e-4f5d-a854-3f8a72797b84", "value": "ps_FpvsSrwVngoR_1776784364633.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a0eadf-42a2-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1777339954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339954, "uuid": "07c3495d-6f01-4b6a-9e7a-4ddac8565e11", "comment": "Malware payload (DonutLoader)", "value": "c153675f6d8fce0fae91c561eba6c4ba", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339954, "uuid": "95b59806-46fc-4174-9996-09799ba3ede0", "comment": "Malware payload (DonutLoader)", "value": "336c46188ceff34fea213f7ebb593b8ded856fde47edc0c1ba8380d04377fcb0", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339954, "uuid": "ab23dcdb-0aaa-4b85-b77c-075c101b0051", "comment": "Malware payload (DonutLoader)", "value": "e0bcfb2fc54410671d9ec05d3dc69d4d1ff319ab", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339954, "uuid": "fc70c723-6744-4e85-a231-bb4bd6fc0da8", "comment": "Malware payload (DonutLoader)", "value": "7376d6a7c91ea1190e8ecb65a9c775ccf1de8bd151ae66f2d160910c2765b4bae18722611175776218de1ce6ca0a6075", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339954, "uuid": "1c85cc47-894c-4bd8-aafb-72044595954d", "value": "T1288565348B702A63EA7C9D71A24A842C48724961AB6E3D09C271BD190FCFED77C65DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339954, "uuid": "31a47e9b-5c18-4ad9-acf3-46ac7c2efe54", "value": "12288:aCS0mXySF20rzZUtf8xV28y0wYvN1CmFy3xiiF4iDtXp:xKiSF238xM8yuN/g3nFf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777339954, "uuid": "aeb7b90a-ad58-4e13-8adb-887089398c5e", "value": 1826528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777339954, "uuid": "2f0a02a2-1c1b-40d1-98b4-a9a1f314b3bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339954, "uuid": "d901cf7b-13f1-466e-9332-01808b211e60", "value": "1292176168.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d10b596-4297-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777335222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335222, "uuid": "33f2e596-26d0-459f-a746-4e1c6e67cc9e", "comment": "Malware payload (Mirai)", "value": "6f8643f27678356d9b3179d2e0beed8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335222, "uuid": "a122f7b5-0570-45df-8242-5b445b4d9050", "comment": "Malware payload (Mirai)", "value": "338c2e22143d58483591c209ac05f842dae19a26aa822ca433e10b3e61660591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335222, "uuid": "47c63475-ade9-4f3d-99cc-a1b893281901", "comment": "Malware payload (Mirai)", "value": "9fee3035b993058617d859aa6077d8045334cb30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335222, "uuid": "2bb126dc-9b7d-44c8-a9e3-b7550df1ee79", "comment": "Malware payload (Mirai)", "value": "247e89541ba5377d34e92b0e0975311a702eda055082c0ae757db32c7fcbfbf019d6d335bd49cbade0e28d78ed65e0c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335222, "uuid": "2251a692-b291-433f-b74e-f2796e721bf3", "value": "T154E2F1E0F10E6F87F7DFACB40CA2C890F3B20B29B649DBA65050EE5149278659175FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335222, "uuid": "7c14daf0-c999-45a8-90df-bf3a63d01b08", "value": "768:tngyfnjfwqlfBFk3gZwylcJ9RE3iJ8XGyenb2To4uVcqgw09rF:tgyfnjfwqlfrWecJnEeNqo4u+qgw09x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777335222, "uuid": "700fd384-81b5-40ea-b418-5e38bae651ef", "value": 32568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777335222, "uuid": "b4ea57fd-fb96-4a30-bfde-f8fe389ba522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335222, "uuid": "9a8371dc-36b0-4c76-864d-eff0b98e4abe", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78849a2-4331-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777401650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401650, "uuid": "7843376a-b453-46d9-bad3-28a792568e60", "comment": "Malware payload", "value": "ec6c27083569726c3a413d8c3f9b32e8", "object_relation": "md5", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-documentosfbran-info", "colour": "#53545F", "exportable": true, "hide_tag": false }, { "name": "documentosfbran-info", "colour": "#59C924", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401650, "uuid": "6893d35e-b0ff-4e78-ad51-60a6f6e43f1c", "comment": "Malware payload", "value": "34b548034671fba6e8c2ee8fea59bb3e41f3282ffe5234d052f8ecd8899f1ee6", "object_relation": "sha256", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-documentosfbran-info", "colour": "#53545F", "exportable": true, "hide_tag": false }, { "name": "documentosfbran-info", "colour": "#59C924", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401650, "uuid": "9e843a28-5dd4-4eaa-ba8f-686997700437", "comment": "Malware payload", "value": "6169496ed1f4f263a64a1eb1299a9a1f35a822e7", "object_relation": "sha1", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-documentosfbran-info", "colour": "#53545F", "exportable": true, "hide_tag": false }, { "name": "documentosfbran-info", "colour": "#59C924", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401650, "uuid": "7f27ff49-4dc3-4d7b-85ed-a31e8eaeb6a4", "comment": "Malware payload", "value": "683d239108c95456e06fe54a94b4452077205f1409d03661a95bd9b6c9ccf6ef08954b67890d42fb805fce60cd7ba841", "object_relation": "sha3-384", "Tag": [ { "name": "AllaSenha", "colour": "#20D2C5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "docs-documentosfbran-info", "colour": "#53545F", "exportable": true, "hide_tag": false }, { "name": "documentosfbran-info", "colour": "#59C924", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401650, "uuid": "8b0fcc11-4207-40aa-b920-183b5759fa3e", "value": "T10D71B41BCD661D5A87F1821E52CC4DC2AD2C13CA522688DD3267CB69C68842E59D7ACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401650, "uuid": "fe2a0b57-30d0-457a-9f8b-b4b35a030d0f", "value": "48:NyNfEJEl8wy3KMipwUCvh7Pe/06/puyFZl29LlBD8YE6w1zlWdygVR9L7lhXLS:NyfevKMiY7Wcml09Rasw1zwdy2XLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777401650, "uuid": "1c11000c-1fa0-4c8d-809d-5c3df57463c3", "value": 3764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777401650, "uuid": "7646f206-f4eb-4a26-825a-f3fe4f63307a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401650, "uuid": "a1e565de-f056-4b0a-ae27-fa8820b54896", "value": "vngoye.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedaab8c-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777397770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397770, "uuid": "f9777581-9ad8-4907-a8a9-3aaaa4fe0707", "comment": "Malware payload (Mirai)", "value": "41ce1f208b0d94ff7b207501a18c93b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397770, "uuid": "d672e4b1-2aad-426f-ad15-36d3d7ccc39e", "comment": "Malware payload (Mirai)", "value": "350d214b2d2e56594971c027f4cb78ff333553e2f355e5b166f67f8bf68564eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397770, "uuid": "e97a15ff-6931-43c2-adeb-cf9935075598", "comment": "Malware payload (Mirai)", "value": "9e4db93ee087478c51c7e7bc07005b00eb0854e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397770, "uuid": "e2ab0757-7a85-45af-a9cb-4a20b16a515b", "comment": "Malware payload (Mirai)", "value": "aff62af35072c58298fc8333c5e8901886e4539b9ada863c6eb376cb3d841ef3f12fb64f3319372929fd5ab28859a6c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397770, "uuid": "76cc1f05-a5ae-463c-911c-0836d58944ff", "value": "T15C465B55FC2D6462C6C9B6756FB643857239BC488F82C3236618FB3CBAF27548F12261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397770, "uuid": "de96f3b8-82ad-48f0-ad4e-beb48919b14d", "value": "49152:uVOZh4QKKScbOm7Iz4F6Sc+ZkU+BKajTaRwjo5EUsX:uVsmQNScbezo65hORYaET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397770, "uuid": "d420e8dc-d881-431e-9b15-3c254d5cde37", "value": 5636258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397770, "uuid": "00b6caa4-446b-43db-96e0-c70181699b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397770, "uuid": "06cd4c6b-4bf3-4bac-b9d2-40676d434169", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23516dc9-42fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777379470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379470, "uuid": "1248ba60-ad26-43fd-8cb2-bc4da45e2363", "comment": "Malware payload", "value": "fe51517713daabe299ab1df1613d17d8", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379470, "uuid": "de15d568-5b4f-4ad0-be2c-66d0f13e722a", "comment": "Malware payload", "value": "353d2311dcc22296bc1a0bcd2ca772dcf9a8ea0c61efe865ac9ab671c183fb1c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379470, "uuid": "5ff2d413-7bc6-4545-be62-9668c9e622c7", "comment": "Malware payload", "value": "195d42f59a9e883408bf5e44ca3bb33b2d14367c", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379470, "uuid": "334a0b6b-513e-458a-bb5e-f50751e73c70", "comment": "Malware payload", "value": "17222137e7ab91a59be08a40ec83e83b367dfc14d3da07f2641cbfd8250acc641193a2af65df279b2a8c3e774604e502", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379470, "uuid": "41e3754f-d535-40d1-95eb-a03140033319", "value": "T15D3376EB353FAD6A49178D6E81E7A5ECF684D161F9899C822084F1618C398FCDC063F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379470, "uuid": "ab3c0c6c-1869-4500-ad6f-3fcbb2b23e22", "value": "1536:Wi3A8/XYpcTcVM5D7gqvexHLe5X58GeGSky:Wi3A8/XWcTcq5DsqvexHLe5J8GeGSky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777379470, "uuid": "8e6b5f9b-ae1c-4469-b99f-a414f3080047", "value": 53345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777379470, "uuid": "5e3cc349-3522-4790-ad32-f0f460f8bfda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379470, "uuid": "b28c1077-188f-4013-ad88-8b77aa1103d1", "value": "yc-scm.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7a8430-4295-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777334742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334742, "uuid": "dbe91b07-365a-44c5-a803-130670d04b49", "comment": "Malware payload (Mirai)", "value": "ff8c46a51b97d9e4251e6cde231f11fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334742, "uuid": "9ad919a7-61bf-4acf-b158-6ad5969fec4c", "comment": "Malware payload (Mirai)", "value": "3544ea21134e5bf99b6967cd7213a857b9e59ca1b3e8e7f59d5de04ed9f290da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334742, "uuid": "7e1f3bec-1543-4994-8c82-9edbf38f27d8", "comment": "Malware payload (Mirai)", "value": "9203a38299b80d7172ab127932c71bf60cb0a5a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334742, "uuid": "ac40e344-d32d-4465-8762-44edddc146a4", "comment": "Malware payload (Mirai)", "value": "a4c8998238702abb4e6884eab00621a069964fa5c2abdb79157df95cf2c95e7e0428f27a142af79dad875813a1ae4f9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334742, "uuid": "0d660eab-d85c-4d3c-8851-a8f570828e96", "value": "T19CF47E9DFE4E3D42E2DBE37C9B4D83E1A21BB190D32351A33942424CD4C6AD9CBB155A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334742, "uuid": "b533f22f-f325-46e6-99ce-db902cc801dc", "value": "12288:+XmPWQ1U1v2aKVGKfpiylCkoAe6/0wE04Vw5Cwis0zN:+Xmu2UcjGoiaFeaW3wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777334742, "uuid": "9a62b89d-2649-40f8-82af-8803771e307a", "value": 729280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777334742, "uuid": "ab13ba69-1c8a-46a7-9e20-dc3d6a0b105c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334742, "uuid": "22ce4da6-3b9a-4623-b341-4489e9c5a8ee", "value": "agent_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cc45e5-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389296, "uuid": "fbc5fa84-9497-45f0-a2d4-2a884393a6b9", "comment": "Malware payload (AsyncRAT)", "value": "a0a51db121780f587d0ff61e51b36131", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389296, "uuid": "80ca50f5-f775-4036-9b76-f333b13a61eb", "comment": "Malware payload (AsyncRAT)", "value": "360867fb034a42164b811bfb92a9a26e793554d8618d484118d0ed81a83cf473", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389296, "uuid": "673e7777-c7a8-4d0d-a358-ba9247d4bcd4", "comment": "Malware payload (AsyncRAT)", "value": "b15ba592ce97e3e216f0871e2e7b3c89e5013df0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389296, "uuid": "441b38a9-ad6c-4008-89f9-ac59e3c577ad", "comment": "Malware payload (AsyncRAT)", "value": "916925a9a74bc4a5696c7931a1118acd407e941909b181629aecb86a3d9e0c1c809910ba80b60154bd3e4618b8e08e76", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389296, "uuid": "d5d9d932-555b-4c33-9e04-6539a5a3d27a", "value": "T1281339007BFC1625F2FE4FBCA87952454276F9639932C34E1CC4509E1AA27C0AA51FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389296, "uuid": "5c336a39-83f2-4643-8951-524686866c0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389296, "uuid": "689f3748-637e-403a-b66b-45c6cd0b15b5", "value": "768:oq7x+GTU+nnIRgqYSnPPEz6IXSvSRCfPuRbheuoVNt0wLv6D+:XU+LSPPLIiqQXuRbguIN7Lv6D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389296, "uuid": "04948471-5b2c-4bfc-baf4-7d54e27ec1d5", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389296, "uuid": "85ff9a60-6147-48d3-8851-d34a9e1dea26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389296, "uuid": "36aee9e3-b08e-4011-9edd-369a9dffeec3", "value": "360867fb034a42164b811bfb92a9a26e793554d8618d484118d0ed81a83cf473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72d527e-4314-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389275, "uuid": "971fc8dc-7f21-4422-adda-4f4d96d5476a", "comment": "Malware payload (AsyncRAT)", "value": "0aeb17098855fb766c5a46da4486641e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389275, "uuid": "50b8fba5-5c1e-44dc-99a0-3779d04fb9e9", "comment": "Malware payload (AsyncRAT)", "value": "37962d265ce4c3d6b0e1a2479522dc2bfc835b23552cdb24c35747d0c22bdd13", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389275, "uuid": "e3a87741-698c-4014-b648-c32f2269e630", "comment": "Malware payload (AsyncRAT)", "value": "4fcad8f3528695ecd2a8414fb5f5d6d2b8f126d8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389275, "uuid": "a9b480de-2b42-41be-9ff4-81ceef81641d", "comment": "Malware payload (AsyncRAT)", "value": "b3b43b475db1973ada78d3cedaccf18f9bad8fb5eb4ef509f52cad84aff722872aa76c16a77a14d6f9ce0dc0e3892efb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389275, "uuid": "8584d9e4-7b6b-44fc-82e9-55413f818dab", "value": "T1231339007BFC1625F2FE4FBCA87952454276F9639932C74E1CC4509E1AA27C0AA91FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389275, "uuid": "fe0906b2-1cff-4f2e-8f20-0a7dd65c4770", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389275, "uuid": "4a53720f-21ed-490c-ba1a-1b58583844f6", "value": "768:Eq7x+GTU+nnIRgqYSnPPEz6IXSvSRCfPuRbheuoVNt4WLv6D+:TU+LSPPLIiqQXuRbguIN5Lv6D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389275, "uuid": "4db3794f-a6a3-4593-aa06-49f6a600e0e0", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389275, "uuid": "ff0438f7-7f2f-4e1b-935f-1a3935f091ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389275, "uuid": "0c414e29-9d76-4fec-a7bc-fe87b8b528e1", "value": "37962d265ce4c3d6b0e1a2479522dc2bfc835b23552cdb24c35747d0c22bdd13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7f1830-431a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777391616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777391616, "uuid": "ae1324ba-54b4-4f2f-a520-1fe11fd86a8b", "comment": "Malware payload (Mirai)", "value": "7b4ad9413f9f5bd46fa44fc73f3df23c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777391616, "uuid": "c2a239ad-b72a-4734-ad84-0329218ea59a", "comment": "Malware payload (Mirai)", "value": "386f3560257e3f1f2cec7f3bbbfa0c47312ba78f0b78d18999bce976a45e7df6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777391616, "uuid": "55742396-8ba9-42f9-aa8e-22d80d8f3656", "comment": "Malware payload (Mirai)", "value": "5b6154a2ff34fbe029f0d4051403047a28a77c8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777391616, "uuid": "1569ced4-2677-481d-abad-dd4db23001bf", "comment": "Malware payload (Mirai)", "value": "603ebfaae7a275dd20c884e2786ee6508b844e8cbcb74748232a3047b055a4ed5d42f0807af8e1a453a570ce4bb78277", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777391616, "uuid": "7fc7050d-b2b0-4bd5-af7e-d43d38008e70", "value": "T107E48E59FE5E3D46D3CBE23CDF4A83D0B21B75A0D71352723942424C98C69E88FA265B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777391616, "uuid": "46f6dd4a-bc42-4489-b575-6ec93ceb25a1", "value": "12288:naQ2sthZ7/jAs5OGXcqQfW0NRinW+1pYgSo+2/zmws5RhESs:naQ2+cGqZinWGv/eE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777391616, "uuid": "14e2c71c-e411-49ab-8b85-fd7b791ac91e", "value": 666056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777391616, "uuid": "b57ed145-5784-4747-a43b-44f7cdf94c5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777391616, "uuid": "8525e357-d1ff-4744-b7c5-eda10f05dc1c", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4570308c-42b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777349892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777349892, "uuid": "1ffb95fc-047f-4084-b638-4db91aed0ac8", "comment": "Malware payload (Formbook)", "value": "de3b2990c3741f14c3e4f2e68df6d0dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777349892, "uuid": "cd1d4767-8290-44ad-bc6b-d255a054acdc", "comment": "Malware payload (Formbook)", "value": "397dc318a3dacac1afec36eb6cacf0ce4dd8ede9741301ebfd20b9890849d123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777349892, "uuid": "7adf6660-b137-4bc3-a9e6-af2074f0f14c", "comment": "Malware payload (Formbook)", "value": "2a79764b363d92c20b6dca63b63211c621d4cb71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777349892, "uuid": "1362593e-063e-4491-ba95-c75f6d34bb48", "comment": "Malware payload (Formbook)", "value": "99270235589e352c6b1a44062982b0a8a6855f82a2f6c785dab361a03d4f7d58a1a6e8df27c2460485a0d30c7c4aa40d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777349892, "uuid": "abac203f-8bcf-4eee-b065-8052d5c59339", "value": "T179C5AE05E3D819A9D527EA78CB21A333D6B1B8124B76D18F0A99D7061F73A908F3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777349892, "uuid": "e49f13f2-4566-4899-9bf9-78cf6333d817", "value": "e4edc1a9a5e73edb53a696540f95c07e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777349892, "uuid": "fe0a51d6-0c92-417c-86f3-825a4bbdf556", "value": "49152:pqbf7MIXCog1wyVAakuBbVz+17OtUbxIpXCeQh/RfLnd0FO1w:H+COxIpXCeQh/RfLnd0FO1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777349892, "uuid": "f54c14f4-0600-4caa-b7da-4a6c14476792", "value": 2519040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777349892, "uuid": "d6445b40-bb96-4513-bd80-8f8c0f4fe5b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777349892, "uuid": "89ff1d74-fb9f-4cc1-9dec-4d2999511f1c", "value": "edit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958eeafb-434e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777414022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414022, "uuid": "d592ffe6-553d-458e-a095-4fad2041997f", "comment": "Malware payload", "value": "9242e1a100495c2a8cd4799cfc0777bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414022, "uuid": "8bc11f67-d23e-4afe-a07d-41b805c4e4c7", "comment": "Malware payload", "value": "3a0e6e34aeafb5b876273c17808708139d24019376d1e0d9cc1c7add0a81412c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414022, "uuid": "fdfb5f54-2742-4341-bac0-9d49de303b2e", "comment": "Malware payload", "value": "21601703512052eec731fce416c5c5e12a864f21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414022, "uuid": "1449c668-72bd-4255-b5f6-ebc65c409349", "comment": "Malware payload", "value": "0c6d5a19fec2627944341bda3500ad8ae3c2de1a4a54ca39faeed28df5ec9c4014d4117122bc35dbfbc9f06c2196abe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414022, "uuid": "0fb881ff-9970-4991-b527-58cf1c068099", "value": "T1AC43F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414022, "uuid": "a5b07ccd-934e-403a-be29-0c23a746e51e", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfzq:5AG8nY5BZG2xxmLQLS/S7hHnQfzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777414022, "uuid": "07579f32-89a8-4075-847d-9e85c6275f79", "value": 59640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777414022, "uuid": "204b622b-8412-4758-9df3-9b6ce38658b8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414022, "uuid": "569e3541-ee9b-4a4c-81cb-05dd17707501", "value": "pam-helper", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d8c88b-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355342, "uuid": "52961405-d22d-43cc-b513-0c5298af6d7c", "comment": "Malware payload", "value": "dcf647d3b70270eac7d23f9ace2bc8b9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355342, "uuid": "6a8a0fd6-d6e1-48d7-9e62-8811ef2b940a", "comment": "Malware payload", "value": "3a744a172e038aad6809591c3c372d36bb4d679eaf37bdc93fa391d18c75062d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355342, "uuid": "af3cb9ce-7826-4818-b585-ed01ed3b284c", "comment": "Malware payload", "value": "abbd3b86d5e9af49f24eed1d15cc7c2a224d0ad2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355342, "uuid": "51c07c5f-629b-4f64-a959-e5c6c871ccd5", "comment": "Malware payload", "value": "e06de2b89ea56eca13fc1421964c5e830db4057bcc9401e01899200987f8335cafaa2a8a6f1c9ba2c02a71bebb4813cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355342, "uuid": "211a67a0-aec2-479c-9ea6-2dbd397c4a8e", "value": "T16F3723188D344EDF8A9E1625117D1F8D836A8A3981B22F9DFF9D9C07034ABD214DF66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355342, "uuid": "ffdcfdd1-6ae6-4038-a89f-e304f2d21e79", "value": "49152:rXNuXNaXN9XN8XNCXN8XNXXN6XNDXNVXNQXN4u9XNpXNqXNuXNKXN1u4XNiXNUXn:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355342, "uuid": "eab94d82-9e58-4075-af22-7961a27bf37f", "value": 23684326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355342, "uuid": "0df3f6bf-d56b-4893-b755-53fde0a495bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355342, "uuid": "8e39f9d3-aff8-401e-893d-11c24cc3c7ca", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9c3b59-42db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364564, "uuid": "c0d14244-f1b6-4d97-be0d-ef4b237e5000", "comment": "Malware payload (Mirai)", "value": "4a9838c7a08a7a73e7077b25787ef3a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364564, "uuid": "84057d76-96b4-4093-acca-f36aac8f9ae5", "comment": "Malware payload (Mirai)", "value": "3aceefe39982a5eb27e374338eb36ce001663f710b0cbd8d37da619e253c31bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364564, "uuid": "9185e257-730a-4b63-bddf-652616053e95", "comment": "Malware payload (Mirai)", "value": "ebe9cc104cea4c871b35fabe6e19c55ebd5cc49a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364564, "uuid": "f6d4ff67-1b75-4dcb-ae2a-8acc14246e34", "comment": "Malware payload (Mirai)", "value": "a66d9ab30960fccbbc4fafadf23e14fb4d71b4b673aad16b8492694d86e5d2f75e970a15f993f40f61e57d3e21dc1416", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364564, "uuid": "68551eba-47b6-4f43-9585-1c1e161d61df", "value": "T11BC3D506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364564, "uuid": "836bbccc-3382-44bc-a0b1-739886be8ce9", "value": "1536:D4w4zW/h4SZsqEznAXgiDSAP0/OojaXbzzZjCfPNXi/yRKkkI3SGG:UxW/rZsq8AI/3jarzzveqGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364564, "uuid": "1805561f-5220-4b23-9495-856e925e5d14", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364564, "uuid": "d8458529-56ba-4d3e-b16e-544f448a5162", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364564, "uuid": "9c988290-0ed3-48dd-a288-fa7bc194b411", "value": "SecuriteInfo.com.Linux.Mirai.9838.11478.28026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30db943a-432f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777400538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400538, "uuid": "efc0f92e-d359-4041-9e4a-edd3f3841887", "comment": "Malware payload", "value": "8869e8753418e56b91c5843a15e993f5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400538, "uuid": "c85af663-8e1f-4dad-95d1-00f25eacec2e", "comment": "Malware payload", "value": "3b4746772a32db5f0999223137bfade8ca73b24e92cecf7b8e2cedf2eed41937", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400538, "uuid": "5f857f98-32f5-44e1-a010-b825e330ae3c", "comment": "Malware payload", "value": "848b2d8da06318d356d47e055ffba49689735372", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400538, "uuid": "be7fd658-8631-4d23-87de-faa17a00067a", "comment": "Malware payload", "value": "fe67f8ca33f9b09b1a042a644cd62c17e619b70ce706aee60155fe13372c178d6adba81d35b3c90b64068797289f87ff", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400538, "uuid": "0b61f9ec-c76f-46a6-b082-4028c2d63080", "value": "T15B31744FAA4FE1B974B1C12646BBED6CEB4012AAC57440B47C54E441131AA3CDE5C0D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400538, "uuid": "8a369df5-bedb-4dc1-995b-4ec2e2b6ed13", "value": "48:kVCe/DmPKvt/VClymOgC93XADSX493+0A3A1tC:xPxs3XgZA3atC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400538, "uuid": "fe01fd8d-943d-4ea0-b3a5-02004912860e", "value": 1724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400538, "uuid": "3963e349-aaba-420b-aa59-9ff553b14d6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400538, "uuid": "1b68f93a-48e8-43cd-8b27-0ee36c0a4c10", "value": "invite_card.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebc1282-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389314, "uuid": "5875324a-2aa7-4934-a56a-d8b55238b408", "comment": "Malware payload (AsyncRAT)", "value": "a7569d770b58d587ae31d9020986fcdd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389314, "uuid": "60c7af93-357e-4b9a-ba6c-8c149c9c1257", "comment": "Malware payload (AsyncRAT)", "value": "3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389314, "uuid": "973f1a3c-cc6a-45d2-babb-d15eb82ad137", "comment": "Malware payload (AsyncRAT)", "value": "4488bfb0f2d88ee2663c75350a0cb401b9f61012", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389314, "uuid": "460e939e-9772-4d4e-b8f4-3d3eb36c2642", "comment": "Malware payload (AsyncRAT)", "value": "20f0d1d1dea47a7289b31e3c3c6656d7f30d00717d9f1617d321d041aaa10872cd68f3c5eb23cc4ec63be4758bcb193d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389314, "uuid": "083d6bbe-a393-4dbd-8180-09205f14ef27", "value": "T11E1339007BFC1A25F2FE4FBCA8B951444276F9679932C34E1CC4518E1AE27C1AA51FE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389314, "uuid": "7c794d35-ce66-4600-9237-790d4d85e6c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389314, "uuid": "fff6f298-61ad-4edd-b35f-5d4d8bc871d3", "value": "768:hq7x+jpQyn2IRvkFYmnjY8h/WSvSRCfvuRbheuoVNtiQLvOD+:RQy+ymjYq/jqQ3uRbguIN1LvOD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389314, "uuid": "3a0e2cd8-73b3-4f52-ae3f-1ebc2708c181", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389314, "uuid": "e2aab98e-1901-4b1f-b67d-60e6a89450c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389314, "uuid": "2d60926b-df8f-46e7-87da-f8accd01ef37", "value": "3bae2e5e103f4cf404f34ed84a58e55bd44d9fb9ba6f9638b125c4dd81e9794c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec3e7cb-430e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777386469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777386469, "uuid": "f0df99fe-e720-4cf8-b5b1-1f17e0076684", "comment": "Malware payload", "value": "13a8a4a8c7147c9e30e42c50b412cfa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777386469, "uuid": "e23faf5f-969f-49f7-b3ff-d74f5e6a7863", "comment": "Malware payload", "value": "3bd4677d37d1b322ae80ad1de3af264974bc7266b9ce981fbe18ee715a3581e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777386469, "uuid": "b508c9f5-88e4-470c-a25f-e4aadbf1d089", "comment": "Malware payload", "value": "a9007c16b9c6e2b6c45c5cb256c4871839c26bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777386469, "uuid": "a343fad0-3fb8-49a5-afbf-7a63e5a44a33", "comment": "Malware payload", "value": "0661a30e21e4c799026eb763551ec8eaa3e5949c8242b65136c87af0da79b05e94ce1581c414d1c282bbfcef87aa149e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777386469, "uuid": "009ac04e-dd6c-4ad8-8cc6-fa8206725207", "value": "T14B1712EA52D562F8D4D34A706A4A13D974C0754A86FE0C2F36C72C026611DFFA64EBB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777386469, "uuid": "1916b5ab-4560-4c3f-9222-b1d131e35f9d", "value": "5c5b4e3876fcee02b7b0d6830400ceaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777386469, "uuid": "789436e5-20fe-4f46-9801-e6711458f1f4", "value": "196608:UwJo6BPw8WkivDSoYlLrTRpHlul5tvLX+UQsvo9FAncrFy3aRuVe80TmAqH6C/24:UCSzDalbRtCehFhib06E4oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777386469, "uuid": "95d1d696-30a8-40e0-9a51-abfd677c2a66", "value": 19767808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777386469, "uuid": "e4b4c0db-674a-4d64-93d5-ecae9eef899a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777386469, "uuid": "a350a6da-6a1a-43b7-81fd-6f30d19ffbf0", "value": "Highlands City.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6e20e2-42cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777358735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358735, "uuid": "9e350586-d855-4e62-911b-9329239e5159", "comment": "Malware payload (Mirai)", "value": "c4e997bf763c309b059ef25f9e4ec22f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358735, "uuid": "59c1225c-f62b-4659-baaa-f36d59aa58e3", "comment": "Malware payload (Mirai)", "value": "3c937ff63c8bffd2aeb78fa788d9e215896393929f42e2f08f80588f60a25af4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358735, "uuid": "97ad767a-d91a-4594-8a8b-9ef35bfe29c2", "comment": "Malware payload (Mirai)", "value": "eb434d9d08c63ac42e9409304fb046e7798a1580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358735, "uuid": "069c84e0-6422-48f7-8802-8eb5e9b48bed", "comment": "Malware payload (Mirai)", "value": "667d4f9aca9b0c35b8b4fb0d838b406125b1b130180b10b4798ca5f2429b15583193fddee4e3dcf36ec7f55ab19c1dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777358735, "uuid": "609db9d6-64f9-4567-b154-0ca2f2e8129a", "value": "T1DEF47D9DFA4E3D41E3DBE37C9B4E43E1A21BB190D32351A33942424CD4C69E9CBB156A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777358735, "uuid": "0c5bc588-8c32-4b7b-8795-a807eb3e4930", "value": "12288:uTaklqw+Rpb23dvNnRiILhdpmRvG/qiCypf2oIibw5lTiH8Z:uTaklEzi3vLjsR5irPTE08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777358735, "uuid": "28f25731-3f65-456b-a498-0d2daeba7638", "value": 729248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777358735, "uuid": "41c4febb-0d02-4c2e-b7f2-64879a7a8bfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777358735, "uuid": "b530cf0b-3d91-4e7f-b707-a60159c16a43", "value": "agent_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fdd53c-4336-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403552, "uuid": "bbdba6f8-04fc-4ec6-bc74-7113652f7980", "comment": "Malware payload (Mirai)", "value": "4f20e47618107366e658097f6c85e223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403552, "uuid": "19a316f7-0dbe-4fb1-98a7-9a7bc9e41790", "comment": "Malware payload (Mirai)", "value": "3d900d831d5f3d81e5f72090ef0b1f32b0c09625616a467eb47b328b7cc9fe72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403552, "uuid": "98c09f9d-41cb-4d22-bfcc-a76e351ba11f", "comment": "Malware payload (Mirai)", "value": "fa3c2ce61ebc00ca85b6a7f068557bd25d4d421e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403552, "uuid": "35280fb7-cf70-4c83-abaf-9281c7ca2138", "comment": "Malware payload (Mirai)", "value": "2af0f06be69c9982b1c600f44ac6b81a187147ae417792d81693b547f54d1b295e9fd884f62acf722e9e94f90d28dfc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403552, "uuid": "22d04c1f-8a93-4cf1-bfb1-a6446990c739", "value": "T1CEC35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403552, "uuid": "9ddba977-0aec-449e-996b-af62fc0cf003", "value": "1536:UrAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3j:UEFmSmviqS1Bs0+Nd6lAqktNMxSNbmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403552, "uuid": "4a93b8d1-2d3a-4480-97c0-0413b9cc8e39", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403552, "uuid": "66d1705a-cb19-4534-8a1f-a52c3c252ac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403552, "uuid": "06c4dbf2-06e9-41c1-a450-66bc705becdd", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434d23c8-4336-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777403576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403576, "uuid": "a0cefda0-aab4-4853-b9d4-2bd04c1e4b1f", "comment": "Malware payload (ConnectWise)", "value": "84e46b0c01abdd234ef23d8df26ff18a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403576, "uuid": "98b81a95-a002-4ba3-bd3d-610ed339e59b", "comment": "Malware payload (ConnectWise)", "value": "3df446c606624c934a02b105bb7d96f6f9b0d25fa5a6ef233eea1f254bd8ac2b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403576, "uuid": "d2114a4e-0033-4569-9369-41d1796cd0dc", "comment": "Malware payload (ConnectWise)", "value": "70d2d370f4df326f8636af1ae044bf67f5431005", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403576, "uuid": "d66ed124-4c0c-4791-937f-3710d99f1030", "comment": "Malware payload (ConnectWise)", "value": "1ff67de19dc6aabceeff2f098ad16173df51008413b70e721252415dfdf9e1c8f7ddd0018b7247ae216a5a638c0da5c6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403576, "uuid": "51502049-a233-40e0-bd49-572df393e7a0", "value": "T1AD46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403576, "uuid": "654648f9-c502-4522-b8ed-93ddf64b22c7", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403576, "uuid": "a4286317-a7c0-4732-b9c6-ab7b1fefa5b1", "value": "98304:RzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:RhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403576, "uuid": "30efe9df-adae-4f84-aa5c-b9ffe3dff59b", "value": 5643352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403576, "uuid": "e9ef20a6-0e90-464b-a1d3-1ca81533f92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403576, "uuid": "91b89507-6cfa-4b43-ad2e-2ea088678f00", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718fe570-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355120, "uuid": "4dd993b1-19b6-4131-9d54-944fdbdaa612", "comment": "Malware payload", "value": "4573f52c691a5cda71410f24dc9100e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355120, "uuid": "e3f1a860-4499-4981-9c0c-f6181d1118b6", "comment": "Malware payload", "value": "3e1f3a8608c33949b1fe2dcd1e61bdb6f364eb668bbadc2a149f63c2b85c2801", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355120, "uuid": "b4e16efe-f665-4385-9563-089b957e6d47", "comment": "Malware payload", "value": "243bd941964da3e1c02436942d5bb5aa6281e0b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355120, "uuid": "781443e8-1d7b-44c5-ab2e-3e9727438b21", "comment": "Malware payload", "value": "2ac685b57c8b64bb5863d141202402e87a9110e6daf9aa611a914c570ccc9ce812219e48063057f8b13b456260ee7d28", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355120, "uuid": "b6ef325c-e11d-41af-b828-5b7f7d12f659", "value": "T1DF37234306B58F7F8AB8006C9D6F0849E7D406A0D8B3EB5F631ED4A78DD6896510BE3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355120, "uuid": "3ddf8f4e-6647-4eba-aebf-1b106cc92aed", "value": "49152:JEeEvEBEVEeEIEBE4ETELEKERKnxacSOlE3EpE0EgE0KnxacSO8EKEkEZE7EzEXZ:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355120, "uuid": "fde4d8e4-a61e-4fa0-b00f-dc666c9c85ff", "value": 22903920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355120, "uuid": "eb2c2ad5-c83c-4289-ade1-7779bca0ad75", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355120, "uuid": "45733bc2-d1e7-41f9-b89f-f912369ffc28", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9df1084-42d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777360798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360798, "uuid": "d234dbcb-5a11-44e7-925d-7f115759f9ec", "comment": "Malware payload (Mirai)", "value": "8f3f9cbb1dbc70aaa53da9b758a8f6f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360798, "uuid": "29a0e6f1-a8d3-49ed-9e41-50a1a5d7a536", "comment": "Malware payload (Mirai)", "value": "3ecf1508d1bb9a2c4fd1759dc36ca94b02b99247472eefa1b90fd534a89e0f8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360798, "uuid": "b7e00d68-f578-469b-8f6d-f719e9d4f47f", "comment": "Malware payload (Mirai)", "value": "7586008ec895bf91133596bdfe919bca30227084", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360798, "uuid": "09f8e343-858d-409a-b402-d20bfad44c60", "comment": "Malware payload (Mirai)", "value": "468e20fe691a9f36848e0f7ddfbe34770009feca120c1946c5c7ba3b443ef68f39f66db77bf99bd2780578d716d01ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777360798, "uuid": "1502036c-1504-44b0-809b-d4a7b571ded6", "value": "T16493B30ABF740FF7E86FDD3749A92709158C650A22E97B357930D858F24B26F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777360798, "uuid": "78e03526-912d-417b-b283-e385fc0a3ece", "value": "1536:zahaNVXM/WLJR1jzYvXI2I3Lk/0B/BXsZiaBLTe:zahGVEWj1/Mp2TXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777360798, "uuid": "4bd455a4-b765-4e18-be22-8b2749fe064e", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777360798, "uuid": "f31d41fa-8a1a-4c7b-b602-0c595d272cd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777360798, "uuid": "e1662933-4ef3-433a-8b34-2c050ce3ec64", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8b02a7-433a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777405609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405609, "uuid": "a6f45246-bc98-4b9f-873b-b98167aab346", "comment": "Malware payload", "value": "79090f6a4cac4b71ccb218f1c5b73618", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405609, "uuid": "93ff7815-3b97-445f-85fe-07af6a762cff", "comment": "Malware payload", "value": "3efc1f87e3f0566daef895ddccf21dff9eb70fbea17ec7d60ba7fdceb35c1b5c", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405609, "uuid": "51212381-c07d-4a54-bedd-91e61125cfc0", "comment": "Malware payload", "value": "700cfa69f775d0b5547ef20e46d632d1dfe04199", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405609, "uuid": "a759cf29-0e16-4911-864d-d2048d019cfd", "comment": "Malware payload", "value": "27fbb93f450516a2f37f7f165ba22e803a28189e19efaedcbc4d21bb7a1a0568703c3540d4a78294790b67504b4f5fa0", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405609, "uuid": "a7860bc0-57bb-492e-97ac-b8b6f4432938", "value": "T136E58D07BCA515F6C0AEA23289629196BB61BC481F3123DB2E90B7783FB3BD45D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405609, "uuid": "243fbc7e-717f-48f7-81c1-35e877c0c7d9", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405609, "uuid": "86c58d82-a99a-4f47-8348-8dfe5759f82a", "value": "49152:GrapJOCXmbaDQAsezwK/g2IjYoyZZ00EFQbrQJWi:GrQwCWi7V1nbrQwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777405609, "uuid": "7718f944-c230-48be-b491-0bd61ab256bf", "value": 3063296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777405609, "uuid": "a1d03a9b-b036-4cca-a9f6-3ce84435a5f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405609, "uuid": "fbf4cc53-fe26-4b7b-bc6e-873f29ec63e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5d6445-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355217, "uuid": "c9bc8088-95c9-42fa-b01b-1632d99133cc", "comment": "Malware payload", "value": "56dd542816f27b04366369d08ea503d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355217, "uuid": "01e4c13a-ac09-4f7d-9ffa-3ed339950c6d", "comment": "Malware payload", "value": "401341e54ba57176373c116017b3c526aa94754ae005409cd3ad9e17d16082d8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355217, "uuid": "59b525bc-dd4c-4add-bab8-11bea6fe2142", "comment": "Malware payload", "value": "8bf904491f7d09a96c7eb1f04beadb05c9e332cb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355217, "uuid": "a4cdafce-1338-494e-a058-38db8302313f", "comment": "Malware payload", "value": "5330ea0e4d33531b3674c5e02eb293e6086e9c8cefc637a0bc8f32d55dff617d307adc557e69ed2544f59ce58d1a34b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355217, "uuid": "dcff3ea8-01fe-4452-ac0f-8f9721eeae79", "value": "T1AF37234E1F2D6B1F6AB516C8086E0E8F1EE68E2C0402985F6F76B5CE770DE54341B6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355217, "uuid": "eaa50267-8e42-4c23-870b-255cb02542c0", "value": "49152:NChfEuChfE7ChfEmChfESChfElChfETChfEvChfEoChfEgChfE1ChfEWChfER7G1:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355217, "uuid": "3d26147f-2be3-4a0c-aff3-e92d992c716d", "value": 23424201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355217, "uuid": "04e0cf70-b44a-4293-9d6e-502d51891c95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355217, "uuid": "a0c42e64-d498-4e5e-9946-fe8afafbbf69", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7370d6f7-42db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364572, "uuid": "d2e845e6-9e5c-496d-844f-c59dee7a1dbd", "comment": "Malware payload (Mirai)", "value": "bc5ebdde1053d9c3a0220ae7e1831a18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364572, "uuid": "cb3e098e-2655-4d52-add7-de5f79a69db1", "comment": "Malware payload (Mirai)", "value": "40b7c4227235062b1b5d8a3976a8cfd2e7a2783776446a5adfbc35344945d240", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364572, "uuid": "b82caa59-be9b-4db9-95ac-08a46780ce96", "comment": "Malware payload (Mirai)", "value": "baa15a3848725f90db311c6740649dfc1ca5fa79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364572, "uuid": "615a656d-5307-4f9b-b7bb-708f5685c6d6", "comment": "Malware payload (Mirai)", "value": "dc34d77a8ff55dae2acf290c2779986cd2db7c933f8d84ed3e8ad9b1d0117dd4dbd65dd31227330df64c14dbdd597ded", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364572, "uuid": "6b57c250-cb10-4b7f-8972-49ff3c9ece58", "value": "T188B30946A9829B11D4C631FAFBAF414933136F78E3FA7111D9206F6023C69DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364572, "uuid": "75a06544-8657-49d2-8aa2-78e7f1196234", "value": "3072:ZqiiNqVMpOFngfG/7/01ZYzG+nlOallbhVzzN+WZQfvZ40octrJf:ZqiJXdge/7/01ZYzG6lOallbhVN+WZQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364572, "uuid": "33e4a568-fe2d-4679-8460-3d2eebe13fc1", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364572, "uuid": "e143f55d-b575-47f4-aacc-6d59829899bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364572, "uuid": "52c087e4-195b-4186-8c4c-f1dce077ea97", "value": "SecuriteInfo.com.Linux.Mirai.9838.12116.21947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb50eff-4335-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777403273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403273, "uuid": "581c356a-87a3-4dde-acbd-ec1bf138e0fb", "comment": "Malware payload", "value": "3540158c8ae718c5d2cba8f8ad229512", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403273, "uuid": "fe68f0fb-56c8-46ca-9896-0e5406b62e0f", "comment": "Malware payload", "value": "422cfc56f2d87c4456f91dd8932b3773ef88828f06c66bab938648a0b3ac2dc2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403273, "uuid": "bb6dc153-1aee-4c17-bcfc-40235c7e52bf", "comment": "Malware payload", "value": "fc0ac92021961c63cae1dccef5e38eb34fa946be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403273, "uuid": "0373ef95-f507-41b1-b29d-78d3744cd63f", "comment": "Malware payload", "value": "0ddc4d0c2b614ad346690cfdb39f75301939c5746672bc01c75ae8a2f355ec503cefe9cc8c7349fd1dc5586715df4af4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403273, "uuid": "f51170ab-210f-4e41-9cf6-b724c5a62a64", "value": "T1E0318CC990E155766DE4E847726FCC1D300A798E18CA5F89ACCC38BA9CCCD45F160B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403273, "uuid": "ffe422be-0277-4e90-9a73-0c6a906f8427", "value": "24:sF+RhvEfPletE8eAp3ZtRFI5M+M+zV/XHfdJbOR:eEGXleBFphFqMBSVvHVJSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403273, "uuid": "82926eec-e6d6-47d0-8d40-d0cbece69d54", "value": 1505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403273, "uuid": "de0ce504-2cc8-43d2-a306-077af17bae71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403273, "uuid": "f869283f-c365-4026-a848-c3fb69daf25a", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e49068a-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355544, "uuid": "a17989d3-cfeb-4cc7-8946-8ec66118dfcf", "comment": "Malware payload", "value": "cbe2208516498e60e0f1845169845eb1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355544, "uuid": "18db876f-f603-4c6c-9c9d-9b7e7373e43d", "comment": "Malware payload", "value": "4294abca81307032be29f159d6c96bd8720f782615f3d7a48ed63bb077715dd8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355544, "uuid": "fab0281f-7468-4637-8604-4b68d522a6b1", "comment": "Malware payload", "value": "eafa8c9b4a6044e2a7297ecfb9a5f5d94cec3ce5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355544, "uuid": "849ca8f8-74f6-47f3-8cff-764b3aa28a8f", "comment": "Malware payload", "value": "51c79c720f46935fe7f665dd8e524b969af692b2b30d17316f87a5e2295e2648add3c4b0bbfeeed6668b1141e9602891", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355544, "uuid": "85666701-fdb0-4937-84a3-ec5e3584a92a", "value": "T10994CC38ABFE4019F1F39F54AEF46496996FBF632A0E885C1090024E4632945EDE573F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355544, "uuid": "6c7b7650-972a-4089-947e-bc4786483b7a", "value": "12288:1l3ogMg3aZDIfFnXSwmxbIufYjSrhYzD/l05rj:DN4a0rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355544, "uuid": "fe02639e-c909-4b79-8da7-1673c77bef30", "value": 444186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355544, "uuid": "98c94d60-078a-4248-93d5-71222af84e72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355544, "uuid": "4f979657-7caa-4b73-b609-e7e22ae2ecc7", "value": "PI_PO71597329501_Caspian.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bc5924-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403437, "uuid": "edffe9e7-3f2a-410b-8331-7037890e3010", "comment": "Malware payload (Mirai)", "value": "d5ea136d0de210cedbfc0e558b646e49", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403437, "uuid": "7bd8acc5-0ef7-462d-8987-54c1c29ad27a", "comment": "Malware payload (Mirai)", "value": "44179426f871b754f4c61ab5dadad34bb4821bd240866ea1a256535d29d1bf28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403437, "uuid": "121a8574-2d6d-40b3-bd5a-9ea95ad8576a", "comment": "Malware payload (Mirai)", "value": "0ff7511e84cfafc429f5b6177f8dead3767f2385", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403437, "uuid": "575af8eb-4833-43ce-9ecf-1284a17941fc", "comment": "Malware payload (Mirai)", "value": "52d80778dd6e722c1b231dbe43e391edea4cff563cfdee51792accf15a0e75e0cd794c33b324a07b818e69b9df389fa2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403437, "uuid": "699ca767-3e54-45ca-8553-25cca20b2b72", "value": "T190E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403437, "uuid": "24be6988-106d-4373-960a-5036251fea4b", "value": "1536:p+fTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxNdbK:pYlybKpzEOfGQ+vEubTt4ouftL4hdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403437, "uuid": "2ae7ef9a-c534-4ff7-bc6f-26e7fd2cdb6d", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403437, "uuid": "95247f64-2add-45ab-96d7-f8226222bcda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403437, "uuid": "63ef641e-6f95-4a6d-845f-2f55fe5d5f34", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028e927a-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389294, "uuid": "ad33e516-6994-4799-9ff9-a580efa52024", "comment": "Malware payload (AsyncRAT)", "value": "103f5cfef73062b6edc39ffc3e1f2038", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389294, "uuid": "0c35dda2-bcf9-40b0-8ce9-214bd6588508", "comment": "Malware payload (AsyncRAT)", "value": "44448fe3da8fb987dc5cffefe2002dfeaa6e592a908198d518d5f7bd53a7341e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389294, "uuid": "7d954628-b633-40e8-8d05-ae590e1256ea", "comment": "Malware payload (AsyncRAT)", "value": "d3d32af2d57ef588fc7665f84e3e416d6bc7417d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389294, "uuid": "db371ebf-7f2c-47c2-b0da-bac71307a566", "comment": "Malware payload (AsyncRAT)", "value": "644ec9c0415a025a26594274e5e10f5d3f9829868da4646ab734b9e444a1faa287602afcbbeeb0438f77f0043bb255c7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389294, "uuid": "44853d5f-0587-4589-b1fa-ffd62edaf46e", "value": "T1511339007BFC1625F2FE4FBCA87952454276F9639932C34E1CC4519E1AA27C0AA91FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389294, "uuid": "48137cea-22ca-4144-86aa-443dcd12bb00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389294, "uuid": "a96915d9-e4c5-4cd3-8dc0-c57609191cdb", "value": "768:Nq7x+GTU+nnIRgqYSnPPEz6IXSvSRCfPuRbheuoVNtpmLv6D+:IU+LSPPLIiqQXuRbguINeLv6D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389294, "uuid": "6a9c600c-c7d5-4b98-8237-693935ba66d5", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389294, "uuid": "4fd33c29-8ffc-4c83-b42d-c293b4c021fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389294, "uuid": "c32b9fce-478b-482c-bacb-040cdd3e84ab", "value": "44448fe3da8fb987dc5cffefe2002dfeaa6e592a908198d518d5f7bd53a7341e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555feef5-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355502, "uuid": "2fcf4fde-ccab-4d7b-9e85-ee7d35e77a02", "comment": "Malware payload", "value": "85ae23b1b28ae2e105c24460055905dc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355502, "uuid": "7a9d01b8-f90f-4734-8c24-140605af9e86", "comment": "Malware payload", "value": "444812fa826f8d48cc948b7bfc521094ffba8327e88de46502800ba991914ebf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355502, "uuid": "01169401-89fa-4a08-945c-9813cb407345", "comment": "Malware payload", "value": "318b591925a2685656f8fe4ad9b52cdbf3dacc8c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355502, "uuid": "8762c07a-5076-4ee1-b7aa-de6c75911cf5", "comment": "Malware payload", "value": "a5111a52ecef9ff6fd53704443bf0df8c348781becc3d34362058ad7ed0f5e812bb1b10d229fc852a4ac47446b2b2838", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355502, "uuid": "3f594e5e-6077-4117-aa4a-dd5aeeedae13", "value": "T1F93723959F0EEC7F5694378C68E6874E07E4EE84855CD29CA39FB309989EC49004F4BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355502, "uuid": "d5c9dc19-d7ba-45cd-bce4-9dfc7b7423c8", "value": "49152:CCU1AS4evHEF3cYXD3sddBuMBkvHqfF+2b2BGn0w+am6bLAsIS8dSPo0QoUo47d2:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355502, "uuid": "f6cc9a7a-042c-47d9-959d-5d8dcd94eff8", "value": 23424201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355502, "uuid": "68d093bd-da16-4233-9c3f-ba66210fbdb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355502, "uuid": "209be0ee-b1a3-4dd2-a735-bc61d19fef2b", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76f6d5a-42ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777372041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372041, "uuid": "44f71d63-0c99-4693-9ea6-939e55a51f72", "comment": "Malware payload", "value": "7c6e4a085b1fd9b98407ba4400f91201", "object_relation": "md5", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372041, "uuid": "486b9c39-4e64-4d07-ad2f-71deb93a2100", "comment": "Malware payload", "value": "45c8cbaeb5c7708e7b8030e701747c65203958e82eddc41f39e0ca93bd36c114", "object_relation": "sha256", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372041, "uuid": "8364bf73-783a-4ca2-8972-d44fd3e4eddb", "comment": "Malware payload", "value": "39b3b4bb7a1b45cc155e0f8a7149df393e98b2b6", "object_relation": "sha1", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372041, "uuid": "4f981771-96aa-4494-ad70-32f0ada83ebb", "comment": "Malware payload", "value": "8e64fcd54a4b6483ac730d97c27d9f7e0211dbf11a5b337d658b298577b08161e0eab6ecefdb47bed6125b0bc2c8ffcf", "object_relation": "sha3-384", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372041, "uuid": "abae36bf-2f7c-4041-a1b9-9e82829e8c76", "value": "T10B06293BD66244ACC1A7C134DF97D2B2AE31BC1C02F4756F2684DBE03E56E20775AA94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372041, "uuid": "047c9eb4-afd3-4f8a-9caa-e5a196f08363", "value": "1e381804ad46422a5f02967a71e78210", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372041, "uuid": "1e2afe63-5cf1-4513-84a1-150122e98f25", "value": "49152:CTQ3/paP7NsgipvA0F892cWN6yGItk1pQgn5e0QU7UO9Jb:CTQmpU2A6yU1pQgn5v9Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777372041, "uuid": "35b0041e-d64a-4319-bfc8-7addbd169c12", "value": 3977216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777372041, "uuid": "74a17439-e94a-4aa3-b219-5559a32315fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372041, "uuid": "93bfe0ee-67e0-4a0e-b925-b7e70147370d", "value": "mscomer.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f093ff8-434e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777414011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414011, "uuid": "e5857ad9-c15c-4075-8472-79190a8b46f9", "comment": "Malware payload", "value": "cfc393cdfe6230d6da48ca0478a667c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414011, "uuid": "120914d4-4f98-4daf-9000-46d29b6bd46d", "comment": "Malware payload", "value": "46d295ecbbe0d932ee5402838c3383b9a8c9fac2261d9abdfbe14f71ec4c16bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414011, "uuid": "1e121eb8-59f5-45c4-898c-e1fd28268926", "comment": "Malware payload", "value": "9943979ae0c1392d7d6b964b8df9ec9cf8e8685e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414011, "uuid": "fe069504-9659-43ca-bcec-e6a8a89cacd7", "comment": "Malware payload", "value": "0184bad89bec2ec38a9da4778c9db6ae5ecfc5f01029516eef9c9b7479a7569e7deba4041c62c9f765b0907db252329f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414011, "uuid": "dbfb2b9e-7d2e-4ed5-a259-a08cdd6d176b", "value": "T15843F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414011, "uuid": "77ea8c9e-ba52-4c76-80e5-754cb9c60874", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfzV:5AG8nY5BZG2xxmLQLS/S7hHnQfzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777414011, "uuid": "8ab20769-fb30-4703-b71f-3ba83e38db12", "value": 59611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777414011, "uuid": "f813d579-abb0-4c0d-b0f5-c9b96bb1069e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414011, "uuid": "c8c6ed32-bbe4-4ca9-8a9f-0fea14323de6", "value": "motd-news", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738c7e12-42d6-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777362425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362425, "uuid": "0f032b0d-9080-472c-b220-e045be4f5984", "comment": "Malware payload (CoinMiner)", "value": "6447a0e5ffa9258fa5f3d27d240dd2c1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362425, "uuid": "b2f3d2ab-4750-4a8c-a8cc-5ce67b89e6ca", "comment": "Malware payload (CoinMiner)", "value": "47ef2cfe353b76b935cc4ff6e1648b5d856b3a3bb5610444798909fd306acb4e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362425, "uuid": "42808f7f-1707-471c-abc3-cfd3b2320852", "comment": "Malware payload (CoinMiner)", "value": "209a44ab3048ef294c926da03a60c97812a5c85b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362425, "uuid": "51bf746c-cee5-4920-86fd-7b00d3a8d2a2", "comment": "Malware payload (CoinMiner)", "value": "2d70c8cec8422c4e53554a39e48b6f3aa214fe6b2696f98bc93b5ffe5f067ce7c748b449817151d222408647728a10d0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362425, "uuid": "ca8d196d-fe27-4dac-ba3e-cbd0dacbe0ce", "value": "T1FE32191D7E490332E3A489B41879824B517C6223E793E3EFF7339A5A5A963448840DBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362425, "uuid": "777f8bc1-e86f-4782-a7a8-18bfb3cb50bc", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362425, "uuid": "75553d9f-f770-4f3a-bb6a-c0a7294155c3", "value": "192:H794so2WPxTBjx+e3yzDQPFJxTEZmFhS2cVRpE:bRotxFw2PFwZfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777362425, "uuid": "250b14d2-7a01-46f8-8257-d3f372d2b3c3", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777362425, "uuid": "1421b3df-89b1-4508-a6d7-8362e8519e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362425, "uuid": "4882f170-0fa2-428e-892c-0dc9129dad66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7259974b-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777365000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365000, "uuid": "f54c0370-6fd9-4760-8713-0ff7646614eb", "comment": "Malware payload (Mirai)", "value": "e38eb25f9d0a538f8a81e1efaa446663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365000, "uuid": "9495e663-6184-4570-b256-78e9aff90908", "comment": "Malware payload (Mirai)", "value": "496d0ea58eece2fdd1f18e5f34303623d2cf2d14f9831a8f09599cbb6008c16e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365000, "uuid": "0e699197-a0ba-4d1d-98cb-f86a74deeded", "comment": "Malware payload (Mirai)", "value": "3b494d44515bc71426f6f1182146f751a6fad790", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365000, "uuid": "3a40764f-c8e2-4936-b749-abfdd48e38d9", "comment": "Malware payload (Mirai)", "value": "d02de5840c4e8360412317734771cfaa27d617fc3c49f129143ddb6969c4016667e5d851c6259bbf0028bf01d053398f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365000, "uuid": "f348221c-cbce-4d0a-ac19-d1a95692e644", "value": "T130A30987F901DE7FF80BE6BA449309197520FA660E530B76A367FD93AD320D41926F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365000, "uuid": "fd8ed00d-9498-421b-9f84-77060b5ded11", "value": "3072:vy7CzoH1dP0eEdSNqopUj40Ask+hio5Qh1:f/eEdAZ0Ask+tQh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365000, "uuid": "35353eb5-4cb6-4fe0-8528-e8322802689c", "value": 99672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365000, "uuid": "d3c403e0-4dfb-4136-83b0-c5e426278a9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365000, "uuid": "b907a7c7-e5fa-4441-b604-8c604c146749", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e10b32-42ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777379986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379986, "uuid": "289d55d7-907c-457e-83c4-4a5a12232b32", "comment": "Malware payload", "value": "6354ba2ebda813b01fefa536441e68a3", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379986, "uuid": "412768cb-6497-4854-8646-9a8fb8d38d27", "comment": "Malware payload", "value": "4a85069edbc8f1c91072e284d7d7160dfde9331ecdb6fe62e52cce82e5346b9e", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379986, "uuid": "72eaec10-168c-4135-81d5-2b5e131480eb", "comment": "Malware payload", "value": "db7f38b0e2f8d2fd531d25bee5ba97f0cd86fcff", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379986, "uuid": "292e33e3-8200-4766-a6f5-32f8d10d04bb", "comment": "Malware payload", "value": "ed4db64fd59ec69e09282ffe5af2bcb52ac7c284e0a139a7e21ca3bdc57e027beab4e4008aafe225d10a0370bef80fe6", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379986, "uuid": "61d934e8-09d7-4399-bcf8-27a09de43932", "value": "T1E25533CB9E27F3DFA96E439C4251866C095D8B4648633F2F181DC2D2496B326CE12F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379986, "uuid": "1a641da1-bb16-4704-9823-26f9dfa62ae1", "value": "24576:+3oZecyB0BMR1Zg8bj1Y0wYLrGG6JXqRNL4TI9RFjitEAO0mxK6yYm:M4ryB0BMNf16gNYaRovVR6yYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777379986, "uuid": "fffaf2e7-aa78-4ddb-b394-801e9501a944", "value": 1294989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777379986, "uuid": "8ab8ce8b-fb9e-4462-81f2-882b21184c5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379986, "uuid": "e83edfb9-922f-429f-b74f-e63c1c892e4f", "value": "halfmillion-iq.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c526b5-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777365088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365088, "uuid": "1ed45b18-595f-4741-8802-490734243ccb", "comment": "Malware payload (Mirai)", "value": "3da08d303877b14f2ea936c438f21736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365088, "uuid": "27932a2c-c59d-492f-a2e0-9edc3232e3cb", "comment": "Malware payload (Mirai)", "value": "4bb88283016c6f096cf8adcef1b2bd25be3e716bcfaab2ea77eac46758059363", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365088, "uuid": "15e85829-55f2-4c8d-a53d-fb1d2e7b86d2", "comment": "Malware payload (Mirai)", "value": "ee7033ebb4ecc7d6d0a5994d3068860026b32579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365088, "uuid": "16f6b6fc-3400-4eee-af04-fde07e2d4d48", "comment": "Malware payload (Mirai)", "value": "b918bbd07a0ae50a46b2fe9100a05d6495caa6e401c8f6a07be710ceb65851af6b53a7ffd06e55f846a626444355aae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365088, "uuid": "2b3dc33e-0265-44ae-947c-91e6880ac605", "value": "T1B593190377080F47D06329F426BB5BF087AABD6518F5A284751AFEC99370EF26046F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365088, "uuid": "906ab40f-481e-44bd-a700-5431ff6ea700", "value": "1536:WLsO0DysRhf6YgKy/nDSDWd7tvGPhj4Lq6fdVqrgFdnrLOPF1NY:WePRIYQqSQPiVqr8r+jY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365088, "uuid": "ce1b8157-ffea-4f07-88ea-ad47e32013ed", "value": 88796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365088, "uuid": "88f91054-3633-4ac8-bbc9-81a691260c76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365088, "uuid": "ca878450-e481-4c3b-8231-cd5badc49e62", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a94d046-4345-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777409923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409923, "uuid": "6e49f47e-31db-4bd7-93ef-379ca26f9b29", "comment": "Malware payload", "value": "4eaa63980778c4f2620f0d2fe494dd42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409923, "uuid": "5d1ddea6-0b4d-4b4e-96eb-d1557d1ce76d", "comment": "Malware payload", "value": "4bc0b413120dd998090e2087fcc49b1e2972693ad90f227ca48d4fd94e9fddf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409923, "uuid": "03e2a8c4-023e-4d6d-87ff-06a61a41cd6f", "comment": "Malware payload", "value": "bd70be5ebe14c663683ab7a2c29351cfb6cf31ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409923, "uuid": "8fb71f84-b40a-4c16-ae09-e534215c129b", "comment": "Malware payload", "value": "f420e642ae0dcc5363d0b3ce55756151c510b524db77ecabf30ee21bfc663817db3eb3e3d045c9d70d3f6d372b2a6149", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777409923, "uuid": "aa12c130-4d7d-474f-9754-2abb7420c3bd", "value": "T17FF7331865788352FA8A3C7224E7B432EB5DBD5649B06C0C7D5C80F0A6E2B51A7FC763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777409923, "uuid": "1b58b45d-d355-48fc-9e99-7901af4abd6d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777409923, "uuid": "fde75c7b-d9f5-4a76-8c86-369c170671a7", "value": "1572864:Et9IKPqu+va/OfyTD6O20sXrUNUPT5Uv0pGXyevfAp7:EUKF+vtfmg0erUNUPT5UvujevfAp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777409923, "uuid": "8fef3a1b-f061-4fc2-96ba-2b3bdea1c28b", "value": 77103819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777409923, "uuid": "426c34b9-7910-4857-a679-032f946d8340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777409923, "uuid": "81400243-c9a3-451e-b386-59c999b99117", "value": "Setup-Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e95cbb4-42cf-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777359491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359491, "uuid": "73447ba8-0046-4b77-89c7-776adf205199", "comment": "Malware payload (WeedHack)", "value": "aaeda2da6be59cce92efbd199532adb0", "object_relation": "md5", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359491, "uuid": "0cfad7e1-0034-4f2c-99e1-d52f7dfb33e3", "comment": "Malware payload (WeedHack)", "value": "4ca7ca5b39a0ccd6075520932154ac6acf5f5159871d764b24fadab35488b997", "object_relation": "sha256", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359491, "uuid": "40fdd82c-0c74-478c-9588-a0e7822068c5", "comment": "Malware payload (WeedHack)", "value": "e1c2e4759a79da756b2b5d3e1d2bcbc60fa574ce", "object_relation": "sha1", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359491, "uuid": "fc2f344e-ef58-4884-8c3a-cfe960f86b85", "comment": "Malware payload (WeedHack)", "value": "9e023ef24a89c0504a11aa9f8596bc8cbc1f6dd7111a8be1b20209384060baf0a57830480b94d483621bab891079ba51", "object_relation": "sha3-384", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359491, "uuid": "8b2e04c1-f206-40e3-a4b7-499bd0be8f96", "value": "T163D302DAF5D12DF2D08205BF6629B8E851F77C54E24C7D4CBC07AA64CD812A3B5E708A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359491, "uuid": "45aee234-ea51-4990-8421-fb96010a7290", "value": "3072:xIEW4aLyhtDkE/wfbrR7WjtV+GTTNw7hRAVbjnWcATWFbWnM:xIwaeh6LjMbzoDAVPWcwCSnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359491, "uuid": "cc240c5a-eaf5-4e25-9a34-dac5aa5a4bc1", "value": 142744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359491, "uuid": "0278d407-9495-4eb0-bc31-dd1916b23518", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359491, "uuid": "7e4ef042-753d-4116-8e1f-c43541d97e7d", "value": "BBVA_Transfer_Receipt.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0921c47f-433d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777406485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777406485, "uuid": "282b0610-8488-4d04-9884-5f88c429b9f4", "comment": "Malware payload (Mirai)", "value": "3a23f3c5ea1e635f258fdaabd904d317", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777406485, "uuid": "e96be9f7-dd5b-4607-981f-76d252f077d8", "comment": "Malware payload (Mirai)", "value": "4cd3d067ce83314f1c632da40b22a112dfd3556d3eb792a325a1676412fa498c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777406485, "uuid": "37394337-4479-4d15-a921-779c83aa6921", "comment": "Malware payload (Mirai)", "value": "83ce5246620ff195a6953d12f12c3461af371fb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777406485, "uuid": "c5381f24-f8b0-4be4-88fa-e12bbc53547d", "comment": "Malware payload (Mirai)", "value": "c0f49f74a35309264cf0d2bc44d80872450ea42344a921bacaf3d9f043b098bc94a15651ff8b8267c681dd94982b199b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777406485, "uuid": "db4fed5b-3123-4e12-a02c-444ba26f048c", "value": "T198A3E60BEF500EFBD82FCE3706AD1B1625CC554622B87B7A3674C928F61A54B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777406485, "uuid": "a6d63353-24d4-458a-b926-4425848c6ed7", "value": "1536:Qgjg/fcU8RvTyC0tokHZCOn9E1BEcEq7OjNPVO3cVmOaKbQS:ZhTethpY/3cmjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777406485, "uuid": "0c436d37-d50e-4f2a-b8c6-4577348889e8", "value": 101352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777406485, "uuid": "73d35a40-2542-40e9-9473-fc7047eebc0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777406485, "uuid": "63d30431-f01f-4e40-ae3c-d74ea82baf48", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb01296-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355223, "uuid": "5e520ea6-50b9-4ae1-a694-3096c3bc7a54", "comment": "Malware payload", "value": "12f64afa6b24379d3a5411de651be796", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355223, "uuid": "5cc47418-cf2e-44c3-a4d1-492380131359", "comment": "Malware payload", "value": "4d363ea47f116235e4ec342a7e330d107cd0da54b5cbea766c5e88ca32465678", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355223, "uuid": "71946d91-2ac3-4db0-9010-9a624ec911cb", "comment": "Malware payload", "value": "dba4b3d3310868767f85ee0829e0324bbbe2f7c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355223, "uuid": "1f46d278-c0b5-4c55-85a4-005e20ee8b97", "comment": "Malware payload", "value": "451905907b4d3fff74e27ee13b4b8b1d71bf994012bc760bffea75d976e9a40bf5ae9c5fc48fae2cd9b4ba169f826748", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355223, "uuid": "623e6686-1f51-49c1-9fb1-ab62d56bf788", "value": "T1813723334EB81EDB8D4D3194A42B165FB1E09E496A1CC3897B3ED1CAF27FE1504671A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355223, "uuid": "56b05706-6ee4-4a4f-af97-401790263b23", "value": "49152:HEfESEBEBECEYEEEFEjE6E/EeLQ1EeERE9EJE2LQwEQEqEsEFE5EiEVEdEUErErV:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355223, "uuid": "221c6194-a344-4414-a645-d3c1ea9bf657", "value": 23684349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355223, "uuid": "d8e914ea-d216-4a33-91e2-a1db893f636c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355223, "uuid": "8e53852e-1fe4-4a40-82c4-765a3c523c29", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec3aa6d-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364994, "uuid": "03732b1f-3f25-4cc6-a05a-3c47d25db39d", "comment": "Malware payload (Mirai)", "value": "1190d3fed880185c5e79a5f780a5029b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364994, "uuid": "5437ec28-bcff-4e61-81ba-634451a01668", "comment": "Malware payload (Mirai)", "value": "4d8151294717d58bf2ecf2b1ee7fb091778d4017e3594c61d09abc85d36e128c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364994, "uuid": "96643420-2de8-4380-9a5c-fea34a217535", "comment": "Malware payload (Mirai)", "value": "caa5c1ce8bcbc94a34d00f2424cd0ae9ad345dd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364994, "uuid": "876f4f74-d633-49a5-ae5f-ea5d24bed0d5", "comment": "Malware payload (Mirai)", "value": "75c8438cfcb05a28f3a0389c620ad5718d20b3245f95b856fecb22dfb4a5597e6206360b822205c4fedffbbf70f7b53e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364994, "uuid": "18e1146c-9b8d-4764-aeec-b6d234911dc4", "value": "T1C173299AF9819B11D5C115BAFF1E528D7313077CE3EE7222AE24AF24378756B0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364994, "uuid": "2cbb5277-6a5f-40a0-a902-1eacf94c1154", "value": "1536:ysniKN3aU8SJR4xF1IHiBsFWeT4a6STKC7lUmp5aY1caYZ:MMaHK1FWeT4a6STKCSmpwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364994, "uuid": "10ee300c-cfb6-492c-baa7-16a1ee891ada", "value": 75156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364994, "uuid": "f7ab26f7-8f1a-43e7-b3f7-989ce6a5c43d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364994, "uuid": "e293ec48-8538-4cf5-a55b-fffa3566918e", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac4dd45-42a2-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1777340023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340023, "uuid": "7165e4bf-c58a-4d94-a915-2d62a8ffe2fc", "comment": "Malware payload (EternalRocks)", "value": "8690998f78a8755606a5a12f4acdd19e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340023, "uuid": "8300a6ab-bb5e-4088-a7dc-8971d7d979d7", "comment": "Malware payload (EternalRocks)", "value": "4dc036218f6404f48f118140262ec1396d114922a938a77b7381f24217a54a43", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340023, "uuid": "72d7aa8e-5392-4cfe-bd0b-7bf09d510175", "comment": "Malware payload (EternalRocks)", "value": "43045c384cf6f3532b951217b483f9f67e6a4a75", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340023, "uuid": "18bad6a7-95ba-4a55-9660-5171626328b6", "comment": "Malware payload (EternalRocks)", "value": "53005febe037213822c35b225e95fb389552b076430cf054a6db64025046a667ccdc22c8fa64a167962c9a79f0e716d4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340023, "uuid": "c5ce7946-455d-4efc-8421-9551f11c291a", "value": "T1A0463312899E0E7D8BA89B3DF8FF8F0D069D4F058408956743C275E69B9EF50283B497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340023, "uuid": "1ca1791e-b501-4c08-9157-7fc43a85cb6c", "value": "49152:cBjAntQQdnsgR+KgttrmWXEFWjanroah0G3cIcGDQPXzsHZhvdMo5XLLxLY5Sigq:rZmIE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777340023, "uuid": "fae9d7ec-62bd-49a0-b724-b8ab2caf50f9", "value": 5548206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777340023, "uuid": "cbfeb987-4019-4f06-9f67-62b8c4b9d5c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340023, "uuid": "4e0e1688-d430-4553-b858-15219faa4c81", "value": "wscript_e267.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe5da4c-42d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777359681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359681, "uuid": "94c203ce-43af-4946-a0fa-b9b5bdfa9e7c", "comment": "Malware payload (Mirai)", "value": "7747f8ef1444bb394a64e8195ed48be7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359681, "uuid": "20adbf03-701c-4b84-a9f4-106d518bd548", "comment": "Malware payload (Mirai)", "value": "503cd4919b28522a8f5e8c6fd589e5ab4e914e3fa86cf77a7b057eb993f50ce6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359681, "uuid": "39d95a22-788a-4377-b574-b86bf589a88e", "comment": "Malware payload (Mirai)", "value": "3c8b47aabbe859f336bf24aa0b4418340403d54e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359681, "uuid": "b59d647e-ff2e-4e16-bae1-a54916f81a2e", "comment": "Malware payload (Mirai)", "value": "1301651b09922c665bfd25b04c58e00d52d581b61ff6f8ba31eb780a92fc186179dfa66a1e9e38c45320fc238ff4786b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359681, "uuid": "8096f9d5-1f8d-45a9-b503-7c0350d8bee1", "value": "T13DE34C46EA818F13C4D5177ABAAF01893332A75493DB73069D186FB43FC6B6E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359681, "uuid": "9cdbd09d-f0a3-486c-8fd6-93aff4532bd5", "value": "3072:qJs9NARj5/Icu+NGtKfS6XH9gM33kigvNO6bl7XgwxQK3OSLOfM/9JJLxh:qJs9NARj5/IctGtK66Xh0O6bl7XNQlSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359681, "uuid": "a79d65e8-a40a-4ceb-b50e-1c7e05cd38e7", "value": 146283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359681, "uuid": "de1da019-ab9a-470b-be6e-50190b496811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359681, "uuid": "357eb8b7-559c-4c38-8cd4-10af5f2c7135", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05032395-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389298, "uuid": "d1a2ac23-465d-4c11-aad6-3542aadf8604", "comment": "Malware payload (AsyncRAT)", "value": "7fd00852cf8867551f22046f8d2c6254", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389298, "uuid": "3fcdfd6a-56d3-49d5-84b2-f6e1d4872a95", "comment": "Malware payload (AsyncRAT)", "value": "504610a43ee4e0005e657e1657ecad590faf93de739d429f5cc9ea4360f0d1a2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389298, "uuid": "dc453713-f53f-48e8-ab90-26b763f37177", "comment": "Malware payload (AsyncRAT)", "value": "c8d0d613e325998725334fc591a51ede1be93e7a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389298, "uuid": "f82b2939-ac39-4bac-b62f-ad2459b4449b", "comment": "Malware payload (AsyncRAT)", "value": "c83819eaea5823db8149cb9001d5804b63d298e4d42e5c9ec62ca59fd6b4d7a51a88efc7ef98ef516cc884dc271ec09a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389298, "uuid": "f7eddca1-e197-4ea4-9e9f-d502fb3724a9", "value": "T10A1338047BFC1625F2FE4FBCA87951444236F9679932C74E1CC4509E1AE27C1AA91FE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389298, "uuid": "9572a2d1-0219-40b8-965d-949009d2d655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389298, "uuid": "26e5ec01-6dd9-40d4-913c-b9b32014fd64", "value": "768:aq7x+WP+dKnjIR0tYenLHG2RvSvSRCfXuRbheuoVNt20LvWD+:l+dKOeLHLRqqQPuRbguINJLvWD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389298, "uuid": "1e1eeab0-214b-43c8-b988-a3b4824e9875", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389298, "uuid": "f375b733-bb8f-4698-b72e-a0bb42de1d8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389298, "uuid": "5360c489-4431-451c-8364-a628c60d61f0", "value": "504610a43ee4e0005e657e1657ecad590faf93de739d429f5cc9ea4360f0d1a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19222277-434d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777413383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413383, "uuid": "0fe054fb-9954-470c-b7ab-84df12a33f9f", "comment": "Malware payload", "value": "b0e7db431a772189a54762fdf6fb31be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413383, "uuid": "5a7966d6-d3aa-4c1e-a769-45023f6e9609", "comment": "Malware payload", "value": "508514be0baaa7d70ef630a81442ffabb1ed612e1eb626f6dcbaf862427f057f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413383, "uuid": "5bcf99aa-7cf5-4bfa-82ea-bc4ef636b76f", "comment": "Malware payload", "value": "424849b6332fb4bda5cb7ab603149cef08de1f88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413383, "uuid": "4f6b7c43-7781-49d9-966a-080c879d2a12", "comment": "Malware payload", "value": "e07efc8b40bc1d835906b6e6441c7246ce88041835ccb3776f3cb1cfeb5ed55f79ab089cc7a37bf99addf67de657d4df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413383, "uuid": "a42e5551-bf86-4083-9901-9a021fd7409f", "value": "T17143F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413383, "uuid": "ae5290e3-7436-44a0-aef5-32f7361c0272", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfz+:5AG8nY5BZG2xxmLQLS/S7hHnQfz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777413383, "uuid": "bff639d5-b913-4128-b719-f203b202e04e", "value": 59582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777413383, "uuid": "3dd1087d-47db-46b3-a504-884e8fe1a7a1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413383, "uuid": "7a66334c-55f4-45bc-a8f3-d39013e356bb", "value": "irqbalancerd.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efaa86d5-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403435, "uuid": "66a2cd41-609f-47cf-bbdc-d571e100db17", "comment": "Malware payload (Mirai)", "value": "b62b2f78aa0397ca07137762f13187a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403435, "uuid": "8df9aab3-ec7f-4478-8226-bd007998e37a", "comment": "Malware payload (Mirai)", "value": "50d5e80aaabf22af1364003b6ca51fa25add74ed59a43a2909dcfb8af917f83d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403435, "uuid": "2b23dde9-af89-44f7-b01b-5aa26c251b71", "comment": "Malware payload (Mirai)", "value": "acb472dd0a669cecb1deb1c4b8a310a3779e943d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403435, "uuid": "e8332c11-369e-4f0c-b332-faa548e03c11", "comment": "Malware payload (Mirai)", "value": "e8843dde927267456416f0c8626a4224e53909fe799e502e726f4ab63520c8edabd3f9813ca7823de95e27d8aac5c31f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403435, "uuid": "0be935bc-0b56-4ed4-ad4e-8dac65695c72", "value": "T116930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403435, "uuid": "9a04e361-e15f-4318-8b35-c6d1e891ade7", "value": "1536:wqnZK8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yvn:C8NUv5nTacgzafVAwe4BNRIbT2gX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403435, "uuid": "ed0a9470-4a0a-4e9c-a28c-4d85e174c45b", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403435, "uuid": "ee8eda7f-3980-4e5b-bf3e-cc6fbc81b82f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403435, "uuid": "c032ce76-e0d7-4776-a5b0-562cd613dd23", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff5cfe1-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777365103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365103, "uuid": "41696fc7-310c-4934-8764-16c8b7e187fb", "comment": "Malware payload (Mirai)", "value": "72f6b501558d631c29903791c7e3adeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365103, "uuid": "d8a8abe2-9bfd-4c7d-8b91-226c9aee686a", "comment": "Malware payload (Mirai)", "value": "512114c8359ccdf13f9dc20c643e7ce43baa38902943a106f54245f1b595fa28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365103, "uuid": "7e894a96-7fe9-474c-b7d7-5ff56caa0d64", "comment": "Malware payload (Mirai)", "value": "544901edbb86f19b8c1f47bc7b8c23ca77c19da6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365103, "uuid": "b7f17fbb-eced-4b6d-bafc-468163018631", "comment": "Malware payload (Mirai)", "value": "5722611cf39cbf1f55d7326faef7207debcfff6d06b3b3ab4836c9480caf568981981da321b33089cacd719dc8f77213", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365103, "uuid": "edd89044-e0f8-4bbb-850a-21c56b38749f", "value": "T199733923EA26AF46D14761F0A5F64E740B13FC2A8D671EFAA564EDE881439DCF1043B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365103, "uuid": "fa1962f7-d439-45bd-a149-374a5f8f784f", "value": "1536:epwtq/0FORx0SFXyRwBjniiQv1Mje0XKs2ne7c+G4YKC6WUvkh62:epv0QRxJcScv61asrjG4YKcMOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365103, "uuid": "6446b51e-5d42-468f-b2ff-89f3b20c066a", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365103, "uuid": "1c67cc16-2e45-4d8f-bd60-dc1ad6331647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365103, "uuid": "a03d846e-d641-4dd6-bb48-db1b9798c301", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5495844d-4357-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777417778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777417778, "uuid": "e906360a-dc25-4e82-9d8d-25a7a10b26db", "comment": "Malware payload (Mirai)", "value": "f8741bec420d35c66dd80f84d4f5cb90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777417778, "uuid": "74b3e46f-b0ec-44c2-8c1e-a26c0e413d5d", "comment": "Malware payload (Mirai)", "value": "517a8b9b84e3881d01d4a475a4f12844eff6bc3e51ec6b8cb1ce0ac4dd6dc4bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777417778, "uuid": "88f90485-7e59-432c-8c78-ec1ac93d92b5", "comment": "Malware payload (Mirai)", "value": "c1395c7e7c681c6084920e44c562470c2cf7ac2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777417778, "uuid": "4acbb324-6e4f-4373-bf8a-4fa2f867f39b", "comment": "Malware payload (Mirai)", "value": "6b0765c9eedd9046bfd8a346729b6bc6babe312815f62b8894a77211965310e56a51c1bc545dc15962d13d72f62b3259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777417778, "uuid": "741bbd3a-622f-4d18-a084-36038d797515", "value": "T10F13E1AE5564A442FE7D7C73D56D733784D15261300A6FAFB7410CA67AA8C72F20C878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777417778, "uuid": "2b7acdf5-e6e8-48e6-85a1-5ea16e37bb17", "value": "768:s4S0OkkuRPYMYvvVuwI7i+L1f1TAIpv1Ils2K81AWQoQQ5YlKrilLE105W5:nIvvIw2jZIlp13QoQQ5elLEme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777417778, "uuid": "124fb931-c810-4de3-ac8a-c78514fa2459", "value": 41508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777417778, "uuid": "5bb623b8-fd16-452a-b07f-1a21aeec6b22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777417778, "uuid": "f3ffbd93-c49b-49ce-afc4-3ee843445f1d", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4050d5c-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403443, "uuid": "9f6b5d10-0c5a-415b-b30b-ccc34c0dfc45", "comment": "Malware payload (Mirai)", "value": "9fe0e72ddf0a8cb55fda8d955511df9a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403443, "uuid": "efbfe954-f42e-445a-afb8-5f3e0fc91581", "comment": "Malware payload (Mirai)", "value": "51be9be78882853c116b283e5ad0abcaf25abd648b5cbbc856c79cde48b816da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403443, "uuid": "9c11bc73-6106-4fd0-9581-5de74fd6897b", "comment": "Malware payload (Mirai)", "value": "96e821f6ef12fc0ff42405586ffbefc0b33b5678", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403443, "uuid": "56b51529-b136-4d2b-8165-6a1cd5b7c746", "comment": "Malware payload (Mirai)", "value": "dade76e0db8a0e2dc3f7029d6194dafc47b0902802d39c7cd1b1f162a97932cbf9cc1e0d40513b43f4bafff8d0d38eb9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403443, "uuid": "3f459197-7124-407e-8d5b-e090ec68f5d2", "value": "T15514C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403443, "uuid": "9d0af986-a117-4f41-b09b-d83c31575a56", "value": "6144:456eQCbeoufx4Cdf2dp06GtCqjYW8nY1j20WI:Dely4Cdfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403443, "uuid": "65cf6849-342b-4834-b3fa-f6bcfe6fb42d", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403443, "uuid": "d00dcbf7-fe9d-4ffc-8f28-ea91f82ce3e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403443, "uuid": "bf036382-2ac0-4ad7-a30d-d28776a2e31d", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00271397-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389290, "uuid": "8403fb0b-0983-46e8-b3ae-c3373ef658a8", "comment": "Malware payload (AsyncRAT)", "value": "15aec384ac419ff5cb4dce9e5de1f39e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389290, "uuid": "160284b1-d494-4ba0-8e03-7e580526582e", "comment": "Malware payload (AsyncRAT)", "value": "523aa798da02b5d1e1f294068d22bd112eee24030ad263a28fb955b28db428f6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389290, "uuid": "f306c3c5-616c-4a76-983d-69f53412d538", "comment": "Malware payload (AsyncRAT)", "value": "cd57f36dd8131f5580d11e67719a67e83d055286", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389290, "uuid": "c6a157d8-afde-45cc-948f-07b310a01ef1", "comment": "Malware payload (AsyncRAT)", "value": "cab1fa79c123d09bae13db6dd180bdfd4c616b54d839a0c1b8b806c9a1d170cf62937583ebdbd0b6c512f9d99a146f00", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389290, "uuid": "a97fa0cf-ba3c-45e0-9063-35ed481acf35", "value": "T1781339007BFC1629F2FE4FBCA87951454236F963A932C74E1CC4519E1AA27C4AA51FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389290, "uuid": "1acc9a3a-bd9d-44b1-8560-e0510eb58411", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389290, "uuid": "2fb3a171-5cf2-41f8-88a7-e8ad251ad1f1", "value": "768:lq7x+iNv0nZIRWVYgnV3wc5hSvSRCfXuRbheuoVNt9xLvWD+:Wv0CgV3H54qQPuRbguIN1LvWD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389290, "uuid": "947abe91-c8ab-4226-a642-6fcd714af92c", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389290, "uuid": "25dc043e-9efe-4616-8db0-18fb8169be86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389290, "uuid": "08977530-f81b-4a26-8813-07849db479ea", "value": "523aa798da02b5d1e1f294068d22bd112eee24030ad263a28fb955b28db428f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf7e046-42c0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777353155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777353155, "uuid": "91bf0da2-8873-4b19-b7d7-daa4796b1398", "comment": "Malware payload (AgentTesla)", "value": "445dae0606ebe8d2f6a3039bc1de33fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777353155, "uuid": "81375049-7f07-4215-a561-8d765bbecd85", "comment": "Malware payload (AgentTesla)", "value": "5300e3303b8d3213380216de0de7f3321cac74a6a8e5c7f2d506d3a5db92b42d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777353155, "uuid": "581bca4e-46d1-49a7-b85b-32a40d25e482", "comment": "Malware payload (AgentTesla)", "value": "345eb1fd95e5009b5f55be58d71158366acf2840", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777353155, "uuid": "75f92937-938d-4845-8a08-ae2abbe16008", "comment": "Malware payload (AgentTesla)", "value": "fb39cd957290c956a5b5f5b44ed982d205e45569d2e56443d5d47c1eec1cab7924ddd3a1ef13d7b4b6dc327da236a949", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777353155, "uuid": "4906f156-efab-44e5-afba-aefbad0a18d8", "value": "T1AE251249326EC606E0B71BF02961D2B503BA9D8DF914D007EFD62EDF75BAB04451A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777353155, "uuid": "9d58c6fe-be01-4d7c-bcdc-b7f7a5c8b726", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777353155, "uuid": "ff6b1b6d-d6c3-4335-9ce0-6f841861fba5", "value": "24576:KVsBXnr2/zDVn71mOkfUR7wxPW4tOsZur87DXS+:h3rqzB7slMR0xPW4tOsZuuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777353155, "uuid": "f5c2d052-0341-4282-8fbc-a870b3f915c9", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777353155, "uuid": "5416a5d8-1551-49c8-a158-39f834164d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777353155, "uuid": "ac7c604c-b9fe-4dc5-9279-801fa142d306", "value": "Quote 240145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b465e03-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777364934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364934, "uuid": "67444187-de1f-4e0f-b19d-a748ba052e0f", "comment": "Malware payload", "value": "a5bd3e807ef98037eb4f8e5160fc8be8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364934, "uuid": "c9612ef6-88f5-41d4-ae01-bc8c7a16b334", "comment": "Malware payload", "value": "539d4cc9c9c9607f4be1462b933ece9c4b69abd22e0eeda52c8fcaa96b27b5ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364934, "uuid": "6c6dea74-e0e5-46a2-b2ca-97dec5a57c06", "comment": "Malware payload", "value": "43c0d2e2ac84ab11f3beb1aeb849dd1da08f4726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364934, "uuid": "91694c07-24a1-4039-b59d-e5390e24f986", "comment": "Malware payload", "value": "863e3e1e8d993071122efd5728773f064aba0484fcee83d61c09d67cc4ecf235dad26168324d377f5fa1565b4695d180", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364934, "uuid": "17f82dde-1a6c-4366-801a-26a48c82d89a", "value": "T17342C682F442409FC6C043FB973FDFCC7683925AD2EB3727DA494A48245668D8E76D90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364934, "uuid": "a24bc85c-7682-42e4-938c-b44c3d94286e", "value": "192:KCqVwdTHVmRCHDUZXtstNqgJ1XbkmhK1WRU0Cn0sWEdKtGG:LqidTwZo14ZQRMn0sWEdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364934, "uuid": "536fee9d-7ef0-45f5-8a3a-dfef10c2eae6", "value": 12140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364934, "uuid": "f2d37440-06ac-4e7f-a68a-c9ca2c8daaf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364934, "uuid": "8af1332d-3f5c-46b3-a30c-4dca1e9d9e4f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2489254c-42d0-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777359715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359715, "uuid": "5e3c4450-b64c-4c39-9f47-e7ab842cd817", "comment": "Malware payload (WeedHack)", "value": "4ff630d7acc3888cdc30612a9335adfc", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359715, "uuid": "8bc5d23a-38c3-4314-b062-058d64f800c1", "comment": "Malware payload (WeedHack)", "value": "53ce46a67888c29655605d6be749b09f4343b2f6d30460fea3f014876e44b016", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359715, "uuid": "9257dc43-f008-49bc-b76f-aa8c7f304bf9", "comment": "Malware payload (WeedHack)", "value": "c7c2d042cb645222407980b3a816f8954e360043", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359715, "uuid": "d53ce374-cc05-466d-ac46-8d57adbebd36", "comment": "Malware payload (WeedHack)", "value": "e3c6b18102292a07947f96e071e9355ceda8c545d696feb04211b010b87757fae22d038bdfc68a6eb431efbc7598ffe3", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359715, "uuid": "0f0b6299-d786-453b-b339-1c5288b09168", "value": "T10314AC9215E9716EBED80E30E23B44D852ED88056D700F5F8D01F885A66B77E26F72CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359715, "uuid": "ef3c06d4-cf2f-4aaf-a3f8-2a4642a789fc", "value": "6144:sHxktl5lNXlEMsBkUK1pownvPo1zYp7NqZl8jbQ:qktl/NXlQBkUK1Dvgd2qZuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359715, "uuid": "850754f7-cd7f-436f-8304-7382cf87e6d4", "value": 201688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359715, "uuid": "7805c222-50cc-4b43-abcf-d8ca62fe7997", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359715, "uuid": "3f2ae237-6e6e-4973-b5ff-23bb4d27f879", "value": "DueXInvoiceXpayment.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1965e53-4340-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777408083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408083, "uuid": "453a5251-df7a-42d4-a736-9a53828f2a31", "comment": "Malware payload (Mirai)", "value": "d1c14446a3779d09647849674b086bce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408083, "uuid": "9f5c1d15-118c-4e85-866c-138e363be29d", "comment": "Malware payload (Mirai)", "value": "548ccc63d081021693a5f634e16a248274a0f4850b982fdabf375e34de320a27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408083, "uuid": "283a0877-56b7-490a-b40b-c97d57685c4e", "comment": "Malware payload (Mirai)", "value": "7cf41fce7e1bd9d8f3d7c70dc895ee06dc87f9a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408083, "uuid": "27c5ef88-0734-4e99-b049-f6c842501225", "comment": "Malware payload (Mirai)", "value": "6fe60b3d456e376bf6097e8fb5f733f4febcc02e6ac8809fedc6f09d3c7e631d06397814dbaf1ca11b0d1323b02be136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408083, "uuid": "b8211296-94d4-4a97-bc46-b8e35bdb0b1c", "value": "T15C931A46A9529F12C4D631FAFAAE415933537FB8D3EA7101CC20AF9423C59DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408083, "uuid": "128f8e9d-e96a-43c9-b183-2ee6426a4b75", "value": "1536:J4nazk/gsUxR0dUDNkl3EV0vXR4YQfgasDnu5NVIQqlmKi3kdTQQVdMb2uS:jk/qxRPRkqVIXR4pfgasDnu5NHwdTQQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777408083, "uuid": "7b2f2b1a-07a9-4305-bb9e-d4c14fab3ab6", "value": 95876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777408083, "uuid": "24bcaf63-050a-4267-97a7-838f9b19d82a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408083, "uuid": "10a9c4a2-6caa-4377-8bf8-6ccc27677db3", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce17891-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377849, "uuid": "f7deaa46-2185-4d90-b3b0-d95cb5316934", "comment": "Malware payload (a310Logger)", "value": "aedd6ca9d8d09eebe55fb4665e1bcd4a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377849, "uuid": "4af3d84d-a061-4f0f-837d-497c1dbb251d", "comment": "Malware payload (a310Logger)", "value": "54a527c164b9886d6d40da0f02af9d46bc8551147e76ef5a64330d32542cb870", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377849, "uuid": "942e591d-603f-4cba-b7a1-0d808bc18fce", "comment": "Malware payload (a310Logger)", "value": "18769c883edef0a1324c04b157ee59b41f4d5750", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377849, "uuid": "0ad1e399-7b7a-47a8-98ba-f1f79799f656", "comment": "Malware payload (a310Logger)", "value": "d4a839ac323a41632f45b88d337fc39cc380337b33b0c6d424578fe7170c08dc63e80e98f1b4e58b226e5a4fb088ce00", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377849, "uuid": "b27ad1d3-e20f-49c5-a152-133eaa0cc62f", "value": "T173A58E1230CC603F6CDD510F5A8A399DEE85F5C3E05E85E32962228B73C566FAE52E35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377849, "uuid": "b7ac063d-44e9-42fa-aa9e-2a107306e364", "value": "24576:ilb9nnw0keA4W1V5D/MO1mwVo1HuPU8V1MVBt:P4WJIMcy6Vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377849, "uuid": "c4518ef8-ed6f-4dee-bcd8-37dd530bcd0e", "value": 2105444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377849, "uuid": "9c90f4b5-b35f-40f8-9c4c-47f48aa72611", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377849, "uuid": "596951fc-bbe8-4cc2-9e21-192644121c2c", "value": "ps_u6v3yHpIYZOf_1773218024276.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce7645d-42f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777376104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376104, "uuid": "dbc17410-7997-4f35-84ea-cbb9737dd032", "comment": "Malware payload (Mirai)", "value": "b3cf25de36159a14d274b0db6c2d065a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376104, "uuid": "39212547-5944-4f21-91b8-87417abb296e", "comment": "Malware payload (Mirai)", "value": "5510cabd55c345a0af74615109224578a89e6ffc22daa14d6968ad4da5ed4c37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376104, "uuid": "f49fa2d3-ccaa-4c2a-b6f1-cd1ea182d7e1", "comment": "Malware payload (Mirai)", "value": "5ded641926afd53e851916c40eea8c2d9e75975e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376104, "uuid": "b2a806f4-4114-4e88-939d-08b0d1896a31", "comment": "Malware payload (Mirai)", "value": "31aae9ba8ef4cce6178a4c4a05a85368a7866749c6be6e1a279ee452c942f4e7bc69fa8cce77ded729e1dc819c06fffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376104, "uuid": "baacb667-017b-440f-92d2-dbbe9bdf3005", "value": "T10EF2E10EF9A8F7CACE9DDCFB229C17F0214690C533861B1A6345CEC8767514F68882B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376104, "uuid": "d0941a81-fcef-4940-bd65-477a3a576e23", "value": "768:gMwB2ao09iDzgoM6JFJiwMAQQNmrBFtWgWs:gMJR2iH6qJ1MApeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777376104, "uuid": "45decb8d-3761-4516-845a-3e74637852ad", "value": 35240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777376104, "uuid": "14ab95ce-a413-4293-9ca4-d8a36a0b0714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376104, "uuid": "defb09a9-c262-4619-9873-5f1c43f18e0e", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda675c3-4314-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389285, "uuid": "05108d72-db56-471f-96c1-0016f9f82f09", "comment": "Malware payload (AsyncRAT)", "value": "231f9fa5d5e1da0b03d7d54520d07768", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389285, "uuid": "f65eaf98-de30-4bb0-9681-b39fdb42ddd4", "comment": "Malware payload (AsyncRAT)", "value": "551ece23da03e5d1c3e64eee6fa371f88bf730c73381f11df7a582e67fb874ed", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389285, "uuid": "6f2ef83d-de44-45ad-b517-33b399708bf2", "comment": "Malware payload (AsyncRAT)", "value": "0205c7ea0e4037e47eeb090720e4a01e7466a58c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389285, "uuid": "3c7bf7ae-33d5-4455-84e2-6e35259ca39a", "comment": "Malware payload (AsyncRAT)", "value": "2d6c0199b43afa5350b952cf7b89f82faa62ae98b7d2c8bc4488986bb1684c3c63f643d9da08dfec276d16b495479dd4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389285, "uuid": "0609a6eb-964e-4518-b6d0-cf133c2bb6c1", "value": "T140332A007BFC9A2AF1FF9BBC9C7555054679F513A832D74E08C8109E26B27C09A81BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389285, "uuid": "6acdcd50-8004-4cf6-a8a6-8e3a2a091591", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389285, "uuid": "f2a58353-ffc8-49f7-912b-b06fc425439e", "value": "768:H0v21tXpPxf50wabjRRXBRz07RbjeuOlotJC+/5D/61/hF+:PXlxhva3RRXr47RbCugo7CS5z61/hF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389285, "uuid": "dfcd4826-4798-4f46-8161-b3f132d0b6b0", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389285, "uuid": "e56c352f-81f5-480a-b64d-d3b14854d0c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389285, "uuid": "9ef61d97-b7df-4e01-a983-5d1ed3fd5b00", "value": "551ece23da03e5d1c3e64eee6fa371f88bf730c73381f11df7a582e67fb874ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6df2aa-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355169, "uuid": "3e437073-d4aa-42cb-9a2b-f5bd768bf94b", "comment": "Malware payload", "value": "06c0b915e2f66a122f87fc8799739184", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355169, "uuid": "3d5aa861-f965-499c-a424-c3396a46947e", "comment": "Malware payload", "value": "5567661fcb89b6f4d473c0fb45d91ab93e8964658567351a731228f3990000e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355169, "uuid": "06ef99a7-935d-4fc3-9aaf-1b429251d9ef", "comment": "Malware payload", "value": "d01e64fb62b06741be8b3e09237e8c03235195ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355169, "uuid": "f41e8165-d535-4dd6-9e74-12a755da4d0c", "comment": "Malware payload", "value": "879901beec763ce72ea063b451158e158ce17ad86ed7ba4a8efb42bad77399e0a6ec5dbf00bee7874710203fb624f1ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355169, "uuid": "770b5ab8-16a0-4971-9ba6-b83981779d22", "value": "T1CC37238E2F756E8F0EFD291B155E0E1B1EA41FCC8950A7F26A507971821F7068CBB4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355169, "uuid": "2ef1f1ef-7425-44d1-a924-aaae6adfaede", "value": "49152:E1HJ21HJd1HJd1HJG1HJe1HJo1HJ01HJW1HJf1HJC1HJM1HJM03VNOEAG1HJb1H6:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355169, "uuid": "45d34778-c762-48bb-88e9-df303552b7b1", "value": 23424196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355169, "uuid": "f6c19d7b-21ef-4748-add3-b6aa7e856af2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355169, "uuid": "bcbfdad0-ffb4-42ca-8ee7-1171429f68db", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd66708f-42d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777361744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361744, "uuid": "4a771186-dfb3-4cba-a1cf-09b2a12d8385", "comment": "Malware payload", "value": "9ba23e22011c2e066847f5a08045c717", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361744, "uuid": "eca23d71-e284-49b1-bb8b-186d5c43bde5", "comment": "Malware payload", "value": "573379c2a89bd4945c5449bed3e083db6d44404d77b34b4dba80038ef641dcc1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361744, "uuid": "954056fd-0be7-4008-833c-fc5cc50b9ab1", "comment": "Malware payload", "value": "294cfdbb8f1160ee7a963ed135d8079ddae7b047", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361744, "uuid": "d232359e-3bf6-47b8-aa2b-d4b832b8cc39", "comment": "Malware payload", "value": "92784235d53fb4925e6c4087dc7c16c3c0a01e38023ed59f3666a24a96b71fe36af386a3e3cf46bf3717e97d23edc49b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361744, "uuid": "1aa0bceb-6cdc-4e11-a677-ed4f3415e685", "value": "T171D26C46B6009332C5861F324A5BEBE95F7A9C04DF57210236CBB39D2E76AD026B79D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361744, "uuid": "6ae17e6a-29d0-4e78-a99d-63d98c37c270", "value": "768:7moWjwJC1oRRXWxV/jpRJeWMbC9qZN/nq:+1oRRXWnpbob6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777361744, "uuid": "345058aa-eabc-460f-8531-ed9b19cf6ef3", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777361744, "uuid": "711f41e8-6cc8-4ae5-8008-ab53fb3d51d5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361744, "uuid": "356eb567-37a6-4912-ad76-7c23bc45cc37", "value": "nssm.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6a259c-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355056, "uuid": "efdbc46d-3d99-4c65-ad68-e5d42f529459", "comment": "Malware payload", "value": "a72111b479e639d0ec9b31a2392b707b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355056, "uuid": "0eda5a8a-b443-4dd8-84e2-90ab708e454f", "comment": "Malware payload", "value": "58aac8adddaf77332671494b9edd3b5da61ce7953901e111e204207b2a57e5a0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355056, "uuid": "34243069-4b9b-4fd1-9b99-20ce15e86dee", "comment": "Malware payload", "value": "c3cd10e56f6fbeb5cdcc6fe2ad4b24c2d8daa9b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355056, "uuid": "ec217b31-f699-4347-958d-16a2e3ae5f6a", "comment": "Malware payload", "value": "9a324d66cb647bc041f9f1816453051858803c7c4bae4a2c1661c02a13a1e225356a83786b6a3bc9c6a17e1de3bbacd5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355056, "uuid": "3583d036-4bde-4f43-9c28-962d0e7a12a1", "value": "T198372362AB903C7E07F5037C06BB2FDF1A015B15550498E5338B697EABCD61B21E7A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355056, "uuid": "69027a1d-a36d-4859-9b35-5cf9c6fee805", "value": "49152:8kbkXkRkakak8kKkckDkIk+kK0jdXakXkKkAkIkQ0jdXPkskVkhkjkPk9kqkjku2:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355056, "uuid": "9532234d-b86d-4de6-9e7a-4624861fd74b", "value": 22903952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355056, "uuid": "75f35a0a-7516-41a9-8a29-997fd836b092", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355056, "uuid": "c48f976f-2142-4d4e-9a72-a1ad681f6fdf", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36039e9e-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355450, "uuid": "ddc5d4d7-7434-4a7e-8336-a182f851ad68", "comment": "Malware payload", "value": "bffdfc345bff310a63d35c24409d07c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355450, "uuid": "8b7b6288-eb2f-4d70-905e-f89648ee20df", "comment": "Malware payload", "value": "5910c2c1da39bb0b3e1fa69b6b12d7259ef01120b2419f9603833e95b44956ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355450, "uuid": "31c8bd3d-76b9-4aff-b4a8-4fadac2d27b4", "comment": "Malware payload", "value": "a140aeb9ec67fab4dbc286c64fd26be74a359515", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355450, "uuid": "0eb084d1-aa4c-4c86-bbf1-a8c89991520a", "comment": "Malware payload", "value": "35a3488898de0091ca4dc6a76161fdaf1d5331367d568d8e0bdd80092c0a0ebbb2090394fe83d34db68b942157f8ec37", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355450, "uuid": "d6a56d19-e957-4b4a-87dd-c102d25f495d", "value": "T17A27220B4D399EE5042076FCA40F488F7FE48DA10D59605463FE48DB750BB2917ABAEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355450, "uuid": "48b4bf8a-dc5b-4c78-9b3b-7ca474a23cce", "value": "49152:zh8sh83h88h8Ph8bh85h8+h8dh82h8oh8bh87F+qh8Vh8ih8mh8ah82F+nh8Lh8L:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355450, "uuid": "2574fd9d-e5db-4b79-aacb-8c756db9307b", "value": 21863435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355450, "uuid": "787a5cc5-2efe-472d-ad09-cad5b50ab17a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355450, "uuid": "02abac9d-9b44-482d-b658-5664b0dea0d0", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e884275-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355115, "uuid": "20122a25-c214-49ee-9b8a-720b964fb013", "comment": "Malware payload", "value": "2bea0b5154f2608839436444bc725002", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355115, "uuid": "0b75b91c-80e9-4520-8444-52bc9fed0ec0", "comment": "Malware payload", "value": "5978dc7b2e715e58655517d94b190d1e014110e2fe142585a91d4f84c5a18e7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355115, "uuid": "e354b115-e0b3-4f75-b5fe-cd29708b659e", "comment": "Malware payload", "value": "abf3735fff3b88daa1f734cda35e6fa7fb914554", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355115, "uuid": "07ef0ee5-cd33-4285-b811-224b8ccb8bb2", "comment": "Malware payload", "value": "3e9ad344c128576aca1b51711fdd084df619763325ebca6e2e10a3efb9a5ecc368fa70df920c5b293135550e4386ac00", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355115, "uuid": "d3013144-ccbf-4ae1-ad93-d25b7b247d37", "value": "T1053722194FAE6E59C6BC3B3D206B0F0D16A59C55D000F6DB6DEA39A5C38C34D682F42E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355115, "uuid": "24e315c2-bfa3-4658-ab7f-7821e4e5635c", "value": "49152:Kuq2wljlSEXUFX55766eX4UijHB0FPGvNIWEXyX4LDpXVt3r6PfgsIi8E6HVHlRi:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355115, "uuid": "c16dd902-f776-4be5-a6d2-82acdb303b26", "value": 22903932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355115, "uuid": "15b3a970-b696-47ba-bf29-4572ec5da82d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355115, "uuid": "53efc2e2-4f19-458d-a39d-46da3b2fcb2e", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3217ceb-4340-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777408085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408085, "uuid": "2775687d-802b-4dc1-b72e-eca0c757727c", "comment": "Malware payload", "value": "e664d4aaaa31465a870f6252c13c904a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408085, "uuid": "155eb009-ea0f-42ad-ada9-35c85fcbbcbb", "comment": "Malware payload", "value": "598ec34f2e1a6b12e0c47574741f709b0e1ee0170bd8306a47bce3822153f773", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408085, "uuid": "0a6f52b1-b478-40ed-a0c9-423a5a1ecec7", "comment": "Malware payload", "value": "210fd63f86970f828fdccfc64ea03ea83460dee0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408085, "uuid": "3344d456-ff8c-4141-a6bf-4173d940d6bb", "comment": "Malware payload", "value": "d960f7d00d517806e67352da061c33b0c458a63dd2843bc7696d22f75cd31cd5ce840f0b5dedee19335bb4e03a781600", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408085, "uuid": "ef2fabb4-c115-4c5f-b169-8d24cfcaca24", "value": "T1D9F58C53FCD104E6C0AA923289AB15927B31BC494F3123D72F50B6782FB6BD45EB9748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408085, "uuid": "87b30c66-691d-48af-8572-e0a6b77d448b", "value": "49152:edQ5G+Yc6a6uEtZXkUmSafXUwCsWjkvaSBetZDAQjavN:edV+tQDsWjEoZDiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777408085, "uuid": "e4c4e746-4a9f-4325-8a6e-1f794ccadd48", "value": 3377026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777408085, "uuid": "e449fa84-851d-4716-b6ce-131bb3800bb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408085, "uuid": "cd05da07-9c11-40d6-a411-dd596bf06b32", "value": "server2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265e507e-434d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777413406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413406, "uuid": "2b72cd04-e14c-441e-b892-54ebc81b957c", "comment": "Malware payload", "value": "56c25c3250592ec1aff00baf57d355cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413406, "uuid": "1327c7a1-620e-4847-a851-ba81813f1996", "comment": "Malware payload", "value": "5a8cafc1f3f4e565319eafae377e68a5aa9b7c5c0be66c61a543f501dc519ca1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413406, "uuid": "3e935b56-6cef-45a0-91ae-89faebcec0e6", "comment": "Malware payload", "value": "e2de1a4f00dc20987e4b9bd5289ca148d1f7dd1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413406, "uuid": "68321bb2-72b0-4544-911d-223a62488d66", "comment": "Malware payload", "value": "4bc62060501e8a0e854424abcff911c82be1eb21facdff65f3f293439670986f0d70f6ba07663fc7c8d9b41866429641", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413406, "uuid": "f6cb4a4d-60d1-483f-b557-ee077745a591", "value": "T19D43F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413406, "uuid": "242687d7-6a04-48aa-8a04-28b73b6be7c6", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfzV:5AG8nY5BZG2xxmLQLS/S7hHnQfzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777413406, "uuid": "5166208a-d012-4e27-8612-fe06d6c52d4f", "value": 59562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777413406, "uuid": "c3466e4b-fd32-4481-bb63-9c156af91f25", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413406, "uuid": "cb2cdcfb-8487-407a-8e5e-01afa56ab4b2", "value": "systemd-cgroupwatch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0edb7a-434a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777412231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777412231, "uuid": "4a7660af-add0-4a16-8757-ba2f612a32fd", "comment": "Malware payload", "value": "08e589a88d2c447a288cf9c50b620697", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777412231, "uuid": "906b04a1-fd1a-4834-9799-811350e9198c", "comment": "Malware payload", "value": "5b01937182c2af51d6c2299518fcce5e765e82bc31bf49049ef5aa28fa0f2388", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777412231, "uuid": "3e72ff95-3cfb-4499-a1a0-030906b93d4b", "comment": "Malware payload", "value": "26bf170b911986baa3dca465915ffb5d8b33faea", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777412231, "uuid": "1b111fe7-1f6e-4c9f-afb1-919936ecae1d", "comment": "Malware payload", "value": "e43ab0201887edbde2bb95307de057077f5e255743f65c13ad6b88317486cb03db18086bb27fa7f8dc8a129b4eca7adc", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777412231, "uuid": "1e83f3b7-ca38-4a55-8b87-7eddec46fc83", "value": "T1F4D26D57B901A331C5450B328A4BDBE54B6AEC1C9F63204335DB774D2E32AE12AF79E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777412231, "uuid": "f97fde1a-1315-4c41-b14e-5fab51a3e4ea", "value": "384:GwTDe2rGLZT2UxjgSj6IroPRUauq4Tr9qBwGNivMey3M5JC0ioXnufNoVG+OwPgk:1G0E2LSdoZ7r4XaEEeWMbC3+cN/nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777412231, "uuid": "d408da6c-4cfc-416e-9423-83538cb1615d", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777412231, "uuid": "b9c35fa0-2b66-4701-8752-da5f5315f7f7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777412231, "uuid": "02e34646-010b-4914-b62f-6d9d9e1dca81", "value": "RAMMap.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f064b011-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403437, "uuid": "b3b3dfc2-0e1c-41d9-b0f2-3627ab47de6a", "comment": "Malware payload (Mirai)", "value": "82a58901f9bf4238e877b9c84f1dbb80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403437, "uuid": "277e21d0-9b9c-49d6-89ce-2e546cf2ce79", "comment": "Malware payload (Mirai)", "value": "5bbb3cf4311ffb7f8cca0a83840d7a4711382ef43d0124701e47ef652d55444e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403437, "uuid": "630e3bf5-eed7-41bc-9221-52ca694ea2a9", "comment": "Malware payload (Mirai)", "value": "12d582f6ec3d7a8992ab9286c42a359e1c39c11b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403437, "uuid": "60429571-85a5-4ca1-b2e5-cfc14e6e1616", "comment": "Malware payload (Mirai)", "value": "12bc9de761751702da42859e409ed6fdcc7152a90e3529eb696ce062b57fabfd08af0380548277679d77f1a26d5ab316", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403437, "uuid": "8d184525-c9cb-440c-aa84-b3204de10caa", "value": "T12BD308C7F900D9FAFC0AE7374853080AB230B7A549925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403437, "uuid": "04c2d414-7f44-40bc-b941-c5a7339b7f2e", "value": "3072:kSbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFImx:0rybytG/Oyi42VOgLNlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403437, "uuid": "8a36d7c4-6fc4-4cd1-8b08-d77c69cda46e", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403437, "uuid": "16e9c4ef-30fa-46cb-bcde-f4d4eec1793d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403437, "uuid": "8192b5b3-3771-4a92-844c-4225092c441c", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8baacc19-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403268, "uuid": "7b2cf5ff-90cb-490d-962e-894ebbee37c7", "comment": "Malware payload (Mirai)", "value": "bb9f145f88d9cf3e0ceea9ffd60ba9dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403268, "uuid": "7f5d88a7-b3b0-4016-998c-a39f7353db91", "comment": "Malware payload (Mirai)", "value": "5c0ce57b7d38177081fecc5f3ee6143966b16b8e50e42d08db3f6ad1d7c3d864", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403268, "uuid": "fe20b1e6-22a9-4e76-a222-e6a316334c0e", "comment": "Malware payload (Mirai)", "value": "7520675d1a09e94a98a9c370f5f5c5e0a4736d99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403268, "uuid": "89511415-3f4d-4ad5-b380-31b2cd426b77", "comment": "Malware payload (Mirai)", "value": "178d328e9b948310e5334a56b0a7352705fe9eb1806f2dde61629e7cec14d76cb4f1a1cb708ab2755f5bf5c7702ad425", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403268, "uuid": "d91f7ce0-b157-4828-b759-060dc8320cf2", "value": "T140141A45AA408B13C0D62BB9FBDF425533339B54D7EB63069928AFB43F8679E4F22501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403268, "uuid": "f35b3ef4-95f2-4164-9abb-a7a77c5c0886", "value": "6144:INzb7NaInxQxw7lamqUDMhVR7jfeY4fQ57M/R2qsV88:INexw7larUDMhVlrN35w/oqsV88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403268, "uuid": "63495bda-5ddc-4832-94a0-4d93535d083c", "value": 205637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403268, "uuid": "ce20f839-5735-4a10-9c15-a72f365f9619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403268, "uuid": "22750505-c87e-4a37-8263-2d2db0b3e98a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694daf01-42e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777368421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777368421, "uuid": "55696933-9344-42b3-a477-9e0de161d93f", "comment": "Malware payload (Formbook)", "value": "d84d2dc106ae1818d3e0799e62560fa0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777368421, "uuid": "27600f2f-3602-4f11-a758-7a29dba34c00", "comment": "Malware payload (Formbook)", "value": "5c5fd3501c142aee580270869bdfa10af7e94fa89086fe8b12666c0580428d57", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777368421, "uuid": "e6f5c3d1-a239-47c8-b38d-d06162c1dbf7", "comment": "Malware payload (Formbook)", "value": "47b38547946097fe15a5fd0de33e7be7e3c7e275", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777368421, "uuid": "9b6e8fd0-1394-49cf-9c63-b1bf820f63b7", "comment": "Malware payload (Formbook)", "value": "827f68f033432661599ec392d8d91f38ef16896a2ad4c7fda065743e9f2e865ecb5a4444531537ab39cb135e4b001ba1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777368421, "uuid": "65e9a42a-2cdb-41fe-92fb-14d4d4c57a42", "value": "T13B6533008E4A78FE435D8827B9BF7F6812D20717C2D6355799EF12DA0F32B0B4E29956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777368421, "uuid": "f685a89a-471d-4d97-a893-ca709c7ab816", "value": "24576:c2WAuMmSDujxAcrlIkOsfKOiPCTRESV7TdF4tZONXx0M1P7osX29tlCVKF:c9N9Ac2ktKOrEYNSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777368421, "uuid": "24c3713c-1d1a-45ab-863d-858f234b8d71", "value": 1426291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777368421, "uuid": "e5bcd4ed-0bb4-45fb-8502-364bcb8280d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777368421, "uuid": "af9a14e1-3619-4925-a096-501dcf9866d8", "value": "Keller.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4765bbf-4314-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389270, "uuid": "d4b3c551-99c8-4212-b293-0df46364d6e9", "comment": "Malware payload (AsyncRAT)", "value": "0a94a1c6b3d1743f02f63a6e3052c1cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389270, "uuid": "ab687dc1-9a3c-4d7c-bd2c-4a39ece1aa4e", "comment": "Malware payload (AsyncRAT)", "value": "5d20df009a03db5de41320f16acf70fc43137ea774db84b2bd22885ce5a5ced3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389270, "uuid": "21d17963-e6fe-4cf8-b339-44329b2d5a20", "comment": "Malware payload (AsyncRAT)", "value": "b4062cc81738a229653cd55940e6d18474c016d6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389270, "uuid": "bc6cc784-933a-4fba-aab6-ee259bda514c", "comment": "Malware payload (AsyncRAT)", "value": "b24b2a92506e3561487e11b11ac6158467f037f2c26270b1c05815805b17553ee296d4f70be264cbf2587c1c3cdd00cc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389270, "uuid": "119c2444-662b-493e-b182-61ba672dc112", "value": "T1D7133A007BFC561AF2BE4BBCA4B955054676F9179832C34E1CC851DE1AA27C0EA91FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389270, "uuid": "9802e83d-9855-4fcf-bb07-86689f1bbad2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389270, "uuid": "4b744e25-5df0-4f0f-a2c5-6a5175ff013b", "value": "768:ntMx+sN20nZIRWVYgnV3Y6sTpjGe0ORbheuoJNtqLn3j+:W20CgV3PkpyBORbgu0NULn3j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389270, "uuid": "69445c23-d4d8-4133-b396-04efe308f6de", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389270, "uuid": "4f820722-80af-449e-9ac0-2de840657cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389270, "uuid": "87371aa5-abc1-4957-af22-dfb64b368db8", "value": "5d20df009a03db5de41320f16acf70fc43137ea774db84b2bd22885ce5a5ced3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4458476-42ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777372063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372063, "uuid": "7aafeb94-4cd3-4569-ba78-21cbc97e9d28", "comment": "Malware payload", "value": "8ea54a900bd13ff3ecca01e62428e508", "object_relation": "md5", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372063, "uuid": "6f4eebfd-9f19-449a-b60c-29e316ad8630", "comment": "Malware payload", "value": "5d585f2b24503a96011bbe928f42b1b663946e822b309f8496573c66b5ee834c", "object_relation": "sha256", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372063, "uuid": "19ebe697-f5c3-46fb-bfad-ffe938cc2abd", "comment": "Malware payload", "value": "3a0257f31f8db0bf5e1526f4c65f79808e4a5eea", "object_relation": "sha1", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372063, "uuid": "16b433a1-cf53-4db5-8955-c2e9025b4277", "comment": "Malware payload", "value": "ad103fceb0f2488ab7b5526ce91055b6c4ea6b42a04ca71bf5c328f749083987e1d4feb09d68e3f35503cf473b806086", "object_relation": "sha3-384", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372063, "uuid": "55656fb4-034d-4610-b02f-0751b3913418", "value": "T15D063A2BD66244ACC167C130DF97D2B2AB31BC1C02F4757E2684DBE13F56E20779AA94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372063, "uuid": "2a310e5a-8c64-44cf-896f-b7397ec57566", "value": "e5e1c7bf79d9e27780f9dccbb11ab144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372063, "uuid": "c0cce845-484e-4865-a1fc-c8358a2df808", "value": "49152:DPZl7peO03NvTEh5/wWT8qpQ/fnlJLRjmjSKsj1WPqXAQrNu:DjIC18nlJoSKsj1WqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777372063, "uuid": "7b96d3c6-9db6-4159-837b-bfb035211d3a", "value": 4012032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777372063, "uuid": "296f21f9-589b-47da-8eca-ba8dc7689a3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372063, "uuid": "f0f73520-21b0-47bf-b3a4-4de932166010", "value": "mscomctl.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4395991e-42d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777361915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361915, "uuid": "dff46c5e-d966-4548-89d0-0b224333c238", "comment": "Malware payload (Mirai)", "value": "f41512e38e06c7ce6dd28ef80573c5e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361915, "uuid": "35262289-14d8-4f3f-be2a-c891f1e9a2d4", "comment": "Malware payload (Mirai)", "value": "5f05b1c3239c0fa7031372cd306866766bc8ee20a9b21d6f43f9376f4e4b966d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361915, "uuid": "0bc60bb7-bad1-41ac-9342-3dc8a4d9717d", "comment": "Malware payload (Mirai)", "value": "39a38b237a738267d44fb1d3a13e995a5ffad925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361915, "uuid": "7def391c-0484-490d-82c8-56fd27409b73", "comment": "Malware payload (Mirai)", "value": "8ee6bd9581274edcc49082141fe35adea00491398eda07408f156db6df6cb307547978abfd868459795020fa5546fb11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361915, "uuid": "d3a68f66-25a5-4b23-a93f-206cd14d3e34", "value": "T14783E895B8C18E11C5D413BBF92E018D331267A8E2DFB2169D206F147BCA92F0E7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361915, "uuid": "9818ff03-f534-4620-978a-13ae1057c8e0", "value": "1536:uRnabgUZLKq/zB8dAm5UhNTzeRGq1SM2b/cQ7dTMi6N1vGKYw5e5e995nZ4cuIfN:VgYLp/t815YNPeUqoMS/cod4pNFNL0aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777361915, "uuid": "6bb0cf62-11fe-4f37-b266-5c4acd12f763", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777361915, "uuid": "1337dcf1-df6e-4315-b31e-4e94714616c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361915, "uuid": "2b3f8114-80e6-4eac-917d-95eda224223e", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b724d27-42d7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777362787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362787, "uuid": "1e0a13a4-7527-40f9-9f97-e7330fd932ce", "comment": "Malware payload (AsyncRAT)", "value": "764c6e06c6f2babecc2b510102252c9e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362787, "uuid": "beb6f974-bdb2-47d2-84d7-84cf21e4677f", "comment": "Malware payload (AsyncRAT)", "value": "5fd0e67e8a755007259a760ac326b087a716191e42f13870642911cce39c228b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362787, "uuid": "8c078b00-c0af-496e-91a7-58670a9eb20d", "comment": "Malware payload (AsyncRAT)", "value": "85cd0080f001c8614a7c9ce95d400c6191a688f3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362787, "uuid": "665451df-2dbe-4655-9fa9-389b6c14f91f", "comment": "Malware payload (AsyncRAT)", "value": "12c9519d672f12bd826d53d2a3afbd6bca3981a46d4f1922f542ac371005576404337ad7e13ac0d3862fb36fcd4900b2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362787, "uuid": "09e56099-5227-491a-9aaa-93f3081013aa", "value": "T130F412F11F69D603E49797F09972E37603825E9DB911C32A9BFFBCEF38582601518282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362787, "uuid": "90551a83-c849-4ffd-983e-610537fe7421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362787, "uuid": "2e6339d7-a35d-418f-8917-791939fdaac8", "value": "12288:gO9SlMPhXNblVzknxW2dSgj8YQh7jObN1rqreCDzUcFCzeqXy10:gYBXBlpKxMeburnjFCzeQy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777362787, "uuid": "06dd7d63-c120-49b5-8d91-1d69df48ae55", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777362787, "uuid": "29224712-4ce9-4fc2-8d9a-31132086c2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362787, "uuid": "4557bd43-3dc1-4388-85c2-d862211a6aac", "value": "payment-20260427.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5dd553-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1777400506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400506, "uuid": "4043379f-ca79-49da-8f15-a36ed06af1a7", "comment": "Malware payload (AteraAgent)", "value": "832dcb77db69e9b9a52f955a4659ffa5", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400506, "uuid": "a487cba2-de03-4be3-bca3-73d5de73fc8d", "comment": "Malware payload (AteraAgent)", "value": "60241999f0f2d24b6609001a4f3d97f70d0080f7c545fddd3b70962731f5e5a0", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400506, "uuid": "8161da43-4a6b-4a86-9bc2-9837586a4e3b", "comment": "Malware payload (AteraAgent)", "value": "0973396b161d165cc4ee18158ba52022fc1cec89", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400506, "uuid": "a67c7824-b450-4b50-bd7f-e94330c8d5fc", "comment": "Malware payload (AteraAgent)", "value": "6ce29fe12e25cfa1e98f5473283dd51e280c294d1b0ee9f763b6ba8e09a89d1076e3440d03b973e2dd5d208613896406", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400506, "uuid": "e8f53fc1-a92c-442f-b22c-bf6520be283a", "value": "T125863329B7E008BDE8B78279C6A34664FE367C453721C69F136472195F3B7A0653BB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400506, "uuid": "ab21bf64-033b-4c02-a637-1daf4dee0a71", "value": "196608:hWURLv4Vdsl63Dvf/maPOpDXc7fykleD03IJ:TLAo6bGaP8DXwfyu1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400506, "uuid": "40c3e32c-a4c8-4de6-80bd-815c74f3f4c9", "value": 8597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400506, "uuid": "fc906dae-9894-403d-8629-8b7b44d01db4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400506, "uuid": "9a35044d-3129-40cd-ae73-4bf434f1156e", "value": "hmlineear.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589dc132-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377842, "uuid": "21bc66ce-dc51-4650-9864-07390cb2ce4d", "comment": "Malware payload (a310Logger)", "value": "939a50f919f9da3f73bbe7f89a495251", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377842, "uuid": "690e42e5-5265-46d8-8c2b-d6f1a63c2e10", "comment": "Malware payload (a310Logger)", "value": "60c0c18173c6b4430932a9a324dfcd875e62ec977b12e0a006d3355544e48714", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377842, "uuid": "5956864c-4161-4d6a-94ad-d0a5f8e0c46f", "comment": "Malware payload (a310Logger)", "value": "bb8ea5b03f93919f236d87aa50ff9f8375ee154f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377842, "uuid": "da77d65c-93ca-4a6c-9f15-b9f161ae7c6a", "comment": "Malware payload (a310Logger)", "value": "0e35bff4f62a43de545da85d5b947a47c327b173ed6f13c60dd53fffa37871951356ef9cf8096732bc2cdc1447782463", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377842, "uuid": "d27737c0-f657-48d7-8f0b-36279adb9863", "value": "T153858DBB91B499CD725C962DC205DBBAC0E8F2B04A03B539395CBDD9C353FD65821B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377842, "uuid": "b6f5268f-9529-4366-9876-940c1c4bc9dc", "value": "49152:EojvbzXQghjvfMSE6JvDOIfFktU6fhRl+i8DLVdyA4yDNeiiIQxOhmL:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377842, "uuid": "bff3c625-4c15-433f-a47d-9a003ae124ad", "value": 1755226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377842, "uuid": "21284857-42b1-49ab-84e0-d61db4214596", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377842, "uuid": "ffc4c4d1-3025-43b9-a458-f3d0db035526", "value": "ps_T1kaJ4PPEgpG_1773827197944.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436f596d-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777400569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400569, "uuid": "6ea9aebd-05a0-4d74-8fd9-67bb46e1bd5a", "comment": "Malware payload (ConnectWise)", "value": "e8f30f9f22980d68a6c4ddfe0ab0d45f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400569, "uuid": "1804ce9a-f229-493b-879f-21f5632b670f", "comment": "Malware payload (ConnectWise)", "value": "6282bc357c17dabc9cdf2a87dc53f063561fec8cf770d57fc4aa48bd9e6f918e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400569, "uuid": "76bebd92-d791-4d37-b4ee-baf795b79e3f", "comment": "Malware payload (ConnectWise)", "value": "680a8e9e4c7122240f7ba51a0534068c5108bbd0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400569, "uuid": "98f7d89b-53ea-474d-9eb9-6ac2d9560b83", "comment": "Malware payload (ConnectWise)", "value": "cac71c806ed6ff9212d673d7eb95d49868a950c92a4b18dd41dfa83d49268d0a78052ef3b24823d68be110c8bb16c7a0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400569, "uuid": "880f7c72-4fc5-4b86-8097-6e01f4b82eea", "value": "T1D5A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400569, "uuid": "a0ce5495-7a47-43f3-91e4-31dabd9be307", "value": "196608:RnCtVYqI5MvbWEpKkqUIJqKSnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqWnCtO:pCXvI5MvHxIJACXvI5MvHx6CXvI5MvHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400569, "uuid": "cada453c-5497-4ae1-a0d1-81e5a4d36ffd", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400569, "uuid": "9fe13184-18c2-4a4b-b57b-87cd2bceb88e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400569, "uuid": "400de1cf-0ab8-46ae-a62b-bee55192a38a", "value": "ScreenConnect.ClientSetup3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d68c8d4-42db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364589, "uuid": "d03ca1d9-5cf9-4529-84e1-a61f57dd2e71", "comment": "Malware payload (Mirai)", "value": "840e6ec2175c77408a0ea07dd9423308", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364589, "uuid": "19652b58-7398-42e9-babf-b1c4e1271a9f", "comment": "Malware payload (Mirai)", "value": "6330ffa1c3268c3810c009b7478ab69acd5cd96028787ba910c4b8e3e4815407", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364589, "uuid": "8a4b4231-a49c-4536-a87c-5f37453d84cf", "comment": "Malware payload (Mirai)", "value": "dbd3c8edbf785a73cb1dee99e5dd7f3fc9370805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364589, "uuid": "52dfc0c8-af73-4b27-bf9e-e76e1f1204aa", "comment": "Malware payload (Mirai)", "value": "3b0cc5aaeb6e87f019be2128b902a70ae1abc1918d820bab82afbc401054e185afbcc8f3d2ec41b9e2d841bd3f9cba48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364589, "uuid": "69daba3c-6b34-43c3-98ac-acf119fe12e5", "value": "T18083E942BD429F13C5C221F6FBAF019C37266B79D6EB3242D921BF9023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364589, "uuid": "23b58a5b-b165-439f-9bd4-d37eace5db78", "value": "1536:PKDLhQ3BlLywjmConIxqPONb6uKBJw3Q2bK/rPJtGAIsrGj0AnO3fCba:PKDqXjmConIxq2B6uKeborPJfAOqba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364589, "uuid": "09d90ead-f779-4b30-a423-0dd64bd46efb", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364589, "uuid": "f0012e61-a732-41e7-9c58-37d64d274e54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364589, "uuid": "4df814e4-3205-48e9-b77d-756b2847ee41", "value": "SecuriteInfo.com.Linux.Mirai.9838.20305.14393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d3b033-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355181, "uuid": "4b1181b5-82db-4e26-af55-4139e41e0990", "comment": "Malware payload", "value": "25b3854597bbcb8a542d43745278aae3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355181, "uuid": "f8de1836-4fff-4a54-bb95-2a238ecfd49d", "comment": "Malware payload", "value": "633691f9069638189e74e1f1e2747b2ab154772e27e20abb20b7c20cb753914b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355181, "uuid": "7d96fe08-165f-4cc4-a7ad-0d2ceb9d18f9", "comment": "Malware payload", "value": "c411cf7d51a0a8eb3f0af3ec03d18840ab09a404", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355181, "uuid": "85f1b45d-9971-4246-a5c1-ab5550d1dace", "comment": "Malware payload", "value": "2256558fbc48a7e5fffe6a44abfed55f53e7469e49c4afe093b0c2f793f07aed180a7322a0daa0b5f60b97ffc4b756de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355181, "uuid": "71b96e96-52c3-46ca-86c7-303df356a66a", "value": "T17E37232F0E9C6CCFD788C53605FF1E564ED8CD52860EFCE58DE03A129718B2695A622D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355181, "uuid": "8ef05c9c-7862-405e-b14e-99471c29e4a0", "value": "49152:TlaKglaKnlaKClaKylaK/laKtlaK7laK6laK0laKRlaKslaK6laKRlaKPlaKMlaw:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355181, "uuid": "e180637e-7ac6-4ef7-a526-3c8920e20ce0", "value": 22383657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355181, "uuid": "c731932a-d577-4921-a18a-2e25b85fd113", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355181, "uuid": "26fc88d1-751f-486d-8244-4c4d5a28f195", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7540fd52-42dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777365434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365434, "uuid": "5ba35344-24da-4b84-b930-3d1a62889e8f", "comment": "Malware payload", "value": "6bb7bf4e6f2a8b2bfc1bc8fc923d947e", "object_relation": "md5", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365434, "uuid": "eac1bf35-f1b0-443f-81ef-3f20101ad90a", "comment": "Malware payload", "value": "63e5c46d544ed7193f4e185037be2cb893a539dc53f52396138111006f9bdb30", "object_relation": "sha256", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365434, "uuid": "97ebc284-81c2-4953-9a1c-63b34e36af0b", "comment": "Malware payload", "value": "996e67a698e67f0ce9bd72cb9276cccdeab8856f", "object_relation": "sha1", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365434, "uuid": "a8d08dda-bc7b-45b8-8d24-378b8b1a54b9", "comment": "Malware payload", "value": "aa29c5e2abc84d698021055a5aaad99f43e6d40acdafda3686f826a452326f0907b55212c005220e7db1b8b94541df2f", "object_relation": "sha3-384", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365434, "uuid": "7e213ff2-d5b5-4e41-b9a0-5bf5ab56190b", "value": "T157A36CC275C1C471E976393558ECB961DA3FF9501F609DEB3388126A1E346C09E32FAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365434, "uuid": "c056e90d-4881-4598-b77a-706b9eabda73", "value": "6d2f3f95e68f6656e48bb9c572b7b11f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365434, "uuid": "18988c2a-4674-47fd-a105-60875ad8d497", "value": "3072:ZQM/AwU+bVu6TPWi6ulpv2VrAHxGvJqu3F1v6ZqEUQT:ZX/3rTyUFQhB1v655T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365434, "uuid": "fb8b111b-eaf4-4195-8f1b-a05f5c1e9757", "value": 102480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365434, "uuid": "85f500cc-b452-4828-ac0d-a30d5f971529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365434, "uuid": "99d7ad0d-8013-437d-8752-c7a8c8031bcf", "value": "63e5c46d544ed7193f4e185037be2cb893a539dc53f52396138111006f9bdb30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9aa2aa-42a2-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1777340002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340002, "uuid": "2ea93f3d-1142-447c-bf25-af0144ba2b4a", "comment": "Malware payload (EternalRocks)", "value": "22ac49d1bc3b22f8a1b59e8e2a9288ee", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340002, "uuid": "28602be2-ad08-4c1a-9865-b1799504856b", "comment": "Malware payload (EternalRocks)", "value": "64038aa9e013fd24b44730e22297fdbf2a5723ffaeda892a247e74cb64ba3bd9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340002, "uuid": "a91cf477-3f36-4602-ba9f-ab5a8e83dead", "comment": "Malware payload (EternalRocks)", "value": "5fbb2aabf52e4b86b8d6f21bc2ad07194292ce43", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340002, "uuid": "3f796a74-1e50-4ce8-9a05-315332ee31af", "comment": "Malware payload (EternalRocks)", "value": "cc5780bc218aa39757291db4ab59d9713d83196777811b89ab558ad76ec1817b828715258a08a64934bdce0dd5e06776", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340002, "uuid": "ca4d6730-b296-4d40-adb5-2801867bb682", "value": "T194A53300FF6A5DAD0B60722F787F4F0967BE8F52A408A51243D6FC5C275EB04589E7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340002, "uuid": "052a072f-93ed-415f-937c-1d64b6b40c24", "value": "24576:HkqMydT7Wu33T35zsBNUFbD/15kC5Y0c5XgJJZ8dhyCxSK3IU8Eiq4pHU1n7LB4a:dMqTy0LCBNOaLSKoSqUdjPW0rQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777340002, "uuid": "878a9a43-d616-4dca-92a8-057cccf1c8dc", "value": 2264233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777340002, "uuid": "a84cc8e5-0037-47c4-ab84-62dd844bc934", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340002, "uuid": "63287ebf-2d96-4d76-95f5-e8e79d2fa875", "value": "wscript_8286.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e152e5-42d0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777359664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359664, "uuid": "6da0e151-e7b2-4606-b6a0-cd26098e38d0", "comment": "Malware payload (AgentTesla)", "value": "5cd5e8ef66e625e34a28b00720698dd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359664, "uuid": "e2862ac5-4301-4250-9431-9a07213482da", "comment": "Malware payload (AgentTesla)", "value": "646fbc1fad26ad078c4f14353da03d25670b5f324a93599703b19b00de105325", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359664, "uuid": "6b721888-8b2d-43fe-833e-af228994118c", "comment": "Malware payload (AgentTesla)", "value": "446819931d2dba182815ec28e3a60ec3be53b543", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359664, "uuid": "7a0d368b-472f-4d29-a7f6-c43c3fd88a3a", "comment": "Malware payload (AgentTesla)", "value": "0938cebf7f24d7cf8fd3e042dccea60f5ca79e53ed60c9eb37ad7f8f9331c368f1559cf0f6e3d434d22ff396eebd6676", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359664, "uuid": "c2dd824f-978c-4cdd-8d6a-a5f8d9fa4184", "value": "T13CF423423FE16036E22A9B364F3755BD120DE7E40B95963F3350325AF5E0EE7AD08689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359664, "uuid": "b8000980-3f66-4c86-b6ab-6fe39ba2a57c", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359664, "uuid": "dd294745-e3d2-4f6a-8e29-67c54685cf72", "value": "12288:j+ZFKrSteCSZjNfaKxad6Ziyc2IuNJO1opFMg5m+ajc4pVGYRY:j+ZFKrSteCSfaKxaTyeH27A+IlpVTRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359664, "uuid": "03f3377d-76b5-41b3-bc48-2dca029ba574", "value": 776976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359664, "uuid": "3a6eb07f-36ca-44eb-b191-3a1c7b95ba75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359664, "uuid": "f12a50a2-9b64-4c15-883f-91cee0ee127d", "value": "Po.0968978AGTH68886869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936ff8d5-4335-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777403281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403281, "uuid": "814bfa59-e0f3-4c16-bd60-530878c7d617", "comment": "Malware payload", "value": "0e93f3ee900fe6d285d18d4ef25aaff9", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403281, "uuid": "cd21d31f-892e-407b-9b2c-5c8f88f5c1a7", "comment": "Malware payload", "value": "6530b7c8d9c8a48d16c94670cc9755f09b0d09efa92d65fbd1f9c7ebadce6630", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403281, "uuid": "4ec1f701-8ac5-4c05-b88b-acd74484d084", "comment": "Malware payload", "value": "9042d2f471814f3f81036103df0b990424ff36b0", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403281, "uuid": "af61a1f7-2083-42a5-9904-7701182a87ff", "comment": "Malware payload", "value": "aebb72eb1e224f618568b42f41c918e91af3f14ee9884b5c16b05243c9c5a0aa7e0ab5ea035fa9d14182926efbfa706d", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403281, "uuid": "480b73bd-25bd-4b16-9ed2-8a3457adbdb6", "value": "T13106BE07FCA515E6C0AEA23289629196BB61BC481F3123DB2E90B7783FB3BD45D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403281, "uuid": "190835ab-85e7-468d-9a6d-a3d41c925870", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403281, "uuid": "ccec1a4e-8f3a-4d65-8167-8b931fe5c492", "value": "49152:IrapJOCXmbaDQAsezwK/g2IjYoyZxmWsf7okLDDm/z:IrQwCWi7VwWsf7LLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403281, "uuid": "3a402642-9a11-457a-9f5b-02cbdd0314ad", "value": 3834880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403281, "uuid": "c4622d0b-29d4-49f9-a750-aa4b7566733a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403281, "uuid": "3d88cc4b-20cc-4146-827a-97d18e820e05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e0e3b2-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355468, "uuid": "777fc9ea-f2bc-4377-8722-ed2b153cb048", "comment": "Malware payload", "value": "b2fa057e2b679c052a380392795efefa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355468, "uuid": "03b0cc6a-2dd0-4739-a5fe-af817700d5ff", "comment": "Malware payload", "value": "661292b8cf677fd7625c45154da14219f707a2019a64add074e7886fd7882de5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355468, "uuid": "6d85759d-ede6-46de-8bba-7c061d4909fc", "comment": "Malware payload", "value": "fc51ddf7518985ee48a9dbccda82c5437187136f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355468, "uuid": "f88e8821-e992-4059-a838-620608e12ef4", "comment": "Malware payload", "value": "20efa1379031823757304fa65af4121fa96cd8fa724e0bb50fe6d2ea47583a14a005b7ac0371fdbc29b050738f3ce62e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355468, "uuid": "3b76ca67-4645-4f48-990e-219629218447", "value": "T1BD2723931DFA9C0D01FD3B74C0BC2D6E2DA6C554811AB75B29FB94CBB10A9B6301A1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355468, "uuid": "7a73a13a-969c-4a1e-9563-778d22b45f6e", "value": "49152:lxoKtnmxoKtn6xoKtnVxoKtnmxoKtnCxoKtn4xoKtnSxoKtn+xoKtnzxoKtnsxoF:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355468, "uuid": "c9854e1e-3e39-49b1-9c32-d7a9da9d99fb", "value": 21343164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355468, "uuid": "5f1a4294-fecd-4af7-9078-69736741436a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355468, "uuid": "068bf6c7-cc58-4291-9690-20ba9967508c", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb2c4fb-42dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777365418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365418, "uuid": "ca34eae8-a689-49a0-ab85-d1813b78c643", "comment": "Malware payload", "value": "d7274d30669832ae5247906b3c9e7c05", "object_relation": "md5", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365418, "uuid": "c60ebfc1-ceba-462b-8dd7-4fe3ff3f1633", "comment": "Malware payload", "value": "661d893348c0b95abcad8e8f5bd81079fb3f2392b1fa6dab89f77fd1f1914889", "object_relation": "sha256", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365418, "uuid": "57a27471-4a39-48aa-b5bc-2c5131379b7c", "comment": "Malware payload", "value": "7eebc6617a9c80ff1129a4dfcdb174cf17e3fb63", "object_relation": "sha1", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365418, "uuid": "aba3919e-62ba-4aa2-ba4b-c62ca2e13a07", "comment": "Malware payload", "value": "e5570989e5449e07c6f788c4117fe2ca9dfd5dd70feabbd87028becffa59d4d40cccd4dd3b9b0a56b145364b3656bccd", "object_relation": "sha3-384", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365418, "uuid": "29df854d-54c1-4a35-8869-26c68025360e", "value": "T12DF5F13FB28B353EE06E5A367AB6A210943B666165134C16D7F4C88CCF250B11E3F796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365418, "uuid": "4bc0c96f-aa59-492a-a954-461dd22adabb", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365418, "uuid": "06f53a86-e8b5-4014-9d8c-b458aae6151a", "value": "98304:E5OeUFoWkFXz7mOihVI56BTchBG5mAe41s2SvR:gpKoNmOihVIhBG5771sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365418, "uuid": "302912ad-ba80-428a-aa96-33d887f5d14b", "value": 3364856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365418, "uuid": "1465472c-b116-4e5c-b03e-309b9b58c22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365418, "uuid": "76c16d69-9496-4ee7-be54-6e401902342a", "value": "661d893348c0b95abcad8e8f5bd81079fb3f2392b1fa6dab89f77fd1f1914889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433b6c86-42a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1777341728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341728, "uuid": "6bf2a13a-280f-4a47-9143-b2be3a96ee68", "comment": "Malware payload (Prometei)", "value": "ad3786e2502c934af6373d2551e1e7c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341728, "uuid": "433bcabc-d0c5-439e-b3b9-b6f6493d7029", "comment": "Malware payload (Prometei)", "value": "6665b814f6f2aaad5d603684c7cdb5171058ecd08490b84d9d1f494ae7332357", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341728, "uuid": "750b07ee-5e4f-45af-a73f-d00fe867e6c7", "comment": "Malware payload (Prometei)", "value": "50d4deb756b7d57c1f4eaa3a4b5970fd55f21c0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341728, "uuid": "3e8d6181-515e-4f57-a611-78af871f63ca", "comment": "Malware payload (Prometei)", "value": "b3f753879457b0abca3d3598dece616670d1d9f24ac17d1481bf5ede8bced862a5e67a382805b7e6303f73cad45b5a20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341728, "uuid": "fa5db07b-1789-4dd8-9e96-74b9a0fadd37", "value": "T1B68533256813F6F4FB41BE6AD3AA76D6184490B38C5E28103D41DBB66E7E8FF4739102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341728, "uuid": "71a6a1d8-1757-4777-a7ba-4e5182b8d133", "value": "49152:cRAZ9Zj8SmdMD3iQ8fxdKB54G0bOnplx3R84Cv:cqlLWA3yfxXPbYTFRZCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777341728, "uuid": "a0833487-86fd-4570-a65c-b5403fe8d820", "value": 1773400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777341728, "uuid": "795b8e1c-0e79-4102-9057-e11f47804c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341728, "uuid": "7c7e11e7-ce9b-4c67-8af3-895854de47a2", "value": "6665b814f6f2aaad5d603684c7cdb5171058ecd08490b84d9d1f494ae7332357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52442495-42f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777376113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376113, "uuid": "43fd7ac6-f767-4a0a-a658-189c7616298b", "comment": "Malware payload (Mirai)", "value": "76ebec4b6e0e791622d51090c7e47757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376113, "uuid": "c7e099e8-d35a-43b8-9e34-dc2b3c982034", "comment": "Malware payload (Mirai)", "value": "6691d19f8eb9cd9b6f90fa99af34e74a2e869fc042b7649da80b1a8175276943", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376113, "uuid": "ff3d88ee-c39d-4a63-876b-4ce53fd92148", "comment": "Malware payload (Mirai)", "value": "98f12f9b82b16d58910129fdb8ad4ddc8d17e8be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376113, "uuid": "a4c4e621-d0d9-4119-a5b7-8d4eb6124846", "comment": "Malware payload (Mirai)", "value": "e4b0a106765164d0055cd4a9f967d2e6bcb70ac53984c682e1b7c5d04957f8fc03b52e2356fc6ec1c4e1913ececac4ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376113, "uuid": "37a49692-7703-4f0c-81a7-cd1ba3d1a4e9", "value": "T13EF47D9DFE4E3D41E2DBE37C9B4E43E1A21BB190D32351A33942424CD4C6AD9CBB156A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376113, "uuid": "45fc3d27-338a-4bd6-ab92-1ce8db0946ca", "value": "12288:3w3KSqVb2l9vXTuFDozmSw4l+PXlNwnsRbkP1w5lTi9TZfP:3w3KSQilioawl+4n/aid3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777376113, "uuid": "c0de9791-fb28-4f92-9b17-82800b9bc26e", "value": 729248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777376113, "uuid": "09443825-d199-4978-a90d-8551d011285e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376113, "uuid": "fb0eb66a-9e76-4f9d-9084-14ecb3b2d793", "value": "agent_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51291930-430b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777385131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385131, "uuid": "42c6fd51-0e72-47b9-9da5-a408ff787b5e", "comment": "Malware payload (ValleyRAT)", "value": "93fc7f10c5a533ea25270aa017c2e461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385131, "uuid": "b753656b-84b0-4daf-84b6-f1953a669c21", "comment": "Malware payload (ValleyRAT)", "value": "6847e6a295e8312a990752c9a0662f5757e096d3ecde43776caa2943f016da11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385131, "uuid": "ce4e5d8f-9bb1-4239-b5cc-7125dd967534", "comment": "Malware payload (ValleyRAT)", "value": "721a4090697392fedc57850384d843694342de75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385131, "uuid": "4ce4d532-3335-4f37-827b-b900f5301842", "comment": "Malware payload (ValleyRAT)", "value": "c5efe5257fad8cefa4b20d2cc16c81e8e13569d95a54484fe56a03fc4367f48465dfe971387214f47a7583c1e254b68a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385131, "uuid": "53c63770-4fab-47a6-aeec-534e915a0fd4", "value": "T1C6062321BAF4E6B1D45016323E5593B205782DF5FE60A7AB1FD6326A56310C28F31BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385131, "uuid": "2d97aea0-7a52-479e-b3a9-cac375d37ce7", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385131, "uuid": "0d835327-9721-4ee9-a112-3e9bfb2e146e", "value": "98304:0V/ulkFF+/3sz21uNmpMsuRuqU3ZimspJat5Q:0VKXNgtRuqU3ZApm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777385131, "uuid": "affa652c-f5a6-49d4-bab7-a402f6e947b9", "value": 3947694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777385131, "uuid": "5d1a93f9-8e25-4cb1-a60f-80a9494ed126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385131, "uuid": "9b83935a-d3ea-48cb-a793-1c06a20e935c", "value": "6847e6a295e8312a990752c9a0662f5757e096d3ecde4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7766f54f-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777365008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365008, "uuid": "bf8fec08-f44f-46fa-ae28-d926ea268103", "comment": "Malware payload (Mirai)", "value": "714234306b3c964f6594e50dd05c3f4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365008, "uuid": "5da5ccd8-68fe-4b33-bdc4-4ff850be737d", "comment": "Malware payload (Mirai)", "value": "689e0ed267f94cc65e40a2befd45472fb22549093a85a2d2ead71e9d9390c608", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365008, "uuid": "3cd46dea-1caf-4572-b45d-aee94801fdd3", "comment": "Malware payload (Mirai)", "value": "ec6012107afb23712629e384d393f1f5339c064c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365008, "uuid": "3e258928-6298-44fc-b10d-e86f03838882", "comment": "Malware payload (Mirai)", "value": "2aab4514c025491e478a71d2d2a9a6e1efab87e59f57429d2ad8e709e721075e2d0ff4f3fbd451354df9b1103e056b63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365008, "uuid": "131175c3-21b9-4994-9e80-4cb5179605e6", "value": "T11083D85B6E219FBDF578873047B74B20A76923D633F1C685E29DC5002E6038E585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365008, "uuid": "d2b09459-63b2-4cf5-8852-30c2e371c012", "value": "768:/W6dQ5zzL9YP3Oo/kUQB/AyrRpe/jUMMIxkUCcJvwI/DwHJc/X4qdWEdCIOAQE:e6C5zzRYPO6NObe/jfCaoJWIqcaCFAQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365008, "uuid": "e6b9ba4b-3127-4cfb-9606-ca479479ea36", "value": 81452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365008, "uuid": "56f2c706-7300-43a1-a970-96c86e6d49ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365008, "uuid": "d4d9e568-ec9d-45b2-8bfb-ff13ffa83dfe", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5790fb77-42a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1777341762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341762, "uuid": "3dc0fc0f-0ded-4006-bce3-264aaa18d314", "comment": "Malware payload (Stealc)", "value": "48692ae47e882cb674715303096f9715", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341762, "uuid": "61ed1f14-7e62-4b65-8852-51e8b4354aa1", "comment": "Malware payload (Stealc)", "value": "68a6c348585fec6f7709edf87f657b502fb3422fe82b5cae239b249595a3862d", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341762, "uuid": "95000e59-6412-4441-b569-d33fbda9dd11", "comment": "Malware payload (Stealc)", "value": "0f8e4f267c3375279b417737a452cf3e60ce0bb2", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341762, "uuid": "79c010e9-2b0d-4da0-812a-e1c39178d33c", "comment": "Malware payload (Stealc)", "value": "7383302188c275f27ee9226f0be6a113fe256ab26c6131f80eee1ef6ba9de346ad033918ab57d5b0eac0b2ce0b718985", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341762, "uuid": "8ba06867-873e-4414-a778-a2d49d6e162d", "value": "T190562AF311D2EFEFC856D07E8323F93E878FB4770926A4A39059A61A4A2BC447655F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341762, "uuid": "48a766fa-6894-44be-88d8-57ace42ee495", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341762, "uuid": "d391365d-0107-4e51-b9ab-3c9b10e22a01", "value": "49152:Sjc2O3OhgBuayUbMKAzYbxPqH1weOkw2Ng55RdwOWpa+e9BxyKHmy5AgP5X07SZF:wc2i2N8ejIxWpa9BsKH15k7ki9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777341762, "uuid": "3f72d48a-efc1-404a-ab57-1638fc82cb2a", "value": 6107152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777341762, "uuid": "f3107bb4-a007-45ed-bf59-43759532c381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341762, "uuid": "074c627d-e19d-4f2a-b3a8-02ee42a748bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4953be3a-42d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777361925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361925, "uuid": "1fde0e7b-0b61-4026-b492-1ffb2dfc265f", "comment": "Malware payload (Mirai)", "value": "9c6f291a445360b2cfbf446600380b5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361925, "uuid": "83dc0a5f-a55b-40ff-99b0-cc726489fbe1", "comment": "Malware payload (Mirai)", "value": "68bcc8dbd235e1ae581a7c2d77a358cd9cc060d79a3a60f74ba3336dbfa3dede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361925, "uuid": "eb4bf684-b433-4564-8a60-17cd16e6a91d", "comment": "Malware payload (Mirai)", "value": "7822866bef744269e9575d726df223a50217d5fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361925, "uuid": "ec48398a-1f9e-4ea0-88ef-7215398ae94c", "comment": "Malware payload (Mirai)", "value": "b55f4d6d41d8ed244c7bc150021b1e0bc11b4e5b26fcdf945bedfacb9420b3b252b9520156269ecc2b20f7f5074e821f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361925, "uuid": "e4532c00-3c61-493c-9583-ed5f5b3d407d", "value": "T15653AEA6C819BDD4C4008334B422DEB42B63F40596671EB98E8789955487EFCF61E3FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361925, "uuid": "92c3ee97-c8cd-40ae-8742-4f586476b52e", "value": "1536:Oa8tF/MUQ75ifwt1ARSAmJF/Naz/TlHmrmCwM:OXttMUQ75QQbOTlmrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777361925, "uuid": "245ba269-a353-47ea-bb85-f01fc6020bf4", "value": 63884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777361925, "uuid": "24643126-0644-4268-bca2-2a7dd972a2c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361925, "uuid": "e39ff546-8306-4dac-9099-4d49ccb771e5", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a814c3fc-42d0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777359936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359936, "uuid": "5aadaf78-2b31-47dd-9de9-b0cb09a18987", "comment": "Malware payload (AgentTesla)", "value": "0b21737d71e755e6408ba5e5fa587e38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359936, "uuid": "fffc00d9-81b9-4416-8132-da044bd77f84", "comment": "Malware payload (AgentTesla)", "value": "68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359936, "uuid": "2ca5fd30-0c14-4ed4-b44e-8812ed43ee09", "comment": "Malware payload (AgentTesla)", "value": "e9c23bddf4d8ea3e137f3b5ae9f9442e47ed8973", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359936, "uuid": "6ae05fcd-9248-46b2-aa4a-35f1e48c6d54", "comment": "Malware payload (AgentTesla)", "value": "d3d687aacfcc5a2b6ab568952fe2da85916a1199bf7aa38916ab5f97a012bfdb1c11581421ba5e743a50a7ff94c092a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359936, "uuid": "9b55396a-df2e-4b9b-8620-fad3a419afcd", "value": "T14343C02729CBC87608F0851EAB19374BF71CE4F55B48E5DC114A92DE201CD6FCA87B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359936, "uuid": "5262a5ea-f126-4dac-90c6-67924dc6e5fc", "value": "1536:Cq9RCQPzRrfpxKKet2Z+9SI1XFallxRe6PE+bhHyj:PRCzKeoZ+9SOXFH6PE+bhHyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359936, "uuid": "f932b158-b89c-4eae-89df-93b212f3be38", "value": 57817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359936, "uuid": "5ee41e2a-da1f-40e3-bf39-f7618cbbeae6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359936, "uuid": "c03c22a5-643b-46b5-975e-ac2a529d069f", "value": "copia de factura.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9666b2-42a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1777341720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341720, "uuid": "b7802907-82f8-4135-96c5-2d2454a6ebec", "comment": "Malware payload (Prometei)", "value": "5e92af6eac16fa817890f2a5db1c06ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341720, "uuid": "d1f71af3-6186-464f-9cc1-785a94565d81", "comment": "Malware payload (Prometei)", "value": "68dc22e4d663df79302fd11255abceb33401d634219af19684f08f57a787a3ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341720, "uuid": "5da8493d-aad0-4f5e-999a-a380d4737922", "comment": "Malware payload (Prometei)", "value": "c0583343e86d743c9a3c3f7ee91fe34a0dc12930", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341720, "uuid": "42f146c8-4013-4722-9ecc-dd242d1bf143", "comment": "Malware payload (Prometei)", "value": "4381ef774ecf30492d95653d2a213b0b5b24ff99b04b653dbc48d146b4acd7514916da1b38ac1d490ef092ac783873b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341720, "uuid": "bf187938-ee59-47c0-9722-9226fb4444a9", "value": "T134746C01335E9AD7F167187060583A735DBCD630A36F18B7F7C56C89346CAC0A6A8B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341720, "uuid": "c2292f63-9ba7-4263-9a68-a163f288b0e5", "value": "11d7574f4124bae26b618543eea709ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341720, "uuid": "7d3df8b4-42bf-428e-88e1-c81ce567ca93", "value": "6144:mcz0c6+T08MV6uK+WjXXDWHOd8fVMvEf50bx:XX6j8MV6uK+WzSHOd8dMMfex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777341720, "uuid": "517e86e0-10fd-4cab-bc73-b85859ffad30", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777341720, "uuid": "53ada8d5-3bf4-45ca-b7fe-1e79e0f84153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341720, "uuid": "3d5917b1-4cdb-449d-9044-52256a27ca01", "value": "68dc22e4d663df79302fd11255abceb33401d634219af19684f08f57a787a3ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3854871-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355311, "uuid": "68f12cf5-d810-4d15-bd8a-f28ae7e04d36", "comment": "Malware payload", "value": "97afee89c70d807470a974ece284db0e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355311, "uuid": "99f105e5-9181-4634-b673-7e3d6be388cb", "comment": "Malware payload", "value": "6971b4b645896e3239f758ee2d8d94039166d0a8a2e77742429c78a179192c5d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355311, "uuid": "2103eabf-805b-44cd-9d44-f160d199bd59", "comment": "Malware payload", "value": "4b2f7d332566ca8849e73e0d3fe50dd4f378e851", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355311, "uuid": "8cd29c14-11c0-4ef0-b1a1-42daae94f37b", "comment": "Malware payload", "value": "74dd8c758ff1172906a9528ff19dc1cdf6eac529cf8c08aca8ba6a53884b76ba56619ed81c05a5dc68e38f807aee6ea9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355311, "uuid": "139f2d8b-f280-4079-8ea1-d53a5a563f49", "value": "T19F3723044AB80C5F0BF75E49603E9F5BEBD81F54810E71F2AB43B876ABA5B4C3597620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355311, "uuid": "f73c7820-ce3c-465e-aac9-cd6c22756685", "value": "49152:NuhQuhGuh7uhCuhYuhKuhguhpuhZuhCuhLuhbVNyuh8uhbuhfuhjuhwVNTuhjuh4:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355311, "uuid": "015b26eb-9f53-4516-b698-911c579c9f4f", "value": 22903943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355311, "uuid": "b47291cc-870a-4b6c-bbb0-498255943402", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355311, "uuid": "be61a5bd-eff8-4df6-89dc-59af29450587", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fd1654-4332-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777402151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777402151, "uuid": "3b4b057b-baba-44f2-9bcc-f1cdf336edc1", "comment": "Malware payload", "value": "d6aa4e0a37dc990ea0fd934f2e9e11f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777402151, "uuid": "fa92b556-55cd-4c46-bbed-74fe6e7ce689", "comment": "Malware payload", "value": "69b89845c4f4d92ac33a7cecb47b1eee08e626966ca63b2c537dbe39940ca0b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777402151, "uuid": "52ac5822-8208-4b24-9d27-183277826329", "comment": "Malware payload", "value": "b0327beb3de77d276c735d0e66c3b8ec652951ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777402151, "uuid": "00b1d304-7bf0-4622-b6f9-a1bc8742246a", "comment": "Malware payload", "value": "0f2324367cb811b91e5eade0804477ef4ac8500b50c378dfa1692ca049916996444bcadac872b71aac7f2dd037afbbb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777402151, "uuid": "d725939a-6b16-4b13-9838-767d1f52c624", "value": "T191532A07A1D360FCC18BD1748A6BD523AE32789412343A7F2BCCEE752E55E52276DB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777402151, "uuid": "b79e9273-2a19-4b34-a7c4-c4a4ede9ac52", "value": "1536:fTpKcj0X4y3Z2JAv+btwrag7dwlMd34AD0iUr:f1KbIy3ZuAmbtgelMdo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777402151, "uuid": "01b459fe-7fcb-4199-a37b-dc50bf263420", "value": 62760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777402151, "uuid": "f58f24ac-0fee-444d-b227-e85a96c5f9c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777402151, "uuid": "ccf60c61-7b53-4dc3-afde-d2679734d61c", "value": "systemdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40277fc-4340-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777408087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408087, "uuid": "e15ea0d2-4c1d-4cdc-881d-29db0593e83d", "comment": "Malware payload", "value": "165690dd534792fde1ed7dfaf03924a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408087, "uuid": "7041cd0e-3cef-4d93-94e7-536d1c11eadb", "comment": "Malware payload", "value": "6a49c2a914be2b6a841b9ac4d19a2adba6fe121731b813ac6efc79d84569a2dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408087, "uuid": "3b9fb1c3-2acb-41fd-9d53-f175570b658d", "comment": "Malware payload", "value": "75ed96e519336402caa433bc571ef224858463f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408087, "uuid": "0e268168-0858-471d-ab09-56bdb86fdca0", "comment": "Malware payload", "value": "5bb290c84bd3f000f6a5c14f8628cfba627db8d67d58ca524a6fbfe80518956284686fc526df28bc48ff5fe7873b57e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408087, "uuid": "275410a5-7fae-45b5-ba7b-33e7c25d1d17", "value": "T108F58D57FCE508A6C0AA933289B652967B31BC490F3163E72F50B2782F72BC49D79744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408087, "uuid": "b74da24e-3f7d-456a-aaf8-4971b3a7b46d", "value": "49152:c9PEqBhaKHSIhgPLZZDtr4axf+l9garrZknHGtaesXyTDNKJFfo9pN:c9fBnePGWmHtHsCTDN+oXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777408087, "uuid": "d0414a68-a327-49ae-9836-16fb54e185d3", "value": 3387083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777408087, "uuid": "e36c3716-c1cd-49ba-8cf8-1bd97e2b44d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408087, "uuid": "262d3148-5ffb-4464-a15c-ccd17c66d9bd", "value": "server", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1939b3f5-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1777400499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400499, "uuid": "ab5f39b9-791c-45f3-98b6-74a6454d6a62", "comment": "Malware payload (DattoRMM)", "value": "fd1d41cae8a978eae1ddf3bc65c51752", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400499, "uuid": "08afc4d6-fbdd-4703-a796-1eaf5a85cfc9", "comment": "Malware payload (DattoRMM)", "value": "6a64212f80b46ecf854b35a9e7ce8b5361d48fe2902be261735eba0a5e4710b8", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400499, "uuid": "5f6977da-fbad-4d85-bc5c-e5e7f53818ca", "comment": "Malware payload (DattoRMM)", "value": "b60c0032d557af7f7f53820359dd753cf15550cc", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400499, "uuid": "f5d92312-be74-47f3-aae3-09d52949af3e", "comment": "Malware payload (DattoRMM)", "value": "306c68dfe1e8db95203e2aed4c76aa4bfd8217d8250e7263433d83ef8fd4df1228a5473aa971f6cf072b844c18f7c848", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400499, "uuid": "af671329-3736-437b-87cd-6e06e1d0b4d1", "value": "T1E4B63347DE3B8EF4CB63463C89831A57124F598D8C47E4C9E0082E3589E799ADE38F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400499, "uuid": "d1941971-9fcf-481b-878e-d9e654b799f2", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400499, "uuid": "78d10baf-f821-41ba-bdd6-2adc1cbca61f", "value": "196608:KaZk+wEbLGmnYZJukGkxGB8rM2VPFOsti7A95vM9sFp29XaIT030HyyG+zzDp:gnenkGkx08rtE7AnMGp29qIT0WzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400499, "uuid": "7783df5d-cae9-4414-9bd8-50b52d6e669c", "value": 11055464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400499, "uuid": "f4bbb5bc-8e6b-40f7-96be-06aad9b2c3dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400499, "uuid": "7a145e84-66e0-4a27-a8f9-7c97253803cb", "value": "chenabachner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4045ed68-42a0-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1777339146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339146, "uuid": "cac3685a-1010-413e-936d-db162dc29d29", "comment": "Malware payload (VIPKeylogger)", "value": "a91b72d69a4a16a4b78aa272e8ea23d1", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339146, "uuid": "917bf638-b686-4c95-ad34-ba0ed2b55358", "comment": "Malware payload (VIPKeylogger)", "value": "6bb6b965818ff8ccaf82766e8e1b71d071031505d204f24f0c7da7b0358187f3", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339146, "uuid": "615db39d-cc7d-45f9-b0d0-de663765fd85", "comment": "Malware payload (VIPKeylogger)", "value": "1ea63d62372ad752484625d0ad7effb41cb900c0", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339146, "uuid": "3ec0a96a-318f-4a51-b357-5fc00627947c", "comment": "Malware payload (VIPKeylogger)", "value": "236777ef4a89bb2edda2a62d51069e045e4d20f5fe2e882de1427fa19e85e99283325ec87e74527aa0fbd6c3fef10b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339146, "uuid": "ec0dceb4-a4b5-480e-b82a-b5e36ddb130d", "value": "T14213E9DD35E7B0A4065670A32D2AB059FABD1C86754C8190F9D4A8BCFC2433CE576A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339146, "uuid": "ab7bf6b9-d903-4654-aa2b-374b9f5140c6", "value": "768:maEhul9eNaBN3v8iOa/NEOYoG7eRELQlub1oRKQwe96QWE:xAaB18M/NEOYoGRQubHQ3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777339146, "uuid": "8c40400d-dd05-4b12-966e-ae95cecd46d8", "value": 41684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777339146, "uuid": "a1c4396b-49f1-444c-856e-14d46bfd4d86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339146, "uuid": "6eb2165d-641a-42bd-9311-de8a93ca7462", "value": "Payment Swift.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d851fef8-4318-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1777390941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777390941, "uuid": "9a384f11-21d6-43cd-9d1e-4ce4a02ae206", "comment": "Malware payload (DarkCloud)", "value": "b4ce26cb668cd1809cef9f30e5fe834d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777390941, "uuid": "5035b4ca-6317-4300-b5ec-61f49b8bfd77", "comment": "Malware payload (DarkCloud)", "value": "6be1ef4e277daf12f2390d53d35de79ca87c2869163e1a9bdea2208daea2b942", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777390941, "uuid": "c6aacf2a-512f-4826-ae7a-9a66c0df7e87", "comment": "Malware payload (DarkCloud)", "value": "cdd04acb3efa6f112f9f391ee8cacd87f9da6cdd", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777390941, "uuid": "0b4dfb5f-7444-4ba7-9232-a6a0cb27b5b3", "comment": "Malware payload (DarkCloud)", "value": "f2b0a75b70258f15509e4bed91535856e26d35e5859874dec1a6ee604ee024f4ca2ce58c3ae7b2e83d1b66e97dd424e3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777390941, "uuid": "e066c4ca-3bb3-4a22-babe-51f9cd65e2b6", "value": "T1CE45D0256DC32AA4D1A91F78C2E5049967F08D1B5346F32B6ECD33F5DEB238AD903912", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777390941, "uuid": "8a8d36e0-8655-4fc2-9e6a-55ab423b006a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777390941, "uuid": "c84a5a4e-2322-41e6-be01-e0ef151e9751", "value": "24576:WwVUFHQWRTLqdL4DHJ0UOuauvMxH8cFk18Ok:WwVcuWJ9Halxcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777390941, "uuid": "aeee0d1a-a37f-4798-8324-e492818c5442", "value": 1201664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777390941, "uuid": "bfb20b90-e2e5-4583-8349-013fc8e14fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777390941, "uuid": "932fe7c1-36c0-4a3a-9f5b-52c290b0c45e", "value": "transferencia interbancaria (BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e462172b-4345-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777410288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777410288, "uuid": "6e2af00d-ecd4-4526-af56-f148f60eedb7", "comment": "Malware payload", "value": "9994e7cf70cbedf528fd91887b265d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777410288, "uuid": "072c3570-770f-41fc-bad2-98edf0323f2a", "comment": "Malware payload", "value": "6c23b7723a9f69ea48f02c8fe13fd60ecbfc2fb28e32e481c46ec968a66c66cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777410288, "uuid": "393befe2-3a2f-4670-b481-1c4d87cbca93", "comment": "Malware payload", "value": "5e673d4397cb46c2f9650a06ca2a94e4a94db926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777410288, "uuid": "2bcfc507-08e9-4924-9244-8af1b3db9168", "comment": "Malware payload", "value": "47589b904a530c30b4691d2102cca0e99cf647951090d4872bf7edf64da21809763b2eb7b1241185e8e8cfb00cf076c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777410288, "uuid": "3d9165f2-b44a-4737-9cc1-9da25a1dc738", "value": "T17EA52A3BDAB284ACC1ABC170EB8392B1A976FC190534B55F0AC5D7213F4ED705B9E690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777410288, "uuid": "6fd3951b-07bd-4dc9-8fdc-da15e25d0724", "value": "73c4d9a4fab7c8eaadd4946a411a7485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777410288, "uuid": "c9420e73-d621-4b75-9501-6ae6b5eff8b8", "value": "24576:o3aOWrKyPojLoqb+B+wvrdGlYELCK6zLX5C1ySGObPC5sX+LAu:YaOsPojLoqqB+wvRGlYELCK6zUn62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777410288, "uuid": "3be9aac4-e22b-46fb-b460-71dd5d36ed39", "value": 2231296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777410288, "uuid": "3219c9a8-1935-44d2-b9df-61e18394d152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777410288, "uuid": "87327ca9-3c34-4bba-8075-938538207852", "value": "mscomctl.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2afcca-4333-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777402361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777402361, "uuid": "f533be0e-1787-4bf5-b7e0-67a9feba322f", "comment": "Malware payload", "value": "10b40185106eb3760cb71c46117aa0bf", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777402361, "uuid": "6b0d031f-b41a-41ff-a1fb-aeae26342c61", "comment": "Malware payload", "value": "6e36060854006f9ed029ab7547f4478f0486ba5256ce9cc9027248882deebdc7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777402361, "uuid": "3767ac08-6469-43ae-a670-d0e5e30537f2", "comment": "Malware payload", "value": "c2d2332b2bf0fecbea7da05792a61da979499b21", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777402361, "uuid": "dad2095c-d8f0-4ad0-98f6-2d473455ec69", "comment": "Malware payload", "value": "d4fedcef13027ff3f78ad467e19dbebc067e3e09f73532e663e738a5e9c36c0c3355938d4b19805bb8cd1460edd31c40", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777402361, "uuid": "b5a3d8a7-364c-4d84-b7a7-648dc242e6bc", "value": "T12C43D0248B577220E1F3FF32B93D6691D8657D10E6D2979F2403C69D21B3B08AC67B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777402361, "uuid": "8ae7643f-a4aa-410e-a5c6-56c4776939c5", "value": "768:km6w5JQhgKVjJeFJCbdnm7rdW8RhejSaCRWrY/CGD5uLiNTKUU+EvmEfoZ4+K:km5WhgKqOVm7rZHIcr/CGD5uLmdU3eQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777402361, "uuid": "7bf47a83-08a4-478f-a311-3f976676a57d", "value": 57774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777402361, "uuid": "52be2874-7024-418f-9e19-9b47bff9eeb8", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777402361, "uuid": "ab9ea451-7e24-47cb-9425-51feba04e768", "value": "NovaCX_Agency_Updated_2026047_091100_version_1_8.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc349e90-42dd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777365553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365553, "uuid": "707a7321-fc1f-4bfb-8fc7-bcd2a6a7edf6", "comment": "Malware payload (AgentTesla)", "value": "28b6eb4cc7cfc9d9bacd8201a2f475de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365553, "uuid": "160a592a-762e-4a04-a14d-0c6a60326ec6", "comment": "Malware payload (AgentTesla)", "value": "6e40a294a8bc83a959d6309aa18ef12f170ecb07347cd4388d89d4f771bf98d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365553, "uuid": "6de1e1c1-9e55-40e9-a175-b76c228ff2c7", "comment": "Malware payload (AgentTesla)", "value": "a503bd4b578afd98b7d3eb0cb938f5119aac527e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365553, "uuid": "47b44324-5ef6-419c-b566-3e151f7c797e", "comment": "Malware payload (AgentTesla)", "value": "9a90d1f584564b213d5ed7c1b3b50b51352e9664ef06b481e93448fb9aeffe9c8fa768cf69c8c1bebbef7dc3ed031c7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365553, "uuid": "82c36410-6452-4533-9b11-be6427441098", "value": "T17292314EC912846E4EC26B8D5DAF07F1E8B8A1C8D353E928664AA32F6340354D56F7C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365553, "uuid": "1e9849db-58df-4253-9441-84d218805ebb", "value": "384:MUpq0MlAfoB3ghAEWEL0DD0k6ztDqwUYP+RI/:M/efYghAuL0ahDdUYP+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365553, "uuid": "8bf55e2e-44e5-4688-9457-f568d6b1908d", "value": 19578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365553, "uuid": "e72b927a-d872-4b6c-939d-ad63182e17e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365553, "uuid": "9451f6c4-46be-44d4-8efd-ff321cf212d9", "value": "20260428-00326.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138477a6-433f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777407361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407361, "uuid": "4df9b009-3bc6-4afd-894c-86136600d012", "comment": "Malware payload", "value": "d0d3a49a0adfacb72eb83e00ca160702", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407361, "uuid": "694f8ab9-5abc-4497-8d72-7fead8a1981b", "comment": "Malware payload", "value": "6e5507c1676b4f41f5eac58b880edd2fb47a584602205710e3db80a3529fc7f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407361, "uuid": "a1e9256c-e3c3-420b-8253-78128fdde22a", "comment": "Malware payload", "value": "86286a34087934dfdf40db57834e7dc05c82ee81", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407361, "uuid": "b63731b5-8e46-48f3-8c39-3bc30043ae37", "comment": "Malware payload", "value": "06ed1643cc2e4fed6018b85752d5bb4ed77d82eb9a84034bb2cf2325f0ac9c6afc2245aa4b0dccb175e03a487988ee66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407361, "uuid": "84fd5a82-9bf1-4489-949c-e4b2f4c9104c", "value": "T1FDC01260033E4DAA98B79244CCB09E1CA4708DD5078780655D7794C2CC051F045F6604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407361, "uuid": "1933fb00-ffb0-4dfe-91c2-bc18fa47cfb8", "value": "3:YYGRXNVSV5QC+TQjV5A4fA41KipX6A/aBx8DFVVcHMV8D/A6J9dVKqPK:5WN4V5vsQjV5AIAyBpX6A/OUOsq/LdVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777407361, "uuid": "d5fa44ca-cdb6-46f6-ab28-fc1ad8c262e5", "value": 179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777407361, "uuid": "f133ea6e-5be3-40e5-8f13-ff9219d0c1be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407361, "uuid": "36960dd3-e3a2-48bb-8d9c-ff37dca45db1", "value": "FULL DOCUMENT .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de37dcce-42a3-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777340700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340700, "uuid": "597e9615-f5c8-4e48-bc84-02a2bf920881", "comment": "Malware payload (MassLogger)", "value": "6fde7563a87c6f4d37d206fe841a9b98", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340700, "uuid": "66c610d8-092b-4c41-b052-57ca415f7244", "comment": "Malware payload (MassLogger)", "value": "6e9ea88a667df914e3164ae10b8c4893c925784326fb115cbc6acb5ce68e32f8", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340700, "uuid": "8653e784-0fcd-4b6e-9cfc-36ec90ec2b1a", "comment": "Malware payload (MassLogger)", "value": "05a48f95a50f3e9c6d89ca4ba7e1e2293dde49dc", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340700, "uuid": "d4a0b2c2-bd89-4b9b-9f40-ddec53729767", "comment": "Malware payload (MassLogger)", "value": "50d23dce96d0b0408da87f8ccaa78be23e7bb37a11c4ece81bd874b476d7707459aa7262e65c151fcc126138018c847a", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340700, "uuid": "909a81cf-bcf1-4903-9d7f-d74f905d702e", "value": "T100353379584C6D3C0ADCC3E9E077EE0B82A59E9A5058848EBACB65EF33533C61113C6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340700, "uuid": "0f53e558-c3c5-4774-aae0-1c8edcd7fc64", "value": "24576:MfkChNQiLvHn9+sAn3/dqQGp/1eDOotZeCiz3K1+irB:UfLQlK11Rza04B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777340700, "uuid": "141123e1-0230-442d-936b-1b70f2519118", "value": 1114961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777340700, "uuid": "e2d96d70-5be5-4e43-9074-a6dada8903ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340700, "uuid": "02867729-6127-4205-bd5d-f5e1945091a8", "value": "ps_5x5WjYZeV3Gh_1777268525756.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e998cde5-42ac-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777344584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344584, "uuid": "e5875fad-104c-4582-8952-1ef5fab2fcee", "comment": "Malware payload (AsyncRAT)", "value": "1ec41d3036795464e52c05f37bec3258", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344584, "uuid": "d034736e-1fe7-4ced-adbf-a484ac025b03", "comment": "Malware payload (AsyncRAT)", "value": "6eb412e139987a8c83ffc920e10d8af81310de375ace0dfd3895f03514ce0a90", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344584, "uuid": "5716d851-dbe1-4228-9eb5-7d140dde8858", "comment": "Malware payload (AsyncRAT)", "value": "3fff1979cb827442fff8ad44d2648f7cac8a87fd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344584, "uuid": "67be4f47-d61d-4d00-942c-2ad5e1ef92d4", "comment": "Malware payload (AsyncRAT)", "value": "2e0d8fe2b960940c82b8a8e2e347f4c8093c568222fbc8b51ae482682c836e93dc08aaa4146f2fe518185dc51c8c9195", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344584, "uuid": "81614ecb-3942-4848-bf36-595a3e5e92df", "value": "T158241AB6B63635D05FEE3E4EE4A84ED8D5A8FDCCA42160612A5440C8E3F175B2D4C1BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344584, "uuid": "868daf55-193d-4402-8d4c-6728e90b2956", "value": "3072:SKVeejAbQmG3HZ4WZVROqRnCpH5vZWvqrrAK2upUKBqDF3:ShbI5ZVkqJqZxYqv2eQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777344584, "uuid": "4670dbce-079c-48c0-9da7-cd9946d9ec5b", "value": 220322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777344584, "uuid": "92d837e3-f82e-4fe2-8001-29a03eb50114", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344584, "uuid": "786a3de5-3cd5-4109-873c-32cbab799682", "value": "ps_JQRlCwcAKcvq_1773218456497.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d301c9b-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355140, "uuid": "578382f7-590c-4cf1-a1e0-c9f1359ab491", "comment": "Malware payload", "value": "42395763cb522c18cdf152ea6d959f1d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355140, "uuid": "9ae8d609-5264-41db-9acf-10b8677abc4a", "comment": "Malware payload", "value": "6ec334397381527c7384ee215bfeccda52d9e1049656c6b6cf64302b087c0f6e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355140, "uuid": "b32c8182-08e4-411c-8804-acbcadee24c3", "comment": "Malware payload", "value": "b723f38995c846b38d91de029541cde06fd36740", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355140, "uuid": "15d70826-47a1-4db6-b0c4-f86d02e4e038", "comment": "Malware payload", "value": "f1fe81b631208d2262128368682276f7f0b47b34a9db3fb10e702973c8470aa38327b50d74388b38b738e1931de6cd30", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355140, "uuid": "004aaeba-9a52-40e9-986d-defd7593b63a", "value": "T1F2372307887BD699C078222D644F0E9F25364F94612076FF9EF7794BA18AF6405832FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355140, "uuid": "93f2be07-a818-439d-82f6-5b526977561e", "value": "49152:uXp67oXp67fXp67SXp67fXp67zXp675Xp67zXp67nXp67oXp67NXp67xXp67aqta:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355140, "uuid": "51b08835-21e9-461b-9513-17b29d87911a", "value": 22903944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355140, "uuid": "0a3b3390-3724-4a65-89b8-ba4312409979", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355140, "uuid": "e4466c12-0948-4d0f-bab3-ce9a2ee6e1ae", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7b8f57-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777397607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397607, "uuid": "dea94fd0-0155-49b4-9d68-f97abbcf485a", "comment": "Malware payload (Mirai)", "value": "754d9e0db5469dd0ec97aaa98175fe09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397607, "uuid": "b34d151d-5723-48ca-a2be-44f761a22282", "comment": "Malware payload (Mirai)", "value": "6ecb67bebce635ef12428803015b06586d1cfe5519504baefc3cc0b927b85699", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397607, "uuid": "7eacf49c-718c-4647-a5ea-4bac6d557eac", "comment": "Malware payload (Mirai)", "value": "6ec76c8b495d18ba4dea5da2547614ff17900907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397607, "uuid": "13ea5978-0ed8-4108-8db3-193b00589ed2", "comment": "Malware payload (Mirai)", "value": "656462bdb89ebb7e30e92207aa32d8822e1119ad858eaf8876a9e2f1ca4c268cd341c2095a86de328d7113cf185075de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397607, "uuid": "93ef7b90-c0cf-40cd-8d81-005dbc8d9f12", "value": "T10CF2E16E63380666F0038630F685F0FF36DFA589DBD65C5B7D0C8A090B718A39D39691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397607, "uuid": "6f362f0b-52ac-45fd-a861-9905302baf45", "value": "768:TNjFaZ15Mnkatb1geQKFe5HGqLTqnOkSyCx6odgXNtDKja5H/:pJabynhzJFiHGqnqyFPdWNte2x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397607, "uuid": "cb1a66fa-1ac5-432b-a42c-e45065ae7e35", "value": 34540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397607, "uuid": "587080d4-f5e8-4ccf-b9d1-690961abc382", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397607, "uuid": "ebff15d5-a13a-461c-8a22-b732b16d84b0", "value": "agent_main_dump", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd5c07c-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355278, "uuid": "7efaa04a-494a-48ab-8b7c-5cdd9e4c6c4a", "comment": "Malware payload", "value": "65cdde14f8f3072af365af55ddf29877", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355278, "uuid": "606dc515-e107-4f66-bd35-ffddfc19fe90", "comment": "Malware payload", "value": "6f63f729098c85f7a3a4e3efadae3679942956c652cb37a8980a71a0ddafa27f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355278, "uuid": "7bd225a7-3fcf-48b0-a1b2-e5581dd15bea", "comment": "Malware payload", "value": "e3dba75107aab797b0873b9e99ee0f4bc2ff423f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355278, "uuid": "d67a74e2-5134-4c9d-8a0c-63339178ac59", "comment": "Malware payload", "value": "ca6557476c208142795bed31d34d5756603e6c004b237ac3ed40742545fe7561d55f517f6174b4db9be5aaac1d6d2e24", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355278, "uuid": "f0893c3a-bc3d-4b60-8612-6d1469de9c9f", "value": "T1813723694B0F851C6B68406C8CFB0B4F39EC9D5C8029DDEA33868DDE5F5E909659B0EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355278, "uuid": "d73fc807-835d-49b4-b645-da9c2e9216fe", "value": "49152:zd8Zaf2d8Zaf4d8Zafed8Zafhd8Zafjd8Zafxd8Zaf2d8Zafwd8ZafId8Zafod8s:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355278, "uuid": "c5405e72-9fdb-47df-8966-935641f24cdc", "value": 22383671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355278, "uuid": "32d7d28e-0c7d-4ecc-815e-7e60c8df6fe3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355278, "uuid": "18c43a69-4e21-44bf-907c-0b16b5d11d21", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609235a1-42d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777361964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361964, "uuid": "f3b26c8b-dba5-4975-9e90-af8cff2ca1a6", "comment": "Malware payload (Mirai)", "value": "c8222709e0aab8cb6b746e0492bfc49a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361964, "uuid": "bca115b3-68e3-4281-8914-2761fbd0212f", "comment": "Malware payload (Mirai)", "value": "70443ba7e38772f7baef0d6f7c4b997eac8401250696330e343583d3edb831d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361964, "uuid": "f6b1fcef-8d88-4e38-ba60-baec174c4bda", "comment": "Malware payload (Mirai)", "value": "02178f0356e2e5fa5fd17ee222f0099f6d46b27d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361964, "uuid": "c219b401-1ade-43c4-8e01-6cc35f136953", "comment": "Malware payload (Mirai)", "value": "cd06b98cd2e771aeed09f9a3ddad69fb7f95e0e54b0336f18534163f572681ab773fd456bdc868f97398cdae217cfaf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361964, "uuid": "68a41d76-f879-4413-87f3-f859b7eb942b", "value": "T123338CA3CD256E08C16989F0B076EFB55B33646080875FFA6566C7798083ECCF5863B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361964, "uuid": "afad0776-e1d8-4dca-93b4-a2a3ecf1bab5", "value": "1536:NulILwcUKXw/Utp/TsG/H94FAbzCic0sR:N0I8cbXTp/gG/AOz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777361964, "uuid": "49ef3377-e31b-4ceb-8279-0b1e7ace8585", "value": 54620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777361964, "uuid": "f69c7256-8bac-4458-9acd-8ca2f3aa56ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361964, "uuid": "288434bd-a91b-4340-a94a-1d59bc6597d2", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0e50d6-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403272, "uuid": "8cfd079e-a389-446f-9e69-4495c65c6fa8", "comment": "Malware payload (Mirai)", "value": "26a41dc9fe5a5a5342afc43eb36c384f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403272, "uuid": "d2ac1176-006a-45e3-87ba-6b2ceaf3b5e5", "comment": "Malware payload (Mirai)", "value": "70611d62599041669173173544b973ade216efa1f0e6b284591b09b049c19575", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403272, "uuid": "3d727b12-5479-4e4a-8e00-15b0ea43203c", "comment": "Malware payload (Mirai)", "value": "155be85493882ec7b06c26dc818a5d60e45198b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403272, "uuid": "39598ff9-3475-442d-8509-9952f06cbcae", "comment": "Malware payload (Mirai)", "value": "b45b7a9c9318cf103c1b9931e45392c93f7acfbb08ebc3ee887aed224624106b34e7ceabb8dfa1446a914b5492f0d7b6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403272, "uuid": "732478b2-858a-4be0-a6d9-98fd56204526", "value": "T1B5E31B45FC909F22CAD611BBFF4E428D772A1768D2EE720799255F20378B86B0E77142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403272, "uuid": "51fe8a88-db8c-4d9f-8c5b-c491c4f3e012", "value": "1536:EEJko/uyrMORbf5ZUDs3z0PNDn7e9P+OiWLADt0fBTAP3cMKnO0B4EQQQhfMlfhF:lko/fRbf5ZZ0FD7GgyAGfBC3PpRtkc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403272, "uuid": "adbc8674-1da8-4448-95eb-fc82c65716b0", "value": 145900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403272, "uuid": "4ad8fbfe-aa08-4d4e-8f3b-264a91d5ec7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403272, "uuid": "a86e714b-9438-4eda-abae-1bf5bcced518", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a541de-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364814, "uuid": "1d68b9ce-7325-47e3-8774-dde555baeca1", "comment": "Malware payload (Mirai)", "value": "19f191eec17e0ddd81b4292c62e76a6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364814, "uuid": "bc6f22c1-5816-4e59-b1cb-be0887dcbef3", "comment": "Malware payload (Mirai)", "value": "710d4e62f53814b5e77c55e6d6b62b96f4b873200492825db1e82d3a86a84a39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364814, "uuid": "46c645a2-a25d-485e-beef-cec2d3ac2408", "comment": "Malware payload (Mirai)", "value": "f8028ae3f8eb603575ac2a83c8d37ecef2a48510", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364814, "uuid": "0a902ae0-056f-4a67-845c-1f634bcf3542", "comment": "Malware payload (Mirai)", "value": "0129fcd95bce96e5f6a3885aa14368b0795a6ab5afbc8286cc99d67e5458b5e71d6bb9834758afd9d034b3ed36456038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364814, "uuid": "80062cdc-b3e8-454a-b26a-ad6246e3a726", "value": "T104635A356D7A2E27C1C0A53E22B74764B2F1178E3AE8CA1E7D720E0EFF50A5060176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364814, "uuid": "b1a94d72-33cf-4fae-9033-914192afb0fd", "value": "1536:xBzNxnVCvXUB5HtSxZ8ChBKBPgvYLZGGTTzj:fzMx1vWIaGG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364814, "uuid": "32f1a4d2-4052-489d-9aff-eaf1f89de543", "value": 72800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364814, "uuid": "13784528-95cc-452b-aa0f-b58b87aec957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364814, "uuid": "41b9a36f-090b-4946-9b6a-2b5ecf4b558f", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b877ec92-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777397759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397759, "uuid": "8b1a5448-a6ec-46e9-ae29-8a676305b954", "comment": "Malware payload (Mirai)", "value": "836c58cfafc3744851e0645f30b87684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397759, "uuid": "084932f3-52ec-4f51-afcd-718185c0938b", "comment": "Malware payload (Mirai)", "value": "716d48456022d4ccc355e377304d550661cff5136400c1b9b6325ba54d19c5b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397759, "uuid": "5fd90cad-8bb3-4314-8469-ab2d3be39a12", "comment": "Malware payload (Mirai)", "value": "a90f8e6fded0aefef49f21c7d542631b97185e18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397759, "uuid": "d3a9857c-f6a2-4f8d-bfa4-05f5760f80b3", "comment": "Malware payload (Mirai)", "value": "f4ae0013cd86ef751b18973637d22a5882aa5fe97de0418f1d1bed09218b179b67363c1ddbc8bf97bc1d43285955fb03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397759, "uuid": "6c635725-80fb-4b8f-b101-535e311ec669", "value": "T1BB66FA19ED842BF6C81D5B3444EACA9503B05E104AF19B262660FFA9BC772397F47D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397759, "uuid": "127853a3-c7f7-4f95-9efc-678762d5ed34", "value": "49152:XHuuD3REq0wvFGKXgDoBjxd1Jqbi4k5Eq:8aY8xEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397759, "uuid": "f9bc25ac-845f-49c8-8687-cd73e224178a", "value": 6750401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397759, "uuid": "09ab99e7-4459-4084-9f06-9d4b359d71bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397759, "uuid": "b35e66c2-33f3-4e3b-be2b-72aea4b96ea5", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ba305d-4322-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777395090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777395090, "uuid": "ad227fd6-a762-4784-91db-f5517b075418", "comment": "Malware payload (AgentTesla)", "value": "264d1a2eb22da27631861e2f82413d9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777395090, "uuid": "686bceeb-e91b-49ac-b44d-add363092ae0", "comment": "Malware payload (AgentTesla)", "value": "730a0ee8f653c776f2d95db3ce9104514cc4b82829cd701a27fd069887c33fe6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777395090, "uuid": "eb2f56fe-ab3e-4d13-9236-879bcbca21b8", "comment": "Malware payload (AgentTesla)", "value": "2cdd8ba9e4e41ac5db4e3d20f903345c6f3720e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777395090, "uuid": "b5b6ec06-8054-4418-94c8-e43486424260", "comment": "Malware payload (AgentTesla)", "value": "1763736b86fc5d21b234b07a7d03aacd696b2964294ab327d8f45eaae9493ca42d4e4e70046e9d8c922b2149882f290b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777395090, "uuid": "866f1223-b518-46a6-a641-525b3926d69d", "value": "T15255F10186C47FA4DBDE1A2950BE2599F3A24E8E6415698EE733FE45BFB3B00D1071B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777395090, "uuid": "d5ff68f6-6f28-4db9-a65e-6579841e8291", "value": "24576:f4Z7wT8cRX6qJRyYY8nSJGYVf3MmQmvYabbBYX0vIBQt4pM:AZsxkoSS2DUq+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777395090, "uuid": "f5b24004-a53e-49ab-9905-7b97a198b05f", "value": 1380861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777395090, "uuid": "baeabd68-4ba3-42d1-b685-727c775baa85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777395090, "uuid": "793f9ff1-bb2c-4e75-a8d6-b90917f624e0", "value": "hbngtterwmnmjcvedcdpoetyrhwexc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5501db8c-42b4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777347771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777347771, "uuid": "21973730-05f3-4980-af37-0ac559010d9b", "comment": "Malware payload (AgentTesla)", "value": "740a31028d80d91f80acf8473a120e50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777347771, "uuid": "1f766621-77c5-410c-87e9-4f36c7b214d8", "comment": "Malware payload (AgentTesla)", "value": "7389bea975cfb69d0e26f91aed307246b2cd6daaee95069b3c08392729de0150", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777347771, "uuid": "78791239-7e20-4fcc-bfcd-66696a435012", "comment": "Malware payload (AgentTesla)", "value": "b867b2b435d534cae45e39569b85abbec7793b49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777347771, "uuid": "756975a0-f632-4a01-9dec-64a2b90edafc", "comment": "Malware payload (AgentTesla)", "value": "71af37a908a518cb2d79009df804ef6fc9125b3cd683aac7e9d96613e4e6f890bbfec9f8f2c9541349ba42984bd2c1e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777347771, "uuid": "72532080-aafd-4e62-8065-35be6221337f", "value": "T14BB5AD06E3C816F9D527DA78CB05A733D2B2B8524762D58F0AA9D7061F73AA04B3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777347771, "uuid": "d59b200d-61b7-4509-8458-aa876a356a99", "value": "b681f4757a973c7a5da31843fdf493e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777347771, "uuid": "4e5b9c27-a4a2-48ce-b3d0-41dcbb54a087", "value": "49152:Lk8O4p4OzT21rcCGBBpYr/m+D5fPwGt4X0RO/z:LBJ8H5PwGt4X0RO/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777347771, "uuid": "aba75a9a-3a0e-4f41-9804-4e768c7c1211", "value": 2386432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777347771, "uuid": "7e4e9e43-c78c-4a1f-9ece-5ed953500ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777347771, "uuid": "6b320fbf-1ea9-4067-a369-8a1010a7acc2", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ddf8fb-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377565, "uuid": "7a739491-0a5c-4410-8eb3-df570c048969", "comment": "Malware payload (a310Logger)", "value": "2f5c73636614f3c336d51ff81401f383", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377565, "uuid": "a86cda39-30b1-4ac1-8e66-d8d0cd861ed4", "comment": "Malware payload (a310Logger)", "value": "73b834df63dd4f204766506b1b45d125cf116584fc976d760241bcaab87e48c3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377565, "uuid": "e6b3f677-87f3-41bd-b009-216fc7b1f948", "comment": "Malware payload (a310Logger)", "value": "07e9db18251ad43d04657d421b48c2748d561a89", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377565, "uuid": "3e50cfd2-866e-4763-9ffd-6e5e3ce48081", "comment": "Malware payload (a310Logger)", "value": "9d2772b434068f2111b658d6b57075cff27b025a015d01157cef383b1a2fc382b0587b95d8802b8c666d03d73e0d03de", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377565, "uuid": "2d7658d3-6030-4a51-b4ab-6c81dd477cc3", "value": "T1919533B55BE37E7C8528913992E37F5EABB24F488C1FE4E63BD834C01568BC1818951A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377565, "uuid": "1c9c6066-477d-4362-ba5f-40c632365af2", "value": "24576:7hUnYzMzL97bG/lCFk/uLtxGPlKhZ+OphP2EMklTeEqGus4QWSexYVxEgsXm9INP:UH9RJ4UePENIDQWqxsm5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377565, "uuid": "7e82f564-18e3-4edb-aa5a-fa22e1b55bfb", "value": 2040212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377565, "uuid": "23967e0e-6264-471d-b348-4e8d49b82d95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377565, "uuid": "df8b7a15-4747-4f2b-ab60-f17e7db70efc", "value": "ps_2DgLyqiHHQAE_1775722228227.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46c64b9-42ac-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777344575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344575, "uuid": "e4f7c163-1686-41a5-9661-b3d160b9036e", "comment": "Malware payload (AsyncRAT)", "value": "bea6efb5087bd0044ed80940902012a5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344575, "uuid": "0bbed80c-2afe-4103-af6f-420059b1690f", "comment": "Malware payload (AsyncRAT)", "value": "7448c841d7b0a02301d8aacbc4651e8492133b5d6077d9b9f9323337b29ba7b3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344575, "uuid": "f584e24a-3fa6-44de-8b68-5439238e1a06", "comment": "Malware payload (AsyncRAT)", "value": "aaa4893eb877b0a64ed222efe73001613e022349", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344575, "uuid": "9ed9ac61-cfbe-449c-a939-207b9f8a3877", "comment": "Malware payload (AsyncRAT)", "value": "1059896f388436361e76a2a629f743dcd5eb5cf6781624c3feb3f82e440b0b875d48031c3fd65e90923c95b121f75b50", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344575, "uuid": "ca51b495-08a8-4bac-ae76-5ecff1de0a19", "value": "T15944AFC37DAB65D21C3DD4AD076FC98B803AB1731C2C6824875E1098F778B9B19E7866", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344575, "uuid": "238b26b2-76d3-4e0c-b3f0-628bcaffaac0", "value": "6144:+LSQwdPURB+rf4VJLdUTo3q9I3xtjbviWp6YefRnq03YSIRyz0i7I2Y:YQPURlVUTo3q9wbviWp6YefRnq03xwM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777344575, "uuid": "549c97c6-d07d-416e-a5b4-e9ae4bfabc9c", "value": 272088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777344575, "uuid": "56f839b6-6052-4556-ae34-05276d9fc892", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344575, "uuid": "f541edef-d459-4cfa-be5a-8ccd2c49371d", "value": "ps_h6Wyg8Vr0I5o_1772698779379.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1a56e3-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364936, "uuid": "8976be2d-8728-4b68-9d0a-673bc7dbdf96", "comment": "Malware payload (Mirai)", "value": "da3b7b58c14b89f8fa57a6c73692078a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364936, "uuid": "9cb2b09b-a973-4177-bb07-f4f1ba4fe845", "comment": "Malware payload (Mirai)", "value": "747fef4be60a07e6874788a30486c61aca8d90e1a6cad5c2925d52e227f48d4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364936, "uuid": "1d22c801-5fb2-422a-80e1-686ece132825", "comment": "Malware payload (Mirai)", "value": "edeb325096409bf9b9ec0860098c4a8417d49b70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364936, "uuid": "591acc73-0b13-4293-b0b5-d2fe2f126975", "comment": "Malware payload (Mirai)", "value": "bf1f3f04a32bcf2b83d9a9aca566f0aacef42e255597b9018b4eae9119964b57f358e9d43f4f8a278e4f9690bec4e6b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364936, "uuid": "8ef4d468-a38b-4ce1-bbd0-024f74c89499", "value": "T1D7F2D09C270454EFD1BF24305BE20F7039754AD1394AE80FA249EF8AD9C82E87D438E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364936, "uuid": "56363622-f4e1-4ee3-a2fc-4edbd8f528b3", "value": "768:4zobRMvVgjGNzqNdmlFE8I3v/XY6y0Be5uPjeAJgGlzDpbuR1JC:UobRdGNSFv9s5jAVJuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364936, "uuid": "9a8a5c5c-6500-4db8-85b2-13080ad7e535", "value": 34972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364936, "uuid": "cbe5b0cc-53ce-414c-8f37-46b2ce4fd502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364936, "uuid": "4a23c722-38b3-4f31-8c06-055116c41419", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571c4aee-4299-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777336178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336178, "uuid": "ee7ff2fb-1b9d-49e1-874d-c7bdfe49470b", "comment": "Malware payload (Mirai)", "value": "e46fb644a8c8cd4f31d8c71320254b4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336178, "uuid": "218ad167-e139-46da-bc99-daa41e047de4", "comment": "Malware payload (Mirai)", "value": "74cb08ca2bb13465ea052e2734bc7b694e1fe6407a53ea0e196ffa2fd0516296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336178, "uuid": "57992bb1-24df-45a1-b78f-b460e415ccfc", "comment": "Malware payload (Mirai)", "value": "c911b1e02e419c794932e4f5ad106631670cddbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336178, "uuid": "85528a7b-ae01-442e-a039-4f78f4cf3d39", "comment": "Malware payload (Mirai)", "value": "d4bf07059ccd7737d23ea49077cca38a3847bb8228c8a41c2637b7b4395ca5008ce54fad2127e17c90d16bd8c3a8f652", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777336178, "uuid": "aeb1d93d-32f3-4178-bfff-6938c25568aa", "value": "T133E2E198C5044433ED67C73513353A57EE2E19794E8AF6132AF3D391D4B44602636A6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777336178, "uuid": "77072311-252a-47b4-8172-2d2b2f2fcdb7", "value": "768:4vTR5smxw/mWEcypMSx3yvVcsDIF7YR+1f2YQddtctw:oTRCIf5c8tv0IF7YR+1f2Fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777336178, "uuid": "b078453f-1913-4b6b-a90b-497572b5e0af", "value": 31260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777336178, "uuid": "e597d896-52f5-493f-b59d-c83301296218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777336178, "uuid": "e1b7a731-67ba-47e5-a9a9-11708613b8ac", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9907a68-42cf-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777359590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359590, "uuid": "4e599447-a177-4d02-b9a1-f830f397fe58", "comment": "Malware payload (PhantomStealer)", "value": "e411c97749197bf04804bc281f7a7d48", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359590, "uuid": "fa467e02-e795-4980-9a75-876d258ba4f9", "comment": "Malware payload (PhantomStealer)", "value": "75704305538def57efadb10ca26238eb99924705c55c776bb773c558ae9b1b06", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359590, "uuid": "fac0021d-91e8-4645-952c-53d6b77da677", "comment": "Malware payload (PhantomStealer)", "value": "7d30bec52bc57cdd9b5cc97713ee00c46f42c9e5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359590, "uuid": "60e7bdd8-32c8-474f-b5a5-8651425572a0", "comment": "Malware payload (PhantomStealer)", "value": "8a0465d1dabf923537af87d6562a380e4b1d0c7646af17658121e4aa41853851d66e2b2c107aebdb24a0a40605aaf6cb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359590, "uuid": "fe170784-17e8-436b-a75f-53fdaba941f9", "value": "T15035F2279DCC6F789E9C193690FD1A1A73B04B8A6125A48ED7237D46BFFFA40020B4D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359590, "uuid": "1e26b79b-907c-4406-a7a5-ffc0574573d9", "value": "12288:+68WRLv9yQkidHUziFdvRsKct55kN3SOegaWJnwIVsH2WAjurmPHhm+ODMsXHBQ:QWRLvYRziFCkFnbAPAC5+OhXhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359590, "uuid": "b245e294-4c91-4203-9e47-06c0a9f4f33a", "value": 1140753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359590, "uuid": "6dd2f73b-7f00-4ba6-a2b2-c0354f8ef9b1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359590, "uuid": "70ba8b01-a0f7-4e67-b3bb-7d2ef1fea713", "value": "Quotation request 7212600200_00002708.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155a9515-4297-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777335209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335209, "uuid": "f7f1876e-a68f-40f4-831a-bd35017b8b2f", "comment": "Malware payload (Mirai)", "value": "cd79256528fba5181fffd507ee0d5b4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335209, "uuid": "fe1ad60e-48cd-4504-9301-09dbc2db3d1d", "comment": "Malware payload (Mirai)", "value": "758d1860087e8ed04a20e639d49dafe60bc01bec4680bdd9309cdebeeb6aeceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335209, "uuid": "751d1d2a-366f-4f97-8f66-bd7a93491864", "comment": "Malware payload (Mirai)", "value": "6cdb0644a81a6bc88773dc423271ecd4fe4a57bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335209, "uuid": "502e16ef-ad4f-4a7c-9ef4-73d403adb5b0", "comment": "Malware payload (Mirai)", "value": "203a390742ef5d62f111666d559f80b59ecebb2fae0c91bdee391ff476b0aa1eb6cc899a54ada8ac1e2bd42e94577638", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335209, "uuid": "b8ea0cb6-8e44-43bd-8f65-3b0593089c78", "value": "T1B6C44A55F880DF62C6C52976F64D829C73174B79C3EB720A89254B343BEB86B0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335209, "uuid": "9628d435-4cdb-4c5d-ae2c-7e4c1f06a319", "value": "12288:YsGoxgLth/6EsUDKLok93O0BN3xh02K4GnWfEcgpketOK:+G46EsUDookdzhnKBWKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777335209, "uuid": "2fdf7637-271a-4d1a-be2e-903b81bc2fdc", "value": 578856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777335209, "uuid": "3367be4b-ae03-46bb-bff3-6abb58f66491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335209, "uuid": "051d7e58-2977-4906-8b2e-56ad86a2f02a", "value": "agent_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0733a5d7-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777377705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377705, "uuid": "6e9b5af1-f7bb-4182-a24b-61f6b01c2e37", "comment": "Malware payload (Mirai)", "value": "2d71217d2307ad21f393fed2f8335f12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377705, "uuid": "eabe2eb9-9d2c-4431-b868-6f5b24a36c0e", "comment": "Malware payload (Mirai)", "value": "759417517aaed53269def9b04b0a029446fd2d6002331354443cb5006366b58a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377705, "uuid": "120b2437-9749-4bba-a58c-65ec4af284d0", "comment": "Malware payload (Mirai)", "value": "c7512ad38766c1392628bb400dedd394249527ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377705, "uuid": "d0f8eb94-771b-4d20-8816-6e2da2d36449", "comment": "Malware payload (Mirai)", "value": "91e7be9fb1c516587dad5d1eddce3f8eac7136d3186c33dd67a911012cb97a76e7ab0a8a21b13817445908f7a70bdf46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377705, "uuid": "5c930568-63cb-4c6e-b589-3d18ea0d2405", "value": "T1FD534C89F783F0F0D94A4A71119BB37E96308E125024DE6AEB94BD65AD32F12712F71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377705, "uuid": "3b80e2dd-173a-47f5-852a-915dee99e04c", "value": "1536:XU9O77C3N5szjpWPZypGG6h+lv7/1RCUd31cFwkcaTr:XV6N5szjpw1EvhBiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377705, "uuid": "56a5c217-88ac-418b-84ee-47ec8e02a7f6", "value": 62064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377705, "uuid": "708221de-6979-430c-af53-5c7e14cdc422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377705, "uuid": "5782b203-9ab3-463c-b524-c93ad6a502f2", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840695a1-42ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777371901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371901, "uuid": "495abb2d-6550-453a-b4a7-f4d66d8730bf", "comment": "Malware payload", "value": "0f7a9e3c2b2487ceafd46acc7f6067fb", "object_relation": "md5", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371901, "uuid": "a62d2308-e482-41f1-bed8-05b575f463f1", "comment": "Malware payload", "value": "75961f1208581c5154324ebe12f01673248374f3aa67317fe79a06fcd2fb9da5", "object_relation": "sha256", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371901, "uuid": "33140909-d909-481a-ba79-2aad5eb2e697", "comment": "Malware payload", "value": "3a5e8c348ebd8550dde4a28d69b41ed62ff82b2f", "object_relation": "sha1", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371901, "uuid": "39ad22dc-54c5-4bb7-a7fd-73c8da8d8af8", "comment": "Malware payload", "value": "ad58a2af782b38227a3e063a36ac8aeb8ec31425d64cde8248b469df2b5feba228f6f5e76e0f326b19ef475e375b59f5", "object_relation": "sha3-384", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371901, "uuid": "4506d7e1-6156-47f5-b75e-56f08ba337dc", "value": "T10C213F60C243F2A5CB7D077E90F5A9A6AC55F0011DDCE93C13143C8198FE2429EABAB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371901, "uuid": "e05cb79b-3534-47cb-ab81-f513b2866c8d", "value": "24:8dfVDBJl4dU9KhjbFDZcC04fBfmEl+uX1h:8FVdJHKxFWC04fB+a+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777371901, "uuid": "7bd526aa-df0e-476a-8c9e-6487a0cc79cc", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777371901, "uuid": "d6e6b9e6-f5eb-4649-9e9e-ab64c1c92b22", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371901, "uuid": "bde68b22-ff8e-44b5-ab54-c17913a68750", "value": "Screenshot_2026_04_20.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5eedd2-4314-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389283, "uuid": "3fe6875c-8dbb-4cbc-bc76-81647b396ee3", "comment": "Malware payload (AsyncRAT)", "value": "0d3e0a9e0e33ea9099678d05063aaf3a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389283, "uuid": "f5aff6d0-5dfa-4533-89a2-90f7f0f49b9a", "comment": "Malware payload (AsyncRAT)", "value": "768893f53c6ccbd06a8ce5b4006423cd72d2e2e33c858a315e4557b070b9f537", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389283, "uuid": "d89d53b6-fb11-4ecf-876a-9667cf5f81df", "comment": "Malware payload (AsyncRAT)", "value": "e49b7a9386c2649d04adc03153833ee976440b78", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389283, "uuid": "797f562e-15e5-4da1-b5d0-2106090eb3cc", "comment": "Malware payload (AsyncRAT)", "value": "6ec5e101159216bfdf256d953f81e7a39cf1dcfaa965bd56b4b806c22c32796e6a3b79f50369a2d577a5bc783868619a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389283, "uuid": "679df616-afde-4e3a-9ddf-bfe9cb143f9a", "value": "T1DF1338007BFC1625F2FE4FBCA87952454276F9679932C74E0CC4518E1AE27C1AA91BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389283, "uuid": "87cbb976-906e-49cc-aed2-b717e1361ff2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389283, "uuid": "440f0409-4b8c-4a5f-88a1-d6d6bcf5d69a", "value": "768:0q7x+bzkon8IRp8YEnJ0NzHYSvSRCf/uRbheuoVNt5vLvdD+:Yko/EJ0VHxqQHuRbguINfLvdD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389283, "uuid": "8eb6ae0e-b385-4205-933f-8af7c5cdac22", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389283, "uuid": "2419abd2-558f-49b0-a2aa-4a5642e37f57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389283, "uuid": "ff34f9a5-e37d-432d-a315-52e133ecc260", "value": "768893f53c6ccbd06a8ce5b4006423cd72d2e2e33c858a315e4557b070b9f537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de30238-42eb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777371274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371274, "uuid": "998ec533-237f-4355-9df8-97a6aca13444", "comment": "Malware payload (AsyncRAT)", "value": "d82b54f6a52aaad57140c8a03b4ceca3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371274, "uuid": "74c6b90b-cea4-4d1d-838c-5d496c49c309", "comment": "Malware payload (AsyncRAT)", "value": "78c25d10e088fabffa93f29515f370e0c363199e3747b934986569fc7c9f3adb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371274, "uuid": "821de452-3ef1-484a-9aaa-9cbcad89f97c", "comment": "Malware payload (AsyncRAT)", "value": "f307f8cc9d8cb49984142b6a3f9438bb08e26cdd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371274, "uuid": "765c6391-3b2d-4ae8-b130-6bc48aed8185", "comment": "Malware payload (AsyncRAT)", "value": "1642e43f408600d7732bc372f8698a39ab92f49ff77de4a47bea9757ff19e3a25127b0088ba2a31b92f22f3f176d448b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371274, "uuid": "71a3c200-410a-475f-a093-7315028939dc", "value": "T1C1B6337DFB283141F44C6EF1EB956A8407EAADDA929CCF0097813B364CF52A45698C37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371274, "uuid": "56090db8-4f30-43ef-88d5-088752f396ff", "value": "196608:6BcKJrx33uyOLIPLFFYuEm0FrfQ19OXQr00QFnDpduZlh8zioNAqEK:6eKJrNPOMj/YuEm0xPAr00uDpdo8nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777371274, "uuid": "2649ecae-c824-4551-9266-eba151751464", "value": 10557803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777371274, "uuid": "d2cb75b0-631f-40df-819c-854fdace4fc8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371274, "uuid": "0cbbd7e8-2ddf-4f0b-b3b0-61b0b75da437", "value": "Tax-Number22563.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11c1546-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403438, "uuid": "f9b0629a-9e6c-43cf-bb1a-106abef8cb56", "comment": "Malware payload (Mirai)", "value": "025d514a76f0cb5be8e07d7f48480f86", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403438, "uuid": "b0b5ffc9-52ac-476e-be0a-4796563b4bb4", "comment": "Malware payload (Mirai)", "value": "794baded095a5d724b5f1cfe4c56971dc772831e5ed121ffadd1f063b122778a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403438, "uuid": "241b43eb-d7e2-4fa6-8a64-593fad1b718c", "comment": "Malware payload (Mirai)", "value": "80bb6740a81947a32fa040b93608a36870524601", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403438, "uuid": "977ef50d-4301-4267-8551-ebb02e225d3f", "comment": "Malware payload (Mirai)", "value": "90664f246009111168e5ece2b3670f038945e6a9a85290e428ba9ee07b3b40369ca5164850ed61aad8156462e45b75e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403438, "uuid": "280452ce-27e1-4f5f-b54e-55ae54f92d0c", "value": "T137E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403438, "uuid": "06b44432-1bdb-4a24-9f47-a92e1176b2af", "value": "3072:axjJw1Cc/0s6YAPwenUr48pzfR+Jon1y:axlw1xAop0YfR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403438, "uuid": "fc5be568-f85a-4a02-93e1-2292f3937827", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403438, "uuid": "b8022d28-0312-47b3-b015-71738becd423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403438, "uuid": "a20ed8a3-2e1f-4b44-99e2-8ee406e76d8d", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f60922-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777365028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365028, "uuid": "e8e64211-dbc1-4a78-9db9-c86046359523", "comment": "Malware payload (Mirai)", "value": "fd289c76665f25bd96df53d7850d9836", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365028, "uuid": "df2174a8-35b7-4a02-89f6-744139e03cec", "comment": "Malware payload (Mirai)", "value": "7a554b95133b9d2be284dcf4d4e411b80e0cd92f3aeda094ca7006882d8f2747", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365028, "uuid": "53f148cd-2ad4-4955-b560-f769fdcb7965", "comment": "Malware payload (Mirai)", "value": "92bb0db5baecf3aa98cc977954a2e4acb3144a43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365028, "uuid": "83414cff-47ae-4875-8746-af2e4cf092c6", "comment": "Malware payload (Mirai)", "value": "23eec17490d2cd8fd5803c1d572b87a30e9c432736054d25e1d19ebd20212bfc1e7a4ce4c36dc1df73a7e51b1c93ff76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365028, "uuid": "f56c7b3d-7bad-4124-ab7f-e626ee750135", "value": "T14483190377180F03C16329F026BB1BF097AABDA519F4B684756EBEC59271EF12142F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365028, "uuid": "3ffdfd4e-7a3b-4e67-a3a0-41622b972c02", "value": "1536:lLbVgT+wtH/OojrjhFIRc8JePeiGvvqce2mJaJf2y8YnjjcJmN:li/2o7hKYGLmXyLzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365028, "uuid": "46cb67f1-6652-423e-865b-34f5259bac13", "value": 88716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365028, "uuid": "4f4f890a-603b-4d8e-9f23-c00185aba770", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365028, "uuid": "93c576b6-f4ac-43ce-9efa-9800ddf8f88a", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d7c223-42d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777362670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362670, "uuid": "a9bc455f-3853-48ec-b59c-32da5f178b47", "comment": "Malware payload", "value": "f9b38ad25fa975ea038359dce8410008", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362670, "uuid": "8e4e1836-3711-4152-bebc-9217e9d6fb4d", "comment": "Malware payload", "value": "7a7ceb023a054ef1c506283d8e606577ab690d02cea62875f2f12b9c54c91c4d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362670, "uuid": "b7bc8e6a-6d28-4c04-a8eb-c970c6a5a743", "comment": "Malware payload", "value": "f04a91bfcf40e36a3efb653e09e5707ab2533cb3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362670, "uuid": "f8756479-a01d-4cf4-9b6b-0da53b254da8", "comment": "Malware payload", "value": "2b1a436951447d426aa0fad686151e07b6c4af3712d52179ba84b6b41c44e2654f754b7394384ffcb991b81fc563a5e1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362670, "uuid": "806de177-f483-43d5-836a-06c6df0780c3", "value": "T134A32A13046A722652F8A57972CFC1CB383062A985C787984581E53C7F9A7CFF19B9E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362670, "uuid": "bca58c90-2304-4107-a4b5-95b15c14d1dc", "value": "3072:cfE1kzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzn:X1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777362670, "uuid": "6935acee-a646-40b3-be58-12982cc00017", "value": 98408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777362670, "uuid": "fa8bfd3f-9e26-4648-aa93-789ab779749a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362670, "uuid": "93bd95d0-879c-4dcf-bbe9-22f009774000", "value": "Scan_2_19_7_1052_27.04.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433c0fc0-42c9-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1777356760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356760, "uuid": "02e41f41-47cf-4dbb-b473-2ae0185fd35e", "comment": "Malware payload (DDoSAgent)", "value": "a875886ef336eb35ec9fd9a4f7b13e46", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356760, "uuid": "bfed194b-f3a4-45e0-b0d7-796fdd230a39", "comment": "Malware payload (DDoSAgent)", "value": "7b3c60107a0ae01f9173f66cf18eb618a9b91d14bb8b092c3f9b9de2e58592eb", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356760, "uuid": "5d67ce1c-0db0-45c4-8fab-2cfdcc328c0e", "comment": "Malware payload (DDoSAgent)", "value": "2acd1b6eb6927ef7e23ce7865e9553a3ac148314", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356760, "uuid": "608a6d4e-0f40-48c4-ab81-b4828c94ca4c", "comment": "Malware payload (DDoSAgent)", "value": "3098d4e5a7b61a5254c72c9b58784d718a15b8faa27cd4eb664d4735c88475e1581197a14bc100cbd6880a85af81d0f2", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777356760, "uuid": "0d452a63-3e28-4e65-93db-c440eabc9bae", "value": "T1F7868D11FECB58F6E6431A3104BBA26F13315D058B25DBC7EB407F2AF9BB6951932209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777356760, "uuid": "d0a423e0-d6e6-4125-b116-ae78cb8d4a42", "value": "98304:YfX0+A31xZQ//pvdEyL7MbVuf0EY09TtPNysP/+hkZT+aSdy6BmUKu:YfTA31C/p5YgTvfPWhyqFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777356760, "uuid": "e9455a40-3066-4228-8c27-1eaf71ede093", "value": 8505814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777356760, "uuid": "b91f0506-4ee9-476f-9662-a2e192444510", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777356760, "uuid": "9349b410-af1d-441c-97b5-feba138c00f1", "value": "kitty.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37616165-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777364901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364901, "uuid": "2da9701b-34c0-4d08-b6b4-b053c19f1463", "comment": "Malware payload", "value": "0231547ffae12b8dbb4efb3ff96e2a12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364901, "uuid": "98cd6379-f354-4196-b03f-f7ec54df33fa", "comment": "Malware payload", "value": "7c34529a70d11c1b625afd2f5dee49d8858969818c05f2c74304ae7d465818e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364901, "uuid": "dff05394-2cb3-4548-9ebd-a908eb101354", "comment": "Malware payload", "value": "9edbe91cfad8c5bf6e851ad4c4d274cca69dd0f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364901, "uuid": "c0234b2d-17e2-4dcb-a019-518e3c24ac8b", "comment": "Malware payload", "value": "8500fa7a5f0affb4366fabdb747560460c2bec0418e7d25917cdf780310dad338bf3a0e6c8a9d6dcedc061f1204e589f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364901, "uuid": "6617a83e-bf95-42d0-9d90-16798b1ddfc0", "value": "T111F19D12CB22EC8ADB304932666D0FF4D34BB27D08CAE76E04118A4BAE3D04A435DC8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364901, "uuid": "a63178ca-dec7-4be1-975f-d286df2d3cd4", "value": "192:IAsbUPiVmCnmkub8LeThTpWOltZZEaBHKEC1x:IVJsyUhTp/ftBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364901, "uuid": "dca85b89-e007-47d2-b58e-2ae28afb690f", "value": 7948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364901, "uuid": "89d07d3f-f566-465c-8420-b9a867df2ea0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364901, "uuid": "0cf5e180-56e3-4e8a-9b88-29a19150c9ef", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3aedec-42d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777361933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361933, "uuid": "8abd70f7-092a-458f-aa00-2526858341ec", "comment": "Malware payload (Mirai)", "value": "66efeb85c8701d0eb77b21879a9199f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361933, "uuid": "97c6facb-0358-4659-9f63-18eb1ef94329", "comment": "Malware payload (Mirai)", "value": "7c833ca33bd1a77e8f5ce75b25f27477015ebb96764f69f62e7066f7bf105cb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361933, "uuid": "e20b803f-63fd-42b0-883b-b7d797d91469", "comment": "Malware payload (Mirai)", "value": "6926e1c6e056c2a8a0698c98ae30c8560797e8c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361933, "uuid": "46f7f509-27c8-4f8c-985c-54b808aa1a0f", "comment": "Malware payload (Mirai)", "value": "1421fb806c561efccb3dc59dda0c0f0e78e2f25b6e3a4f66017913ae145804666f5e107f70fd7eb4dd14420839cd7d34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361933, "uuid": "3eb9234a-cd4e-4402-8184-2467a429bba6", "value": "T1A393B61E3E258FBCF79D823547B78E229658338A26E1C545E15CEA011EB034E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361933, "uuid": "6fec040a-0ea2-4e04-86ad-bbef1ce41915", "value": "1536:bK/QR35eT0Ata6s8QpTy4OVDZZUHWm5XSWYkhoh9A:ke3sTPutO4OVNZXm5XSWXhaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777361933, "uuid": "19a2fb6c-9360-4ca4-b5fa-9911d780a2d0", "value": 89628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777361933, "uuid": "ca73d239-fc58-482f-b504-c3916f68d82f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361933, "uuid": "89706bed-3d91-4e2c-9812-2737eb70c5a3", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a2397f-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389302, "uuid": "7f9d08ec-42a6-4a13-8fbd-799f6a1b9e7e", "comment": "Malware payload (AsyncRAT)", "value": "1ae1f0ac600c9648924cc4567629322d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389302, "uuid": "c751cdbe-cab0-4cee-a9f7-db6b4a688142", "comment": "Malware payload (AsyncRAT)", "value": "7d00b4845fb8ad2ba4be4b7534257a2c6f227fd66840d8524dd12d1c6c825fe8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389302, "uuid": "dd92113f-5a4b-4d2b-aa73-8980d6052b28", "comment": "Malware payload (AsyncRAT)", "value": "a047903a0d8bb998b54ed4717c3a4975aa129d9e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389302, "uuid": "4cc1bba5-b6b5-4521-98ad-9fb1b9129612", "comment": "Malware payload (AsyncRAT)", "value": "60fbb1382826e512eb6ad7e225edd790dfdbd25bffa866f894f5d1136bd54c4d5e76f32296f3755e0848faa1875264d7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389302, "uuid": "8ad98754-fd66-4cf8-95ec-0ca1023b00e0", "value": "T178332A047BFC962AF1FF5BBC9C755505467AF913A832D74E08C8108E26B27C09A91BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389302, "uuid": "b4d50d8a-f821-4d78-8b62-b21246097f1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389302, "uuid": "65dd2d8e-a6dc-48a0-a40d-1459b789993b", "value": "1536:zvUFxVEhpRRXrI7RbCugoOCJ5z61/CF+:4FxVEhpRRARbCG3rznQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389302, "uuid": "d1f3e5a7-b178-47b5-83ae-353c639a5125", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389302, "uuid": "be7c092c-1df0-4fe4-8f5c-15fda2a617bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389302, "uuid": "992f9b55-5405-4f0b-9f2a-3525480c6f34", "value": "7d00b4845fb8ad2ba4be4b7534257a2c6f227fd66840d8524dd12d1c6c825fe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e51b59-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1777400527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400527, "uuid": "98696875-16ab-4f6e-8644-2f6b9bbaf38c", "comment": "Malware payload (DattoRMM)", "value": "ab1c7cdd17dfb073915f2d4ec501f8dc", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400527, "uuid": "6f41db3a-a31e-4128-afdb-85c5ae130847", "comment": "Malware payload (DattoRMM)", "value": "7d57f0c07730a6abfb23bbf3365d4922542ee4e3daa3baf7c3c506f0c170593a", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400527, "uuid": "53682c7d-b911-4c77-9d2d-dec0750695c9", "comment": "Malware payload (DattoRMM)", "value": "74d9b6e699d5e5125bedc238edf1db00c92d49d0", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400527, "uuid": "691b702a-42fa-45a8-a824-1777f916f00e", "comment": "Malware payload (DattoRMM)", "value": "7eaa212a32973417f79921345b8af0b1241df24b5a6523ba7c21740804d3da19dac434baaefbcfa42facf18a67077ea9", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400527, "uuid": "20bb75f4-7138-444a-b318-ce105135b1ab", "value": "T16CB63347DE3B8EF4CB63463C89831A57124F598D8C47E4C9E0482A3589E399ADE38F5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400527, "uuid": "dee098ee-0e73-4721-ad64-105aba1b076c", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400527, "uuid": "aa870dfa-05fe-45d7-a3ec-b6c0673bb0be", "value": "196608:WaZk+wqbLGmnYZJukGkxGB8rM2VPFOsti7A95vM9sFp29XaIT030HyyG+zzDP:En4nkGkx08rtE7AnMGp29qIT0Wzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400527, "uuid": "d81ebd4f-01fb-4764-8a0a-b18f34b5a06d", "value": 11055464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400527, "uuid": "8058432e-eb0a-4660-8d6b-db0799d714eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400527, "uuid": "4937a576-bed2-4c81-b2b8-ee91a9aa2908", "value": "Gerkenandassociates.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbc55a7-4295-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777334738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334738, "uuid": "dc9eb484-e3af-422c-a633-1192974046ae", "comment": "Malware payload (CoinMiner)", "value": "c347b995cf2b44f9b2d7ba817697eee1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334738, "uuid": "8906836f-fa33-4c7c-bc77-66b7e26ac97e", "comment": "Malware payload (CoinMiner)", "value": "7e8761ad6443f0ec53d381bb80b37f694f5a50efb9ec04832782304762339126", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334738, "uuid": "1a31eaf6-2033-4223-b033-286f0a89319b", "comment": "Malware payload (CoinMiner)", "value": "5235f77a175de22738fc4e5dff59c39538a84822", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334738, "uuid": "afa75e5e-fee5-4693-a391-afa0bd54e862", "comment": "Malware payload (CoinMiner)", "value": "33ce059c297e9dffbb7466c7f46ed4bcef5ff178aee6456d491d9a9eac7812a783b81e1a6ea099c764a1861bb39de0ce", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334738, "uuid": "2d0e8bb9-50b1-4389-a7ea-8fa50acf725c", "value": "T194363378B1D3A461D60A1C3E6A1EFB70279479D38EE56903EE04C94C1977AF2D78E213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334738, "uuid": "e148cff3-ebb3-4b54-9c76-e3fbeca2a23f", "value": "98304:EpdDXzcRPey1NgYaDuXBuGpndsDFXpaKNoOG+XwtEl8cDq4nusMpTVCP8TUPiB4F:EHsRF1jPxuGpnyDxLqBENsZVkwU6B4ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777334738, "uuid": "6f23c1f8-eea1-469e-8e7c-53900dc371a0", "value": 4913840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777334738, "uuid": "c4fd6bff-a5f8-41c6-9435-9db2fe368100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334738, "uuid": "bbbc85e1-afcc-42f2-8c5f-a0ea36216a54", "value": "xg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80809bd2-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355145, "uuid": "eb984e98-b4f2-4b28-bc1c-87de13581d5b", "comment": "Malware payload", "value": "9e129b220275c3dd227e293a50aaa2dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355145, "uuid": "60f5abea-88d1-4548-babf-43dc71bfce0b", "comment": "Malware payload", "value": "808466703546f63af964ea1ce61bd9abc56f2c4eebc8a164b550eb51c6558caa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355145, "uuid": "8a369361-5986-42fc-a044-8a0b14cc4bfb", "comment": "Malware payload", "value": "c183506e5cbe9629e412e6c91ea17310d28bc9eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355145, "uuid": "bcd16601-ba91-433b-bb96-7cbaf38fca48", "comment": "Malware payload", "value": "dc5854062944444ef01ab1c2843b8424b0f7b5ca5d8200b5fbcb983e4441df78c6477bfaa002c9278d8989a9290522df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355145, "uuid": "b4e3e25b-6c54-4dca-8d3e-dc8f8d0ac194", "value": "T1763723074C29CF1D289D6B3D207D1746269D1C005159F0EE63BB1AFEE2DEA1209FEEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355145, "uuid": "0ed1066d-f724-449c-80a4-b9b02660606e", "value": "49152:5vWvYvJvcv0v6vDv5vPvJvjvm3kvhvuvMvsv/3fvUv/vHvDvgv5v2v3vkv2vkvlB:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355145, "uuid": "90981c72-e0a7-4dd3-9f43-f648a050e981", "value": 22903925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355145, "uuid": "77a3bf97-fce0-42f7-9f44-52eb703f5ea5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355145, "uuid": "28ffba15-7ddc-4a5b-81ba-2dd8d18844db", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca423a8b-42e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777369442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369442, "uuid": "2f9062e4-d017-463c-a1f4-eccc8e1f2892", "comment": "Malware payload", "value": "f9a18bcccbdea287e553ad9268761315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369442, "uuid": "9904530b-ea7e-4cc6-b4f9-8bfd24c47b08", "comment": "Malware payload", "value": "8098d0ac5b16092440496840368865bb77a7c40a92a095c7baeb7e19b8a1fff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369442, "uuid": "4c900944-c3ab-44b3-94e4-31f97bb4afe3", "comment": "Malware payload", "value": "211869159a8ed24cf8fd0a01e8ca6d80273280d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369442, "uuid": "429e96ae-111c-4db3-88f0-17da5ca62345", "comment": "Malware payload", "value": "62c163a74d3e2266723e83a41137aabb7e837f5f2934a4650266c221ccbd47e51fbc94415cca2352aed3a9f3c07a7ee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369442, "uuid": "4e7625ae-eccf-4e85-8df1-f7577d51b3cb", "value": "T117083347B06865ABE28328F8305CB423DCAE5E51D24373DD55AC6FB2127C1F6A9C9339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369442, "uuid": "56efd8e5-0e57-466a-a8e6-950fea5f4931", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369442, "uuid": "f7812b76-668c-48b6-acb1-ec05b4258bbb", "value": "1572864:pejOt7ysRZL2k7HDSHW039jkuz3uAZ/3Zaah6dct/voBD7SKujEqgP:pN/RZP7u3R38e9RvoBXSKNqgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777369442, "uuid": "406a9c99-7b69-4455-9635-0c9915a39559", "value": 77957753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777369442, "uuid": "451b798d-fe30-4c02-9ac5-33a8d9b23c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369442, "uuid": "c040693c-41c3-4782-965e-1c5edb008e7f", "value": "Windows Security Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8129a63-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777377626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377626, "uuid": "84ac903c-4b8a-4ecf-acb3-e5662077f09c", "comment": "Malware payload (Mirai)", "value": "6443a06ff16e29f1c8db1cb5efdccf53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377626, "uuid": "142f35b3-837a-45c6-b0a9-70d15cd4b18c", "comment": "Malware payload (Mirai)", "value": "8213231acf234c383be6abfe8d8a7a6f0364f91917ddcfc1ac3cca242d463cd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377626, "uuid": "48defcf9-6f45-4e1d-939f-c1168d28f6e8", "comment": "Malware payload (Mirai)", "value": "4b9f34d598e96c3b17cbbb331e631783318c6b54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377626, "uuid": "ebb6922c-ebe4-4564-b2bc-003f86862e29", "comment": "Malware payload (Mirai)", "value": "725362c50966a32e99343ddc8484f581e8f01d9354a5560295be43b805087983da893157a7f65d3ff1368e4798a8cd2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377626, "uuid": "43539204-420d-43dd-9a87-7ef68e16536e", "value": "T1E9731AD7F810E9B6F809D7774497491AB230E3A20E921B767347312BED3A1991437F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377626, "uuid": "81783f4c-4048-4863-bcaa-12fceac22687", "value": "1536:OwhGwGLZ2/8ovPm3WIyW+6Ws+9ywLWw/scAn2HffZzlwBVMDj5dIxhcqVxga:5hGNd27PmGIyW+6WIwLdk4fZzlkMD9dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377626, "uuid": "81df100e-99b6-49a2-ad96-15f9fc612965", "value": 78348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377626, "uuid": "0d7ffbc2-7c1f-4ce2-8d2f-d7a2098eaeac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377626, "uuid": "d201e57c-19bd-4dbe-86e6-fc2feea07c11", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316adc7b-4313-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777388513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777388513, "uuid": "9217e2cb-39c1-4a2e-b1b5-f172613ccb5a", "comment": "Malware payload (MassLogger)", "value": "66a96d0add929cbc2a778a13faf11d08", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777388513, "uuid": "c54b8d9c-efa8-46c1-ac47-f333dc141a49", "comment": "Malware payload (MassLogger)", "value": "833e9a11ecd705acad4d9a1d9a3513ec8bcd25b45a75481b6e74266b9f56ef8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777388513, "uuid": "413c267b-8268-475e-b585-904013d02b6d", "comment": "Malware payload (MassLogger)", "value": "50c22ac39a882930e40adf24dccf79b6067a79ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777388513, "uuid": "fad02132-26ff-4c70-809c-e2b31cbd0ccb", "comment": "Malware payload (MassLogger)", "value": "400466e989df9532c287f39b4579ae407492dcee58545000ff9ce1d4519b2b787c1d4ed1a301919c8fdff397d3b1a3ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777388513, "uuid": "20cb08c3-9d30-4703-8667-4c5264658394", "value": "T1F175F11045C43FA4DF9E1A2D90FF3559F3A10A9E6815698AE733FD0AAFF7A0092174B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777388513, "uuid": "5c6d264d-90a0-4e47-a9b5-a5dd65588d79", "value": "24576:UOesEbP4xEL+egiFZ/KVj7iK6LrNT9/d+I09eRHd4c3Qt4pM:kQc+UZznru+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777388513, "uuid": "a7487ff8-819a-454f-aad6-366a0ba71be9", "value": 1576641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777388513, "uuid": "c2e90ceb-3b75-4b71-b671-01d218c89865", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777388513, "uuid": "3f4bc7e7-1441-44ec-b025-4d2bca667dae", "value": "Jafurah Field \u2013 Gas Field -SPEC- Al Ahsa)_RFQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e500ff8-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355383, "uuid": "9009d69b-5abf-4eda-bc22-0dc211415684", "comment": "Malware payload", "value": "20dea39e61d551d8117551331845c456", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355383, "uuid": "f46b5f1b-db10-4468-86f7-64cabfee7aba", "comment": "Malware payload", "value": "83d75369148eca79a1ec108eda5281f7d6ffcbb52b4d54c361ec4ade408ea919", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355383, "uuid": "4e42c1bd-e2ff-4dbb-8a36-c293e87726c6", "comment": "Malware payload", "value": "8ee8189c4857804c69adbe5acebaf80fec26b907", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355383, "uuid": "ae385cb0-0b2d-46e3-822b-35a6c93f52fb", "comment": "Malware payload", "value": "5cc95a1bcba2013c928fd3390f7d4b2477effbf5bc11733f926dcf829f3c8633031fd3e8f4a4f916e79ac265ce469024", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355383, "uuid": "060a5fcb-4bf5-47b7-82fe-30e310c9103f", "value": "T1B537234A6D188FBF00A47F5C14FF2D4FD6E292444C206EF796AC3F5696C980A293B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355383, "uuid": "4bee1171-f4de-4017-8bf0-78ec5cb4c987", "value": "49152:PsIsWsRsDs2swsqsqsHsMs4sIe4NGJsdsgsCs+s4e4NG0s9svsDsmspsvsHsmsfU:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355383, "uuid": "b4469030-3802-4df4-b2c0-ab74774199a6", "value": 22383668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355383, "uuid": "c1b0a315-c019-4c69-b8e5-13a4067932c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355383, "uuid": "46cde4ae-e167-4c1b-bf63-1300c321d082", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c035bbfc-4340-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777408080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408080, "uuid": "0581eef8-6024-4c0e-8919-07c12c22aa2e", "comment": "Malware payload (Mirai)", "value": "c72271841e12ccaa5d877ecce98341d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408080, "uuid": "b3490fce-1e30-46ac-bfb5-c72748c5ab85", "comment": "Malware payload (Mirai)", "value": "848648dc59e61a4155825b755024eed8eea96ae9777119507d86b9b02f73fab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408080, "uuid": "3da90be9-e2eb-4cca-a299-43cd7f912a8f", "comment": "Malware payload (Mirai)", "value": "8854cb4a08a22e8214f2feb34e4260e2e79ba24e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408080, "uuid": "3fd66ee5-587d-4ce3-802b-1fbc73a20f87", "comment": "Malware payload (Mirai)", "value": "64576c3826d1a338e7e735417be467c6200736ddbe64e11c31318acfe1e64121e5ec19bf27df53f89099c02759629074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408080, "uuid": "bfc7560b-21c1-45a0-9ee9-4cdadef6dda3", "value": "T196632A81B8829613C6C412BBFA6F019D776653B8E3DA7213DD219F20378792B0E77746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408080, "uuid": "ad376fff-b6c3-4480-862d-0719d0d6fb01", "value": "1536:UNyzA4/2loHNSF7supL0zA/B3+X6pmOdy7Ep5cc7L:UNyzAnrB3+KtcuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777408080, "uuid": "d79da10b-47c9-48cf-b973-85f34e5a973e", "value": 68780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777408080, "uuid": "0800f485-8903-410b-9d5d-da8653e6f64f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408080, "uuid": "f64996ad-5319-4031-b076-9ed427c9d605", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15140878-42df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777366132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366132, "uuid": "e7d5d212-c08d-4a36-bf7e-3b7f0bfc810c", "comment": "Malware payload", "value": "fc45372d7ee175d80db8a4331a6e9d6a", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366132, "uuid": "ef63d9fd-6aad-4cb9-9284-4edc56c5b5e1", "comment": "Malware payload", "value": "84e3190977292faed77c7c71ad26555c5bc770fdc9dc3f84376297ce8ee6727c", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366132, "uuid": "edf2f77e-7a8a-40c4-9f3e-f54270d53cec", "comment": "Malware payload", "value": "642fa5fa3094655248a67cdf5698a19e2ffff50d", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366132, "uuid": "6a508afc-ad3b-4232-9101-2c1f7350694e", "comment": "Malware payload", "value": "19ab7f752a313051795f967217802f3c8b4f275f4e578690d83dc827e6c2296a723a8cdebfd2c8fcf3fe5f641fea4464", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366132, "uuid": "3408ca1a-f859-4b1e-ab41-575e45c20386", "value": "T13BA53356B1EB8A67B327464A66F282330978E916316DE3FE5052E422E3544F9D3CFDC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366132, "uuid": "3c2b6c38-a24c-4256-9eeb-b8dd7d735080", "value": "49152:J5x/231wB1XbT5yMS7xhd7BmH1coipwkPmjOkx:z5i1aLT4MYb78VyEjvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777366132, "uuid": "05a060b3-6365-4be1-bc58-8fd457d0260c", "value": 2118800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777366132, "uuid": "99baf15e-ee52-42f3-ba76-935cbbe92ab4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366132, "uuid": "e9c58ca0-eaa8-43ff-8dac-5ffc5f20ea81", "value": "0ed5fc014a3981d620df3b5b6c6074d4ebdc04e6d805b522f47feababbac7557.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f05f7b-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355211, "uuid": "a55261c2-e65c-45af-b18b-4ff15c14cc5b", "comment": "Malware payload", "value": "9dcc2ba810c06aa126afda9576d7884d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355211, "uuid": "bc11fe44-9f1b-4116-9f6c-ea22a28880e4", "comment": "Malware payload", "value": "8520abd61655f62caac36b2c0c4d3f545c26d60f1e0b1483f303a9b95ae41830", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355211, "uuid": "eab6acab-e4ab-45d5-9e2f-e25f229685e7", "comment": "Malware payload", "value": "04498cc3349cbbde250822f8bd9202c3c5548761", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355211, "uuid": "20293cf9-fbf6-48d1-a5f0-30c23c8618ab", "comment": "Malware payload", "value": "6fa987407f3159ff77f75dcaebf1e5d50647047614dbaefb10bbfeaedb409afb75ec791e63e54fc50701671229cb8262", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355211, "uuid": "672d8b8e-056b-44db-a88c-cce2e46ce0ed", "value": "T19637230A8D77593E55ED33FC627B094B9EB34E9A900ACFA38691744EDD9ED41206F02C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355211, "uuid": "c2f66282-9a8a-4f22-a1f9-416513fd7c9e", "value": "49152:4p04p0Fp01p0Dp0Ap0ip0Ep0Vp0Dp0Wp07p0xESQp0Rp0Hp08p0kp0vESnp0Yp0z:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355211, "uuid": "0ae36cbc-8c22-49c6-ad28-887c29994aab", "value": 23424196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355211, "uuid": "57046a15-414e-4e51-8fca-2d8c5efb4510", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355211, "uuid": "d959c3ff-96e1-4047-ace8-ee49bb326c2c", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8cddc5-4301-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777381126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777381126, "uuid": "d7cf5cc6-a2e5-4099-b01d-4f33cea82d86", "comment": "Malware payload", "value": "7fff92a4e399006f212808874290c1f6", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777381126, "uuid": "e3c5b10d-c5e3-414a-836d-aa7b69db86d2", "comment": "Malware payload", "value": "856584606f0bc5182d1e9d20e70c1d07f78355afc974217a128707c9e14fa6d7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777381126, "uuid": "705197ab-16da-477e-a42a-f7f91f3e41de", "comment": "Malware payload", "value": "faac720d8b595bbe676c37c2b4ea27007f2fec8f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777381126, "uuid": "06b3b7d9-2a3a-482d-b0ac-cd8db7fece78", "comment": "Malware payload", "value": "a3bd1b0cb0f9cc010f1ce5ea933d4e76a731c0eae1b6103783d4cdb3d31d22e408b4188ed68c8a789bb729e667a41695", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777381126, "uuid": "cc15e6dd-7e51-4755-a31b-3122d8a079e8", "value": "T110A35CE412EDF3265B9698C439F17627B12B78FD9BDCE30E0893949985C1CA7D14EB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777381126, "uuid": "0ad0f7e1-ea85-447a-9f9a-3778161a3047", "value": "768:6oEZY7m98tzJBO4TFD5gksNbbbbbbbbbHsv/2cct111p:6oEwmFNksdsGcct111p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777381126, "uuid": "a87d3c8c-5d0d-40c2-babe-e8281f19f56c", "value": 102518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777381126, "uuid": "69ac770b-a0a8-4182-8d6e-cbebb346c963", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777381126, "uuid": "92af6f4c-c75f-45f2-ba7d-d62a581d2837", "value": "Scan_5_19_1_1602_28.04.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee97eebd-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403434, "uuid": "ddf6e55e-6db6-46ab-9e4f-693ae7083815", "comment": "Malware payload (Mirai)", "value": "bd55cb5b8e03e56bc19b335096f7852a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403434, "uuid": "48951e59-5060-4012-8f18-359631bf4607", "comment": "Malware payload (Mirai)", "value": "85757cf01decfc6202d61eaf46e78f3f646e302614f9b39d81d7821ef51b85c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403434, "uuid": "4e6d4898-3a2a-427d-8116-9c8f92bc1fa5", "comment": "Malware payload (Mirai)", "value": "fb95d5c672923d6c1cb7a2cc8c1f98d9a0c7ffba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403434, "uuid": "256c9449-f31b-475a-b05f-8f568a41d2fd", "comment": "Malware payload (Mirai)", "value": "5cb282644bfa1529a265de61e6cb4e1f0f8120e00aaa1833bb16e1a9416a85784bfe132903c8c508122aa24b980ff247", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403434, "uuid": "b3d68133-14ff-4834-9ceb-bca18de1b496", "value": "T1CDF33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403434, "uuid": "36420c5f-fe16-432c-b9d1-cd0c6e927f1d", "value": "1536:3dMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpoEn5p5M/LW:/7vDtrnPTR71gmX7Dy7fMpoxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403434, "uuid": "946cc45f-3da0-42ce-8eee-2ddbcd3b090d", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403434, "uuid": "a33af42c-7b57-47c9-92b9-ca300f6cac01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403434, "uuid": "9790e53f-26be-4592-9d8b-4d7d8a21b527", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1007169d-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389316, "uuid": "9510a423-458b-423c-9648-a50784d635b0", "comment": "Malware payload (AsyncRAT)", "value": "70b44788635a11efa3009c13f2eed1ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389316, "uuid": "ccc338a9-06f8-4cd8-b354-a3086e07f188", "comment": "Malware payload (AsyncRAT)", "value": "86d2cd69b2349bdf674036d348bab06d23b308e877ce737fa684d1d56daea314", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389316, "uuid": "6960392e-b066-4ec6-a62e-f6daa9e6ae66", "comment": "Malware payload (AsyncRAT)", "value": "0aa7819b12cffba943ef345314a692897381f108", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389316, "uuid": "1cb43d8c-ebf2-4e32-9e6e-0d6679712dc4", "comment": "Malware payload (AsyncRAT)", "value": "cebae337a91a08af932bfaee3be00eed1f2486930b9935e92502d9c894b23dac1776012e9a0fb9819a72e2da1584a973", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389316, "uuid": "4a24d26c-55c5-4e8f-92bb-b68b4ada99c4", "value": "T1501339007BFC1629F2FE4FBCA87951454236F963A932C74E1CC4119E1AA27C4AA51FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389316, "uuid": "4ea97012-6d31-4fff-bfcb-f0206ca4732d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389316, "uuid": "79d1b030-84d3-4e66-92de-ae530fd74cfe", "value": "768:sq7x+iNv0nZIRWVYgnV3wc5hSvSRCfXuRbheuoVNtkFlLvWD+:tv0CgV3H54qQPuRbguIN+nLvWD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389316, "uuid": "3ffc8ec2-46ea-4e8f-b946-825708a06d09", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389316, "uuid": "9df8a3a2-eac9-4cc0-a233-4cd07eff4122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389316, "uuid": "52505e60-9fb3-464f-89a4-90477b7f520d", "value": "86d2cd69b2349bdf674036d348bab06d23b308e877ce737fa684d1d56daea314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090382eb-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389304, "uuid": "a32ffd68-6157-4bc8-b6ba-21028b96d14f", "comment": "Malware payload (AsyncRAT)", "value": "ad7aa0da7624bdd5ec23401b76eb6199", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389304, "uuid": "9181bca6-974a-426f-9c89-7fcdbe725b7f", "comment": "Malware payload (AsyncRAT)", "value": "874ca534669c559d4ebad4278c0934497356a99a6c10e4aecff1b1238be32242", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389304, "uuid": "48882cf3-cf24-4fdf-943d-e78d52866eed", "comment": "Malware payload (AsyncRAT)", "value": "86710be09c1c56e974412301e84eaec79805ccab", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389304, "uuid": "1bd8e5fe-87da-444c-8651-ed28ba0fadb4", "comment": "Malware payload (AsyncRAT)", "value": "d71955612a7d1b933a95127520d8156e55552fa9e420a0f08229b66a7f0f64e3987fb1e743807590eef04d21fb8a4368", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389304, "uuid": "7a546999-4d47-421b-b560-0354e94464eb", "value": "T1271339007BFC1625F2FE4FBCA87952444236F9679932C74E1CC4518E1AA27C1AA91FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389304, "uuid": "78f355ad-044f-41a9-aee6-10b87cffea95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389304, "uuid": "c165771b-92e8-499c-9ef8-c517a9392f89", "value": "768:8q7x+ap3wnVIRqtYsnhvUYZ5SvSRCfXuRbheuoVNtlXLvVD+:Z3wKshv/ZAqQPuRbguINDLvVD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389304, "uuid": "d31d8319-c905-4dfc-b0cd-007d9636f3cb", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389304, "uuid": "27a61d75-deba-477a-888a-e7b1fe6b3585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389304, "uuid": "80c05a6a-689a-488b-a962-e402966b54bb", "value": "874ca534669c559d4ebad4278c0934497356a99a6c10e4aecff1b1238be32242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0467e77-42d7-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1777362983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362983, "uuid": "0166fd18-2e50-4448-bff8-76eba3fe2b2c", "comment": "Malware payload (DonutLoader)", "value": "bfef76c9c49cc8ac39d181ff0bc29576", "object_relation": "md5", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362983, "uuid": "2bf2c84b-adbf-450f-9717-79dca3331fc8", "comment": "Malware payload (DonutLoader)", "value": "879b38e9c4b9f0741fe217f2539cbcfb0beb72778418c8b8af3b6b65c0bf4a50", "object_relation": "sha256", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362983, "uuid": "ae331bf9-004d-4bfe-a8d2-8f618da53536", "comment": "Malware payload (DonutLoader)", "value": "df419b472c548038355a0d80a528319c1a727b90", "object_relation": "sha1", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362983, "uuid": "67069736-90a7-4cd7-91d8-7e9d9ec21579", "comment": "Malware payload (DonutLoader)", "value": "5db5e763c6fd46daf5d2e1a90eedb0936736d941b8485c764efe99320fc3ac956cfd830a94e2c5eed18977ec17c7a858", "object_relation": "sha3-384", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362983, "uuid": "9db90c15-d34e-48e6-b381-48d34af5c849", "value": "T1A893D057F3976498C20EC03987C566748D34BC04092997EFD2B9BAD13FB0AA86D3D626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362983, "uuid": "bf3bf9bc-ce22-46ec-a654-32c6373d4aeb", "value": "850c7371b5a26a26442526a0bf1f1e22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362983, "uuid": "f122357a-9340-4bd7-b4c8-1558636562bb", "value": "1536:d4kk2P7RAkqFTz/+2cKvrsA8tbWoIYU4PJOOYLJbz:iR2P7RT4GBKzh8G5WvY9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777362983, "uuid": "f2b49b61-b21b-4340-af4e-0c17963bbed3", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777362983, "uuid": "10ff0429-2a26-4a77-b26e-ed18870d1712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362983, "uuid": "dbdb0274-0673-4338-b510-db9067cbe639", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cac8bc-42df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777366502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366502, "uuid": "80ee320b-e5f0-4644-af5d-f7cd7f4a9098", "comment": "Malware payload (Mirai)", "value": "2a0ebf2aed3edc046104f9fc1309f60e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366502, "uuid": "404ad173-1580-42ee-9804-9b5e96103fb8", "comment": "Malware payload (Mirai)", "value": "87d0cb7aea86635fa05c97355d72d48feba4672ded22f44c0d79180357e70fd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366502, "uuid": "98f75c58-db95-4085-bf76-f9ad3e9bf16c", "comment": "Malware payload (Mirai)", "value": "49d853178bc8de0a422d287963cd2c91eb15f3b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366502, "uuid": "38a4ebee-e441-4437-8dc3-00554a4720ec", "comment": "Malware payload (Mirai)", "value": "3bde7b9173493794d7d70d478f0ba24b4e04d7dfb27948c34209da1df317f938a0690b23e40c0a8f40b665ed4baaa72e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366502, "uuid": "33c959a0-aa38-49f2-955f-76fd0071da7b", "value": "T1EE633C4372280F47E5A249B4253F1BE093BFED5024F4BA88694FDB5A4639E761086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366502, "uuid": "adf425e6-5e07-4c8a-b8c2-3a147b09c786", "value": "768:rtbRcTIqx+TV7Rn0/qPhTS1qBeaqPfH7MZff9rwhOm7SG26sMxH5R+h2xMBS62Oa:4g7q0TS1qBp2DM2OPMx36EZIJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777366502, "uuid": "a4e7b9fc-ccb3-475f-8416-6554fe6e44bd", "value": 66808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777366502, "uuid": "bc39857d-847e-4a5c-9812-9783601c9f1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366502, "uuid": "717721f8-be3f-4ba2-aeb6-50d1c1923ee5", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945b7215-42ef-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1777373217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777373217, "uuid": "b5c1d25f-8da7-4da1-b4a0-2111749ca9d5", "comment": "Malware payload (SpyNote)", "value": "8845d6b3792a5cebdd94c1c5a1c92a75", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777373217, "uuid": "a704ed3d-fda6-4974-88c9-ea9b6a19e1bb", "comment": "Malware payload (SpyNote)", "value": "87def7f445734b4b9b57b97cd4af8d22b2684dd4dd3e7ae8d07a120efa3b1814", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777373217, "uuid": "ff0dd6e2-5476-4ea6-bd4a-609273477747", "comment": "Malware payload (SpyNote)", "value": "6161ddfe1a25e8a9d48b507941a865c6837477a2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777373217, "uuid": "3522d7d2-aaa8-4391-a903-fcd7e0436d81", "comment": "Malware payload (SpyNote)", "value": "9b06d13f29751fdb431576f19a5a16dfef7fefebdae73abb8b19b2185d65e9e923479f8cbeac143ce579caa50c3bd7cf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777373217, "uuid": "e68f8bc5-f18c-4333-b1f9-336a8503233d", "value": "T153E413837F07EC79E776107ACA8D82C6663F5F694D41D2EB1E5B720D48366C0AB84E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777373217, "uuid": "406c938d-b6ff-4781-908c-be14a380465e", "value": "12288:kJjp1YM6sXm0En2uu+8zcX9pFsgILK2njBRLIusT3cgtN0F/+6Rq217gY3JtWDkf:sN1Fk0E2uKzctAgGQHT3SF/+GNUi2kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777373217, "uuid": "ec675a28-8a5e-4dbe-b167-aeb5ec0c6acf", "value": 704893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777373217, "uuid": "1e8dfa91-cdae-4627-aeaf-273a37fc2a5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777373217, "uuid": "facfd0f0-4d7e-4609-8662-a9cba30694e5", "value": "ready.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cd0182-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403441, "uuid": "c7c08dcc-bd8c-4ab4-a0c9-f1c7ae4bcb47", "comment": "Malware payload (Mirai)", "value": "7b953c60fbccaa006f9f8e0f7116e334", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403441, "uuid": "9bfcaa8d-8252-4e50-a7a2-621d81bd7a83", "comment": "Malware payload (Mirai)", "value": "883f5ac15547ddbbc724e1c4c1689dd22412394a4824cd8773b3f15bad99cf4c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403441, "uuid": "25fddb56-05e3-4c59-92a4-73003c6771fb", "comment": "Malware payload (Mirai)", "value": "1c034522770d667fc0b3b90795d649342b2b9cad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403441, "uuid": "d7c169f8-0d1a-4a21-8a20-4fe453a2e594", "comment": "Malware payload (Mirai)", "value": "fdbb4d79ab650d523b5859c51ff8486194b15de6b53434ddab4c6c006fc90a62bc5c79f59f2206b8517aed192cd6537c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403441, "uuid": "54e41d39-7ecb-40e2-a5d4-b72b3f0784e8", "value": "T1D632C517A7BBAE1BC4D037770193072162E95F916024472FBD0D1C8E6E9A3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403441, "uuid": "8f788b79-9a0a-46a2-aaa5-fc9e487fad17", "value": "192:xvrOR1CQOsz1NxfAz+OH9iG0GhWaDpU/O7Q89AGSyb/qeif:xvrbCzfap2GwIU/kwGSkUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403441, "uuid": "7193919f-32f1-4f49-8761-d41290d0c8d8", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403441, "uuid": "6618c664-a9b7-4751-8b45-e5fd2c2ef3bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403441, "uuid": "ec3c26a7-9ce8-47cb-ace7-c5a462148378", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d8733f-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403439, "uuid": "c07bee54-5935-40ad-b261-1bd59cbe186a", "comment": "Malware payload (Mirai)", "value": "78949dbed5f325ad3c4ff9c12ddb57d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403439, "uuid": "99380d41-256b-474c-a8a3-82000dea54b8", "comment": "Malware payload (Mirai)", "value": "888e3808300603e551b93f54519dc59e1d07cb95c38f46458f572df52f5a2fdc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403439, "uuid": "a4df1331-2d33-499d-8b01-d025496cfe6c", "comment": "Malware payload (Mirai)", "value": "c410f4348665e054746787f8b1dc8cf94e6c6512", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403439, "uuid": "27d1de79-5f25-4fec-9e23-0432b47d80a2", "comment": "Malware payload (Mirai)", "value": "97abfee3fcedd895b636b8b857566f2123315f68731b61dcbb5973b1300d615e68c8634e940ae36171f5836e9e66e48a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403439, "uuid": "300dd6e1-5f30-4c30-abf3-be1f423d6ad1", "value": "T19FC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403439, "uuid": "623379c5-a23e-4e3a-adbd-9052017769e6", "value": "1536:68B72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dhJ:6eB4exMF7oZKJnCNYavJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403439, "uuid": "43dd197d-513a-422f-89b9-5c01e35d15bc", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403439, "uuid": "f69a38de-78e1-4eab-98f5-3904474fff6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403439, "uuid": "c9f4379c-7e61-4794-8b95-3c8e0b596567", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0da70b-430b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777385119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385119, "uuid": "79032d16-1ad2-40ba-85ea-658b38c6381d", "comment": "Malware payload (RemcosRAT)", "value": "5c89f67592f6cf6285c97629fdc1e89d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385119, "uuid": "8aaa7d4c-9c1b-4ea9-85bb-dcd79d676368", "comment": "Malware payload (RemcosRAT)", "value": "892d9d082a6f846c77d611596da478efb11545709432211a837dce0119d127ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385119, "uuid": "6b35b54e-550f-4a89-9430-0294cadf5360", "comment": "Malware payload (RemcosRAT)", "value": "8f183a42e06d82efa2f588ae3864935f0b3cbbcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385119, "uuid": "1e54c4c7-4716-4c7f-bad6-4673a94d56c2", "comment": "Malware payload (RemcosRAT)", "value": "882263164a2e2a947b3ac330855c509a1782b37c8192cad78bc5e71f856bdf7dc96005af29534b7c69d20675b336d434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385119, "uuid": "14977c5a-94ba-4766-a7ac-e6d63fcd482e", "value": "T1C0B4B001B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30190AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385119, "uuid": "ca02d75b-5a2b-4f39-b11a-f40fc05e8520", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385119, "uuid": "716c7906-7ed9-4509-902d-15d517a7adbf", "value": "6144:bXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBce5:rENlHV9FGeDWv3jADnyYiCNrsPZ0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777385119, "uuid": "f4540824-cb29-4d28-9d66-5abcea95ce87", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777385119, "uuid": "9836e129-5686-4f11-827b-d8e2b769d584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385119, "uuid": "9b80fc91-df75-491c-b603-99f7fb7a5bf7", "value": "892d9d082a6f846c77d611596da478efb115457094322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb71dbe3-4337-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777404234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404234, "uuid": "206b8bb2-8d63-45bb-884c-69ee454496d8", "comment": "Malware payload", "value": "b6258794647d1d4f8ea308f9ba723d62", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404234, "uuid": "aea6dc60-232b-423a-a16d-1369209e326f", "comment": "Malware payload", "value": "8a2b23bdb0d5862f947e81e70a71ff250a5bf82430c70bbba2383b07eca06ff9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404234, "uuid": "ac1875a2-f641-40f6-b202-dd6533221f5e", "comment": "Malware payload", "value": "fc510e521f7479e28a7aa10389ad5f35f4fb47a5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404234, "uuid": "5d48ba38-45e3-4a37-aa38-df6ab45e7536", "comment": "Malware payload", "value": "df9d38b740589533e678ab2fac21643959f5acab69a034e094451833c9151719fe5d4432fbd226ed633b02ae8de6d235", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777404234, "uuid": "6d91b65e-8890-42a1-aea9-d72884f8023d", "value": "T124C08C11420906F2D33828807837139F30DF043200FF191239399C252400EEE33FBDA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777404234, "uuid": "1b50d658-a2b7-465c-807f-79240c080535", "value": "3:WYERIvxmhiyJS3oqLvkBFCceGAFddGeWLCX784ICceGAFddGeWLqFBXBBIICceGw:WYERI5mhijjLvkBPeGgdEYFgeGgdEEFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777404234, "uuid": "1db0acaa-83a3-4916-b5eb-1ff3d22e023b", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777404234, "uuid": "c90245f8-1d66-4246-b9b1-966b43e9f9b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777404234, "uuid": "a1c27601-4bf2-4263-8cdd-b5ae9fd98e72", "value": "sysfix_6314.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28757196-42f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777374325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777374325, "uuid": "917ded49-cb84-44e0-8aec-6116d8253f3e", "comment": "Malware payload", "value": "b8b4fb068555cb4a415da0ab55e8c471", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777374325, "uuid": "16d96eda-375d-48aa-b496-de7211dffdb7", "comment": "Malware payload", "value": "8a5eaf42580ad92e57486f055cf96a1af56b8336d7cc14c23682caed8e362bd9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777374325, "uuid": "bd040c53-7992-41c8-b239-593621cd00de", "comment": "Malware payload", "value": "04602652b5d54117f249725be122875a178404a7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777374325, "uuid": "3e4f5e0d-8a4e-462a-b550-5f9d8eb39134", "comment": "Malware payload", "value": "1873e8c5f59a1f26427f404f9729d4f17ba277901d9f1e079b94b9e6f8c4c9ef089276492d51015a49852a4278db17a8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777374325, "uuid": "410fdac3-e1c0-4863-ad7a-618cbe811cfe", "value": "T179D26B1BB6058232C6420B360A5BEBE54F75AC585F6320433BCAB34D3D73AD532B69E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777374325, "uuid": "f58e1a4c-f1ab-4530-a6bd-a2bf5c920352", "value": "768:SRXpVqA0KqDv/YmKBc6WVNeWMbCUs2DN/nq:3Dv/7+jWVNob5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777374325, "uuid": "f1695568-02fe-4ba9-abe0-2902564bbd1c", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777374325, "uuid": "0cc9b58d-f1c2-4323-b15d-3ba887a7ad9d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777374325, "uuid": "445b3a94-7ffe-4ae6-98ee-0a6066630a91", "value": "disk2vhd.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046d4e52-42ec-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777371687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371687, "uuid": "cfed12fb-de23-4db1-a176-d206cb22189c", "comment": "Malware payload (AsyncRAT)", "value": "5d7c38a454572e068141a98991b4ac42", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371687, "uuid": "c3a78374-932e-47f3-80fc-d913c56dbc6f", "comment": "Malware payload (AsyncRAT)", "value": "8a87aae368cd9817f313ece0e4bb52568017c01e245b7883b03db4bb03d80a1a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371687, "uuid": "6470eaff-e169-4c26-8c0f-fdf16d1ade4f", "comment": "Malware payload (AsyncRAT)", "value": "9fa3cebe7b49f2412a0d618e82c461fa5e2bcd0b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371687, "uuid": "1e4f1b42-6312-45e2-96eb-877729f63173", "comment": "Malware payload (AsyncRAT)", "value": "05d7c5d9bf61d814a3f1c1a87d657a916924ddfe69acc7d068369102a51a4b0d9a8e89d09dfb1bac4bd17c5411d27495", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371687, "uuid": "615b0bc8-e401-46d6-818e-bdc75d8ad6d8", "value": "T1B666C01AB7A501ECC0E7D5B88A175D13EAB2784913329BEB57E089552F23AF05F3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371687, "uuid": "f302a799-6fd3-4627-be72-9f81adb11839", "value": "e5a2c85b0f13d6d706a027c875e2df5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371687, "uuid": "acebbf53-6eef-4c9c-b19d-623de482fd3b", "value": "49152:oVdbcZiQ59a3EbEMUn6RVR4SME9ca+35SEGHY+/o+wiofnxaPKq5wMJn7q4TUEk5:ok2+Uns+QFOfnxiKE1TO8TIzVRJIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777371687, "uuid": "db7b656c-5a6e-4d02-b4b4-14a8a3752942", "value": 6495240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777371687, "uuid": "e4627d4b-949b-4c01-9b09-df7d40c58a88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371687, "uuid": "356ae53e-316d-40b9-80d0-a4f3b1d210bb", "value": "8a87aae368cd9817f313ece0e4bb52568017c01e245b7883b03db4bb03d80a1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06481f64-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389300, "uuid": "97b42c15-78f5-4f0e-bf6b-a547835bcafc", "comment": "Malware payload (AsyncRAT)", "value": "1b7139f74c9be8a6e2896483a8d9ddd2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389300, "uuid": "2b19f796-a962-4848-a222-6f1ff2711466", "comment": "Malware payload (AsyncRAT)", "value": "8ac699aabcf29110b4e97f7f18600ff78eddd617a782e904d7395d67389894d3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389300, "uuid": "ee8527b5-2290-4ba6-8680-bc66b3688b2f", "comment": "Malware payload (AsyncRAT)", "value": "f4f9f29b6f3508db0bdddd6ce38114845dc0a677", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389300, "uuid": "8f9446b2-156d-40e4-90d7-eca601c435d5", "comment": "Malware payload (AsyncRAT)", "value": "af080a4f243d1d7d4c163a60944f7bd731360f87745b2a9e02992c4227d03fa701a6ef027c9bc741ae508182a7da4145", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389300, "uuid": "e7c08cc7-c8f7-4952-a33e-676f445be96a", "value": "T1C6332A047BFC962AF1FF9BBC98755505467AF913A832D74E08C8108E26B27C09A51BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389300, "uuid": "0bb623f7-5a83-4ca3-b110-97f967c34e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389300, "uuid": "ef8de365-45a9-48a6-bf33-9e4330827cc8", "value": "768:z0vjtppZpr/tz7BRRXBRr07RbjeuOlot+C+15D/61/FF+:2pPpd9RRXrw7RbCugokCE5z61/FF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389300, "uuid": "8b4abc76-9aba-4329-91e8-e0f8ad7957bd", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389300, "uuid": "d7faf30d-6551-48ee-ae9b-ead257ceca48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389300, "uuid": "30c0a6c2-4a38-4c7e-a886-6ba11740a57b", "value": "8ac699aabcf29110b4e97f7f18600ff78eddd617a782e904d7395d67389894d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091d634e-42ec-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777371695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371695, "uuid": "638093ec-08da-496e-adbb-55b7dabb0504", "comment": "Malware payload (AsyncRAT)", "value": "d468d54c2f95df99137a8f3074daa9fc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371695, "uuid": "f687eb07-13c8-4754-a534-be8013149261", "comment": "Malware payload (AsyncRAT)", "value": "8ad4ee4f8c4ec47148635ecd1f3f70506b96752ad0c018fa5bc36596d559ec81", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371695, "uuid": "a35fedc6-6a17-4520-ae52-6e1cc491efe3", "comment": "Malware payload (AsyncRAT)", "value": "df8c29fe0a2e7fdf414d69de90d0bfa72183ba7d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371695, "uuid": "42a6f2c3-e917-4cc9-815d-f91b91719aba", "comment": "Malware payload (AsyncRAT)", "value": "f76efb9823ab71708e9373fc8df5b0b6beba28e8a0d500d395033bcf87c1c9544f336d0678a2f3f58189eae65db892e1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371695, "uuid": "b22f8f46-f431-4bdc-ab51-1600e29926cd", "value": "T16ED533E3D69EE152D0C4D07C39C6094A63FF0FA69E33989673CEC09946E89836E1C675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371695, "uuid": "2338505b-7df0-4f8d-b8f7-835105eb92a6", "value": "49152:Im5fiUjQo0QDlWtzoD3atAAs7AaHqnNLbdVkGuRhdO8OMqS3h21qIPh27:Im5VQo1DlWZoD3Ss7QVqoA+PU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777371695, "uuid": "8ea297a6-ccc1-4709-ba0b-7294cc701c0b", "value": 2845820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777371695, "uuid": "b1f2db52-d146-4c5a-949c-82feec586d35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371695, "uuid": "02e8d619-14fc-4704-b832-3fdfc7b4152a", "value": "8ad4ee4f8c4ec47148635ecd1f3f70506b96752ad0c018fa5bc36596d559ec81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cc655d-42d7-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1777362798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362798, "uuid": "98350600-8570-478b-a843-f0bdabdabb8f", "comment": "Malware payload (StrelaStealer)", "value": "479958aa29e02a8ea9da2d099eb20c05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362798, "uuid": "54039fef-28ad-4536-b765-9ce854394a34", "comment": "Malware payload (StrelaStealer)", "value": "8b450c09dcd4cddff6ced02326719c500c953b087cffdf7f325639c2add8a738", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362798, "uuid": "475a3f1e-9615-4c85-88da-f0347e404827", "comment": "Malware payload (StrelaStealer)", "value": "00856179af786da8064470e1134efda6ace63f10", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362798, "uuid": "1870019b-e477-46fe-b6d4-400c076190ac", "comment": "Malware payload (StrelaStealer)", "value": "3935ab8376fded0cd6c48f2f443dad1ae49c8d04938debc86d43f88d6e72bc3116dcfe0ddcf4e54f3f48cd052cd1d4f4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362798, "uuid": "a6c24272-0baf-442b-8580-c841610003a1", "value": "T1D8643B3439FA5019B1B3EFA5AFE47496D96FFB333B0A945D1090034A4723981DD9263E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362798, "uuid": "47c77af3-ccd3-45b7-a903-d11430782173", "value": "6144:zcwUS9+qs2r12A5X1YlXiMcd+3IouKXH6Drc9jw1wp3SO7+NlQNPhyJqMSiR8sxG:zx7s2r12A5lgiMcQ3I7KXH6Drci1wp33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777362798, "uuid": "e6d96d7d-ea0a-4eb5-a179-629afa265913", "value": 324168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777362798, "uuid": "33567d5e-ddfd-42af-8301-2badf56ea88b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362798, "uuid": "6d4241d4-f344-4f5e-909c-278c7fe7885e", "value": "QUOTATION#MGE274.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1801d888-433f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777407368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407368, "uuid": "979c2a70-f882-43dc-b41d-bba0465ad592", "comment": "Malware payload", "value": "6f05e222fc898de80209d57c2016f428", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407368, "uuid": "8cb2aa80-c061-4469-80b6-2829e15b91f5", "comment": "Malware payload", "value": "8b8307812d5a8ec31931468bb24e5a1ded3150cb8507a2fbd799ef5effa7abc8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407368, "uuid": "6daa0df9-0194-4cf1-9e07-83e2ce38bf27", "comment": "Malware payload", "value": "9855282b70ed3fa79733567e330f8a433cbb87f5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407368, "uuid": "64e65fbd-1247-4e0f-ab4d-e22eb04985e8", "comment": "Malware payload", "value": "6b013bb9475c673db1f53b7ef3e89989f4db1799578363fa1bf5f37d32ebc2c52f5b55190cf85db5dab852edbb43cc84", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407368, "uuid": "06e7f2eb-621f-469a-8862-75e3275cfc9b", "value": "T1D282824CCC56DA6C4A73635C9DEF0BF3A8BCA208D17EAD3576DBA3746000258D52C6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407368, "uuid": "5d5690ee-0326-4033-8af2-98a3079a6127", "value": "384:49UCsVzIBHBZf2fUlPo1m4vD0k4gLzR5PYg/fyKpWwpfOUG9:uzgzIBQMlQV15ggn3P4r9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777407368, "uuid": "8312f71e-9301-46b6-830b-ed886ae48a94", "value": 18684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777407368, "uuid": "2541e380-50ca-449d-9e69-c7ab0c51471a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407368, "uuid": "579cb242-208c-4085-b809-faffb9b76256", "value": "SCS0503-042826-0305.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86cfb7c-4314-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389277, "uuid": "924a4551-44b0-4475-8f94-3d910a8ccdcb", "comment": "Malware payload (AsyncRAT)", "value": "13bf99fc912f8dc07d6dd5561aeda0b3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389277, "uuid": "18f9587a-1c82-454a-b515-c69ed50668f3", "comment": "Malware payload (AsyncRAT)", "value": "8bcc386e1c2d7054051912494c30137126876ac42c2fb5fac19a767a20350373", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389277, "uuid": "09d63801-8c73-4351-b266-14501e28e80a", "comment": "Malware payload (AsyncRAT)", "value": "0ccef9c5282a613e1a6b20e057c8a788122380a4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389277, "uuid": "3c653c60-3e9f-4f11-bed1-a9eebfb116bf", "comment": "Malware payload (AsyncRAT)", "value": "447aeea2fed29bcb785b84ae7b51e37d0f78b7af7e9abf62da0b94564cc227ae7e7f5693d410d0eb966df60fe9f1b9aa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389277, "uuid": "cfb5524f-f233-4108-a4f5-23c4ad6159f8", "value": "T1C91339007BFC1625F2BE4FBCA87951454276F9239932C74E1CC8519E1AE27C4AA91FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389277, "uuid": "a1f48322-13e7-4709-a067-59191787352f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389277, "uuid": "942070c0-4e0a-45a3-a8eb-d4b2aa295819", "value": "768:hq7x+Kxbw4ndIRStYUnZPcApZSvSRCfPuRbheuoVNt/lLv6D+:Wbw4qUZPPpgqQXuRbguIN7Lv6D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389277, "uuid": "fbad7cfc-89b8-401b-889d-b9d159cadb05", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389277, "uuid": "7c156e7e-06fa-41c7-96a4-07b9ea65729c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389277, "uuid": "b83ffb2e-0fee-43fc-974a-fb58e481365b", "value": "8bcc386e1c2d7054051912494c30137126876ac42c2fb5fac19a767a20350373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f179c1ce-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403438, "uuid": "e915fdf2-f7e5-40bb-a7f3-806e26883aef", "comment": "Malware payload (Mirai)", "value": "2874ccf2b714751081805b4b6e9abe26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403438, "uuid": "c1f093dd-ce06-4969-ab28-a63622fdf7ab", "comment": "Malware payload (Mirai)", "value": "8ce908b38a2d08f6ac3a026ff633a30e31da35b4921b3c06e79d0dde1f631d97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403438, "uuid": "1133c5f2-5c7c-4486-8e00-5a1ccd535dbc", "comment": "Malware payload (Mirai)", "value": "7ea16ebecbb55fb5a5c60ea3b780c59ce43f762c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403438, "uuid": "6d7ca738-3784-4dce-bd88-908c06930cbe", "comment": "Malware payload (Mirai)", "value": "11c2731e1a07aaffc173e036f0da62cbc510a91b0161109a1dfefb138d8f4ce40eb836ce116141157b38321d2a300ed0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403438, "uuid": "9b68610b-8150-4f2b-b1e3-56315d13a8e3", "value": "T1F814C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403438, "uuid": "a10086ff-679d-42aa-b084-3541bf8d1184", "value": "6144:456eQCbeoufx4hdf2dp06GtCqjYW8nY1j20WI:Dely4hdfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403438, "uuid": "baea18de-e181-46fb-98c0-057e614d43ac", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403438, "uuid": "26692486-019b-48d5-b3c6-dea76dc9a113", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403438, "uuid": "85edc73f-d66c-4fc4-b9b1-f6dcd8ec043b", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd7328a-42eb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777371675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371675, "uuid": "2a8a5395-5e89-4604-b219-c79bf58ec32c", "comment": "Malware payload (AsyncRAT)", "value": "b55407ad89cd891755e1c9d6d0fd7045", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371675, "uuid": "96ca6d3f-2be1-490f-905b-9b28a019dbae", "comment": "Malware payload (AsyncRAT)", "value": "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371675, "uuid": "c8eaa77d-f720-48ca-ba5e-0c41a7601b67", "comment": "Malware payload (AsyncRAT)", "value": "5f846f9c74e274074a28172c1c940c32cb80acdc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371675, "uuid": "cf72b172-4b17-4b8d-8187-a8300c37c28b", "comment": "Malware payload (AsyncRAT)", "value": "0fc199ecf98b252d5b1996f04ca1571b2ca7a9f1b76424e155e4649b71e4c1f92c6ac623c27c0ac99e66a09331f96f5f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371675, "uuid": "23cf6490-05eb-4dde-9cfc-f4c779b1caf9", "value": "T150033A48B7E00615E5FE6FB0697361024670EA07E523EB5E0CE895DB2F27BC08D51BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371675, "uuid": "75286b76-b98d-4bed-a038-9eca569ec511", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371675, "uuid": "be49d8f2-dcec-4935-b246-269443f7b274", "value": "768:uMAGHreax6SlLz8ReUeXA8zFPf9MAOKhie5tX:uMAGLeuL4ReFFX9MAOK0E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777371675, "uuid": "4ec989b2-75fc-4ea8-8099-4b28b50191a3", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777371675, "uuid": "cbbffdad-78df-4561-8775-d4b1628d9998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371675, "uuid": "b23e7d18-94cd-4060-a99d-0f7e159b13b3", "value": "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65692469-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777397620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397620, "uuid": "7090919b-04ca-4f71-9d51-9bfc101a12af", "comment": "Malware payload (Mirai)", "value": "660a71cbcfa4b40b33e9ea47732d6302", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397620, "uuid": "3308a92e-5f08-4491-abea-e367cef55455", "comment": "Malware payload (Mirai)", "value": "8d65e75bbf5d6bb85264473ac2bb8b6066c06cd119ed770bc15b4f1644dd6c98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397620, "uuid": "2b5b6bc5-79d3-4f68-b3f3-7230216991af", "comment": "Malware payload (Mirai)", "value": "a7152add25fb10451745f1c2f2e58bd50a124460", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397620, "uuid": "f4518da6-3987-4876-b6c5-c0f0367c7876", "comment": "Malware payload (Mirai)", "value": "5b7d6cbc1cf5187f2a1b0334b806648f7ff7cf03924a48875f4817ddbd2389b2c623eb7b880303d2ed67efba244b2a8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397620, "uuid": "d97d6ee6-9cbe-4463-b28a-7e4bb0ff8050", "value": "T182633A07F99394BDC9C68730864F9132BA7178B597226E7F36009B752D12F581B2EF22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397620, "uuid": "2fa7f336-b576-448c-b588-327e4c45c053", "value": "1536:BYxXJPA83xLd1ZWGXVAOH0Su8YWppUaFjl:BU5n3VZWGlA68sUaFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397620, "uuid": "428188cb-419a-4d23-9430-b11902c2f797", "value": 71624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397620, "uuid": "0c24e18e-2b28-4f11-b2fa-27fa46f1cc11", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397620, "uuid": "60551e5b-f92e-4ecf-bcd3-8559f3481be8", "value": "agent_main_dump", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05aa2a7-42df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777366473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366473, "uuid": "f84202ac-d288-4fb8-8795-968e675a6d72", "comment": "Malware payload", "value": "160cd37ee70bd2bc10ca895e9a244ab1", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366473, "uuid": "5c445b5b-0a72-4247-bf92-d081bf8836c8", "comment": "Malware payload", "value": "8d997eb3bef53514c118463aba5d19d23a6abe362103305bb752386a82f4a589", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366473, "uuid": "96eb1fe6-80cd-4388-afe4-3f56172a37f8", "comment": "Malware payload", "value": "7053e4af781a674f6e1d1a046828c4c27f22a286", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366473, "uuid": "f8af8dd1-a892-4456-9b08-8598484f1dbb", "comment": "Malware payload", "value": "ea7658d8e1ea31d173191c4a023f0405de447f2b34a8f519a05307a553bad83edcf23a33e5aa902c6e2a6a4da2e45afd", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366473, "uuid": "1d2d5aba-a2d8-494a-b2c4-8d55d2761f7e", "value": "T18A8533DF740981255F360E7220C5E544C2FD9EE8E902A9B9EAA8593A9207FCDD4C13DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366473, "uuid": "2eb99cf6-181c-473c-b70c-d4c99f9e7919", "value": "49152:0KqJqEvc1uEm8SGyyQq35335s8/LEVFDtoAFKMJtB62rV0UU:0FvcsEm8xd5H5QqEbY2rBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777366473, "uuid": "9427e9f9-0e2f-4074-8335-ea1879b1e98b", "value": 1826054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777366473, "uuid": "d4785801-c97b-4373-88f5-a3debfa17b45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366473, "uuid": "cc03245b-ac9f-4ed3-8b7e-25f80a6a37e6", "value": "e55529c98f2fdc31a518d3da47802a68d7fe8ba3bde350ee2724acb6932bf3a6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810cd43d-429a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777336678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336678, "uuid": "a9b21549-d59d-45f2-a1ff-249d9ed8ec95", "comment": "Malware payload", "value": "28ef78e8e366c5a4c7c7c91b8be4b6a2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336678, "uuid": "8408205a-7760-42de-8a42-14f6d325cc29", "comment": "Malware payload", "value": "8e3f15ec8ae49a98467a204a09d41aa8b65ac0fbe7dddcccdb6fe7be47a76a1e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336678, "uuid": "0d925b59-9d15-4baa-a95e-aea327b55c7f", "comment": "Malware payload", "value": "359aad271db418f7013dd2bdfc629d094171f1a4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777336678, "uuid": "0f440269-6b4a-4532-9db9-fd8b7e12769d", "comment": "Malware payload", "value": "9b6769ce768520c7fe4c7d4857aab35d93a6914ba5ac2b7cb948635bca2c4e391a25ac3cc53da8156468207ce5a80c19", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777336678, "uuid": "695f2c30-4cbb-4c40-b81f-9b41b6c0fba9", "value": "T16FB2E0F1F8ECA436369D453ABB9CA805A9CF7C2F4DAB7D2014575938411CB1EA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777336678, "uuid": "2d513b79-a5ee-4e8e-b8ea-6f00e2832de8", "value": "384:ZVc3s1oisjsKG6qkSgjkjV/A4UAcGE3JNRhQuW56:SshUMkSgjkjVdUAcd3JN39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777336678, "uuid": "0986edb3-da8d-4d29-a14f-aa1fb848485f", "value": 24176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777336678, "uuid": "9cbf755b-d4fa-4632-8b6d-7b41f0e96eb8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777336678, "uuid": "d1ae106e-d229-4f4a-b591-49b22136f1f8", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f979f7-433b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777405778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405778, "uuid": "650bd810-0b52-4be8-96a1-e6828344533c", "comment": "Malware payload", "value": "8c45305df1afb2a9d0249ba3d0576b41", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405778, "uuid": "db9e46cd-1179-49e5-9af6-bd17fcdb4a9d", "comment": "Malware payload", "value": "8fdd3ab82e8c40e4262d6ea426cf8668541cc9396c38c438b44951422ef2fa52", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405778, "uuid": "f4d6103a-f689-422b-b724-d53528993e45", "comment": "Malware payload", "value": "99a2dc4c1ffaba1f490324f4c577cad21f56c319", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405778, "uuid": "2b945b68-0320-4418-bfac-aba1afabe998", "comment": "Malware payload", "value": "0776b2cc94209871bec663db1675c2d6f1e4fcc46926eadd5b8ac86562083eb2b9932e7122c7d4ed2bf4e437c184c391", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405778, "uuid": "9541226d-4fbe-4b03-b8d9-804c7c68974c", "value": "T1A54124BAB8628E30336DC5BC7489654CA7578A6F49162E74F047B83C37BC3247174295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405778, "uuid": "cdb4d452-a674-4355-b0ee-88ce0c2faabb", "value": "48:vkwvpihneZZn1oBydXqPtonmzEvJGU6ljiPq2MTCki:vkwYheZZK862mzIj6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777405778, "uuid": "389ce667-cb44-4aea-871f-837cf9c5793b", "value": 2081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777405778, "uuid": "1163332a-c289-447a-a6af-09065d175aa0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405778, "uuid": "ce714edd-da71-4f52-abc4-020aeb648dee", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cf3b3d-42ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777357245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777357245, "uuid": "682ed17c-0d41-47d3-9387-e7b2c75bfc6a", "comment": "Malware payload (ValleyRAT)", "value": "89b9a021a2867a1645c97b427fd428c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777357245, "uuid": "f4be83e9-7352-4025-8b10-7fb9d04c62d1", "comment": "Malware payload (ValleyRAT)", "value": "90303a988786b705b9991b11d62c236df9e4a072ecbec5d70cc07c8e917408c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777357245, "uuid": "1039f85a-d7bb-4622-97a6-5872e9f4db40", "comment": "Malware payload (ValleyRAT)", "value": "9eec248aa7ed9578465a2df547384aac2d171c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777357245, "uuid": "2efa8f8d-ecc2-4eff-a63c-4b5959fda794", "comment": "Malware payload (ValleyRAT)", "value": "200eb34a624ace0c93e45ab80688af687cc3cb11c768c275834600923105e2cdc21044aca61b7e10542fe6c06077c3cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777357245, "uuid": "2814945a-c8bc-4bf3-b647-1760177117eb", "value": "T159C63391E19849E4D4F2493ECAF68656EE36BC720724CBC747B8768D2B331C25C7BA14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777357245, "uuid": "211b1124-e4f4-4022-897f-f1049e83b963", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777357245, "uuid": "e52fa9b9-4a59-4aa0-9536-835593993b02", "value": "196608:Pza85DbJrtep47/OI1W903eV4QRztpDjIIAcwDkRP8h2YpWvk9kIi0AiFFh:G85vzw47/O+W+eGQRJ9jok29kil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777357245, "uuid": "6611b211-579d-48d7-94b3-6741bebdb058", "value": 12262018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777357245, "uuid": "7425dd97-33ab-45e9-94cb-f597e457a2ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777357245, "uuid": "708a5a0f-94aa-4562-8f35-1f1f3a454a06", "value": "\u8c37\u6b4c\u90ae\u7bb10112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3a70f5-4296-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777335111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335111, "uuid": "5e3b3c14-4533-40b0-8f5f-373bb2357306", "comment": "Malware payload", "value": "2512954c51ad9e7cb3e63e8b481f66fa", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335111, "uuid": "6a6f21a5-8c25-415b-8ea6-9d72ab3cd60f", "comment": "Malware payload", "value": "906694b2b64f471e500b1c9429c274a0a960533fd311cee1f3e483811f19c6a2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335111, "uuid": "18d85020-cd0c-47f8-9e3a-2795293daff4", "comment": "Malware payload", "value": "550d3b10c870ea51e12ac2413697c2effa91badb", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335111, "uuid": "9d5f305b-0688-4f8f-9e4b-193c4bb02606", "comment": "Malware payload", "value": "7127d62ff925fd7b10f1094bd966ef291405cdf0e6985b3c953c13991a2c1e484559a58332c41b0af7d3dd5626415d60", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335111, "uuid": "e5d469c7-09c5-4052-96aa-59b78a668b55", "value": "T186D0234937B24CD865535D719CCB531EFB5D7319B14953A27C074A84680D1D5D34130B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335111, "uuid": "098b6297-869b-4273-95d2-816b2c50f597", "value": "6:tQO0wKjFZqF+8iOMZala3fEMJ2gjJWK5manENn/P:ipw68GalrMX5DmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777335111, "uuid": "d824116a-4724-40a6-9f58-15d29cf8cbf0", "value": 227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777335111, "uuid": "800c3001-a3b6-46e7-aff5-6899c92a5b80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335111, "uuid": "5276f4ea-e13b-4c08-977b-f1b6f63fa0f7", "value": "Viper_platform15.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2565b529-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1777400519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400519, "uuid": "5dceee7f-25f9-44ee-a73c-f1f08c22ec38", "comment": "Malware payload (DattoRMM)", "value": "82106d72f609329154df64b561c623f5", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400519, "uuid": "d0323f1d-127a-4b00-b1a8-955a8305d973", "comment": "Malware payload (DattoRMM)", "value": "90803e6e49b4425ea144aec039a28233a996e5ab62aa06107d190a5bdda3d285", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400519, "uuid": "f29d1280-1d62-441c-bd61-25fecadc3e75", "comment": "Malware payload (DattoRMM)", "value": "bcd4dfc04706599eb067ab471a4d934ddb22c85d", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400519, "uuid": "90e805c7-40f4-4768-bdbb-dd77b2cc10e7", "comment": "Malware payload (DattoRMM)", "value": "1094978dcf51d13a570ae9e04812721f6e97c314ac7df769f5da361993bfaeced2f48e1383301283d4530751656985fd", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400519, "uuid": "3f862ce2-3fd4-43f3-bf39-de8938120e41", "value": "T1BFB63307DE3B8EF4CB63463C89831A57124F598E8C47E4C9E0482E3549E799ADE38F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400519, "uuid": "f8bec2db-b0df-4158-9fec-69592e3189f3", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400519, "uuid": "9662e2fb-316c-409c-b69b-840aeecd9583", "value": "196608:/aZk+wKbLGmnYZJukGkxGB8rM2VPFOsti7A95vM9sFp29XaIT030HyyG+zzD/:3nYnkGkx08rtE7AnMGp29qIT0Wzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400519, "uuid": "1930484e-7a0f-4ca4-8609-366a287c6d98", "value": 11055464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400519, "uuid": "f14d8373-5262-4eb2-a831-7a050cffddd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400519, "uuid": "811c075c-f6d8-473e-a026-47fc5417fe76", "value": "FX_Logistics_LLC\u00a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb09831e-4314-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389281, "uuid": "0a24f675-40d8-4c16-97bb-cf5d0e4104a1", "comment": "Malware payload (AsyncRAT)", "value": "172fe7a0188ed1f830782860f87e4dea", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389281, "uuid": "8762d747-d1e4-4b7c-8727-082b83eb6d78", "comment": "Malware payload (AsyncRAT)", "value": "90b61043155e4846aa4ba2acae38ca65ab72db396682de076725b8a82bbf57d2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389281, "uuid": "d1eb7352-76d1-43a6-85e1-68258b66ad50", "comment": "Malware payload (AsyncRAT)", "value": "29606d56a255c2a02d52e35df4fc6ade5fc8f8b1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389281, "uuid": "f4e2b92a-bfd7-4af8-89d7-128315801d8a", "comment": "Malware payload (AsyncRAT)", "value": "47321d24c192f50b451dae63e65bf5a96092bd4e2595f33550c18f5d50d1b52ada52c518e201d0bf47489739ed062bed", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389281, "uuid": "a67ca279-4ac4-4ae0-8c7e-8279cde27338", "value": "T1261339047BFC1625F2FE4FBCA87952444236F9679932C74E1CC4518E1AA27C1AA91FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389281, "uuid": "8013fabf-3391-462e-8edd-8e113b63ac28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389281, "uuid": "e137bd08-ff41-40bc-8001-384950ce1c66", "value": "768:Dq7x+ap3wnVIRqtYsnhvUYZ5SvSRCfXuRbheuoVNtBOPLvVD+:s3wKshv/ZAqQPuRbguINmPLvVD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389281, "uuid": "68965173-5aca-4f06-805f-5ca6fed05188", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389281, "uuid": "551bd3ec-6ddd-4d05-99f4-580cd8a8088f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389281, "uuid": "f02911f8-849e-487c-9287-04869da720d2", "value": "90b61043155e4846aa4ba2acae38ca65ab72db396682de076725b8a82bbf57d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0178ac-434e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777414004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414004, "uuid": "d85fb807-d2f9-47e6-977b-f71a6ae4c7e6", "comment": "Malware payload", "value": "4b11afd4c772c90ab5bac263bdc94a3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414004, "uuid": "d6e9e52f-1ee3-46d0-b82a-9fac205bdc21", "comment": "Malware payload", "value": "9206565b6e5bf79325f3efb36e3577fbaaf6ceb0d87eb9431ba8820d7cc5e4f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414004, "uuid": "886c2400-7107-42b0-a468-f4cc3b2dc496", "comment": "Malware payload", "value": "0cd17f7a15f2de3e2f643b3882e0ae6cfcd55022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414004, "uuid": "adee0497-c04d-4520-8124-bb43f97fa211", "comment": "Malware payload", "value": "f93d7d3bfaa17b34005acb083688fbfb96dd4b745ca3a45d905e97abc8b37d8fa4a9eb5fc08ca1d13c950d2c494077a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414004, "uuid": "24eb30ea-5088-4c8f-889d-c878301a5eff", "value": "T12F43F6433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414004, "uuid": "a3f6bf21-d70a-4abe-b0d9-2f3dd67eb734", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfz8:5AG8nY5BZG2xxmLQLS/S7hHnQfz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777414004, "uuid": "f597e2ed-b642-42f3-99f5-6d4ec085b827", "value": 59688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777414004, "uuid": "f7adf39b-dd20-4914-991b-4d091b33970b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414004, "uuid": "e569adb5-e215-400a-b18e-bef896819fa2", "value": "kernel-syncd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882b0870-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403262, "uuid": "b4db391a-0564-4676-bbdb-da743be1680d", "comment": "Malware payload (Mirai)", "value": "60527aa6906a5144d7cf33cc1b804644", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403262, "uuid": "9cf95db7-5cd5-4858-9283-8026d580434b", "comment": "Malware payload (Mirai)", "value": "92d39f3ae94469d397378eafc12b60815ac8ca2786842e44f64dd2ba0d08aff3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403262, "uuid": "09ffa8b5-10a2-4f0c-9d81-770dab82d762", "comment": "Malware payload (Mirai)", "value": "abf97c617d1f5cec96e82012dd61211dfb529ac4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403262, "uuid": "0c818e50-2563-4fc1-98ca-814e83b1fe40", "comment": "Malware payload (Mirai)", "value": "e9c374849b5256f382aeca348b7a1ff63990637d7da652e923302b6c190b7b7678e06f739e70a572b3a707fa07d20f74", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403262, "uuid": "f7d72702-7db7-4ed2-8ed0-c0474816f9d7", "value": "T1C45130C600C1633A69F7BB53F6B58618B0819893B8DE7D6CDEDD38E58ECCD04B860652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403262, "uuid": "6d67fe65-8936-4b4b-9d7b-80e33191449a", "value": "48:ipSeSx0pSRS6pSUSqpSJSapS7S+fpSjSipSxOSApS6SepSrSCpSWSpWpS1SmpS7n:ikfSkc6kdqkEak2CkOikRAkLekGCkn0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403262, "uuid": "9b71f3ee-660b-487e-bc96-b46106af2384", "value": 2917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403262, "uuid": "3e5b5053-603c-47eb-841a-a02f57f2f4c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403262, "uuid": "7e93a09d-f0dd-41be-9cb4-0faa7cd20383", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde47ce0-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355248, "uuid": "2ac8ea59-e195-4212-aca8-52e0d8796a40", "comment": "Malware payload", "value": "ff05cb84b8e1c656b245477537976711", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355248, "uuid": "b475604a-9cb7-4b0e-9143-17d449ae3e6c", "comment": "Malware payload", "value": "92e7677758087faf326752162e4f58959da5f1603e5f6f1d0d579c0880f99b93", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355248, "uuid": "c282f3bd-b45e-4ef4-931e-cbd9f161aa3f", "comment": "Malware payload", "value": "ad82e7aa0f023b96b1b32b03294edf2c055bb690", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355248, "uuid": "8dab4645-4d3c-43a1-a5aa-6f47b10f7f8c", "comment": "Malware payload", "value": "7928b4515ef13eb2f93163844815c82dd033daa2712d49c32b2296aa8d4e1afb2f173ffa111be82644280189f357b992", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355248, "uuid": "7d0787e5-e07d-42c8-9580-de6436b37be3", "value": "T18537232AAF7CBE3F1AECA468109F8E3658C88E804564E6F712D57A6B035CF14393F554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355248, "uuid": "ca02b897-d93c-4582-85ef-e08e8b5dee40", "value": "49152:sRh0hURh0hyRh0hoRh0hXRh0hNRh0h3Rh0hvRh0hcRh0h6Rh0hlRh0hSRh0hVXS2:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355248, "uuid": "e3d0a5a0-d442-438a-a0dd-80efd071ff9a", "value": 24204576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355248, "uuid": "a0cf5b77-30d4-40ed-b545-451a4a6934ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355248, "uuid": "8d9803fa-4421-4166-8e15-7a75936a05d8", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40eaf7b-4324-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777396061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777396061, "uuid": "fb3826bf-f62f-4eec-8feb-bfa66fdd5f80", "comment": "Malware payload", "value": "640283f64d1824a848d504a3f8275b24", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777396061, "uuid": "93e7e310-1590-4e9c-b22e-480675075ee9", "comment": "Malware payload", "value": "93d6de58e4f8f6a94cf2549c37ef9257c1050f87a0895e8fc574f16818494abf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777396061, "uuid": "ac78553b-2428-4947-9bf0-6134a5198926", "comment": "Malware payload", "value": "7c7b558c570bac76fa32c0885db50866ba961e4b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777396061, "uuid": "08fe7666-4f14-4a8c-8e84-4094a0399d05", "comment": "Malware payload", "value": "8f982db83e99d99053aa614ce5c99f42fc6821a7d0de4ee7922891bb5b293a452fa894a86bf32efd8b341092dacb4fee", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777396061, "uuid": "07a8a9f3-671d-4525-9a8e-e0de2b76046e", "value": "T198137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C496DCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777396061, "uuid": "52d73a3e-c07a-4b5b-8805-e859ef14f983", "value": "768:b6+bq9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b6+zcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777396061, "uuid": "0f06ac3b-1207-4ec1-9f40-f1918e10807e", "value": 45441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777396061, "uuid": "16d11ca1-9f49-4c57-bde0-8b579edf9bf0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777396061, "uuid": "85bb5130-ed35-4bf3-8ddb-35b0aa02632d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8b63b3-434d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777413391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413391, "uuid": "307267cd-67ac-46de-ba5f-394015ad3b9a", "comment": "Malware payload", "value": "377790c33bf9595ffe3e14e093ab27cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413391, "uuid": "9408676c-1981-43dd-b255-75bda5672315", "comment": "Malware payload", "value": "95da4eb87a8e9719812e7027100f2aaab87236e242ae6ce533fbe1e556b0b245", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413391, "uuid": "9718b25b-a92d-4cc0-8fe1-1170970ab20a", "comment": "Malware payload", "value": "f3f07f8048fe23b6a4d0073f6dc5308b7da269e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413391, "uuid": "25b53ba2-978d-4f90-abc6-cda3dbf64a46", "comment": "Malware payload", "value": "b49a9b0866943481c8d602b2bfc1c726f80c003f68fa677fea78411f0bfc9890dd9f0499bc140d7dbf91aa5a6c20c5a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413391, "uuid": "45bc6307-64dd-4e80-ba4f-7819fe5b3168", "value": "T10E43F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413391, "uuid": "442bca64-285c-4d0a-b6f9-0409da0b68b3", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfzu:5AG8nY5BZG2xxmLQLS/S7hHnQfzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777413391, "uuid": "3ccad75a-f4cb-4ca0-bc51-637a9ce6bb17", "value": 59612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777413391, "uuid": "9ad89466-6c43-4d5b-9216-3f616dc201d4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413391, "uuid": "cbdb9de1-e4b9-4cab-a358-189bd4e377a0", "value": "kernel-syncd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d03b4a-4304-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777382139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777382139, "uuid": "d0ad2bc8-d8c1-4918-9e96-ade3a00ad393", "comment": "Malware payload (QuasarRAT)", "value": "de5c87a2e1ce6e7df2df24cf4c886d0c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777382139, "uuid": "a655aedc-626c-4e49-b509-fbc91b42e47f", "comment": "Malware payload (QuasarRAT)", "value": "9703a4c17ec31daea75aed1039caab89444337a645968c181c738c49595c868f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777382139, "uuid": "44b405a4-d74e-491f-845c-be1121bebbec", "comment": "Malware payload (QuasarRAT)", "value": "408ace3572f268c3d24285231e3727d538f43720", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777382139, "uuid": "8d4a2540-02ea-40ce-9ec9-a41dfbacfeb7", "comment": "Malware payload (QuasarRAT)", "value": "b6a150d287507e82685ea4ab898efb737bfbaa66d9958ff394667dd34362be8d1ed78e5e511bed9318ff98c90189e67c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777382139, "uuid": "84682c79-97fb-4ba4-b447-63622310c904", "value": "T1E7E53344AF9DBDAB0568A31830FF1F9D67A40FE24884B8D693D6E1CA771D705412FCA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777382139, "uuid": "730aedd1-9ef4-4d03-89ee-5c3b7e3dc215", "value": "49152:i2OpgECnvCRFfonyw2enujQGWPSrnUUpS+ShQZVDfECYTJ4nH:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777382139, "uuid": "e25fd180-e093-44f2-9dea-1fee8a3e48cc", "value": 3162703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777382139, "uuid": "3ec002b5-630c-4c56-bbb5-1e4160737963", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777382139, "uuid": "da673bc3-04de-45a7-b04c-ec6ec6abd950", "value": "weauhf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1aa4873-42cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777358744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358744, "uuid": "004891be-fd51-4991-b9c2-7cd798d7ce26", "comment": "Malware payload (Mirai)", "value": "cf02e7dd2f6a818d4798755ed4bba3f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358744, "uuid": "1a5a4a4f-4e8a-445f-bbd4-e0e86595e823", "comment": "Malware payload (Mirai)", "value": "974b7db1a9a8f3b6c7c60119fb1450e0af52eae82e6efb73f35e5abacb99b9bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358744, "uuid": "c79c8a24-548b-410f-9e20-75f7109f1ce2", "comment": "Malware payload (Mirai)", "value": "70e368d25a2694a1887e80ddc8153e6606fdcae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358744, "uuid": "f6d23437-22fd-4a2d-95a8-7b2bb04ddf81", "comment": "Malware payload (Mirai)", "value": "54d61a81cc2de1147989bf7af81596256b76200316c605ac3305ab32140775504b4c460e7c012c576c1a5c2d698e1ecf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777358744, "uuid": "149fca19-6ea6-463c-a505-0472c071d3ec", "value": "T1EC158D2EB2B3B1BCE017C03407DBCAB25531B47522212DBB26C5DB353D6ADA51369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777358744, "uuid": "3bb45028-8201-41d1-9b20-426093f980cf", "value": "12288:gFboIyNgiiH8DYXPMd3HWCuo8QO8AzJ4ah+ImLQg14SVdayd5T0McD4FHX:8bPyNgkE/dFoIOJ14SnAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777358744, "uuid": "6717cc44-0cec-4faa-b543-23bb96d56178", "value": 911624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777358744, "uuid": "c9328b6d-2068-462d-8c74-ab6c831b72c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777358744, "uuid": "ea5ac102-1877-492c-b29c-65894c672e42", "value": "agent_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b37b9a-433f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777407467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407467, "uuid": "75068678-a35d-4253-8792-eb3db6dbe425", "comment": "Malware payload (Mirai)", "value": "bacd93528cb72a83e8b9344a71c9c659", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407467, "uuid": "91c9a2c5-074f-4717-94d4-8ba8c1db8e61", "comment": "Malware payload (Mirai)", "value": "9763bce05a2f8e748dc4888235d6b7dccdb8de3ccd5e17dc4b303f928bfdb22e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407467, "uuid": "44abaaf3-e3da-4c19-9c16-e2e17b12f3f1", "comment": "Malware payload (Mirai)", "value": "f4b00d4da3d1e0482eced2c8498f5e78023de42f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407467, "uuid": "142b69de-b273-433c-beb6-3c20b4b86d3e", "comment": "Malware payload (Mirai)", "value": "ad64481656c26b88a373bbbd75a3e71af49174a62248399c87d170eec64c62b20d0b7a75d1d700f825c9ec708b78eda8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407467, "uuid": "2ea27118-f4ca-4583-96d6-2ce0b2f8269a", "value": "T1BC834D22BA31083BC4D4553A62F74339F2F7838A10BC8A1B7EA14D8DAF7565432677E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407467, "uuid": "36cba6e5-fd71-49fe-85d0-30b074ba8c74", "value": "1536:ttA7zXbmtdYlaN95eqFwrjWt0+FIHTuHG:ttA7zXbm/dNPeStDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777407467, "uuid": "b2386fdf-4742-4d2d-9c8d-d1f9987dd208", "value": 81316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777407467, "uuid": "a4be00e4-2ae1-4664-ba00-4cd6c5289d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407467, "uuid": "7a34eee3-d5bd-40a4-849c-0b735e17f7eb", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7ce50a-4338-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777404720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404720, "uuid": "1e530c36-e4da-4930-bb4c-e35287227017", "comment": "Malware payload", "value": "08cbcc10f33928fc9fae15ccf8024ffa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404720, "uuid": "08331baf-294e-4c95-ad49-5d84eff5e08b", "comment": "Malware payload", "value": "98babd858ec296d43844c96d53ff8713c44a451ba6e05b89d64c772828a0514d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404720, "uuid": "4b97f09d-7e4d-487a-8e8f-6b79132d5fe2", "comment": "Malware payload", "value": "d86e1d771d8d5027ae7ac25fc8ba0d93ad82b751", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404720, "uuid": "8e13a8a2-8d27-4218-ad18-f48c90ad0c68", "comment": "Malware payload", "value": "27bad4c66ff6f340d3f8e35121ec5a32a7d4166a6f34a7b99070bbbc056172b9d7ebb35ede1382b285b0031dbc7997ad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777404720, "uuid": "48ddb254-d256-467f-a9ce-e288a39cd818", "value": "T156B5F857E49590E4C0EEE174C726A213BEA13499073837E36FA197F11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777404720, "uuid": "4c1789d7-8a3d-405b-9db8-3730732716ab", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyH:cqYUQuVDt0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777404720, "uuid": "868b1246-1468-4fbe-93e5-293151a39000", "value": 2392064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777404720, "uuid": "d42308c8-53f2-45d9-9ead-78c9c6750f5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777404720, "uuid": "d70cfde6-af07-4a2a-8752-fac2d32ef7f9", "value": "98babd858ec296d43844c96d53ff8713c44a451ba6e05b89d64c772828a0514d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebd47db-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355196, "uuid": "4a6bc13e-4e27-4f06-8bf1-7f22374f20c2", "comment": "Malware payload", "value": "94f1d622a4a846e01738ceb415044525", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355196, "uuid": "ee3cf5f2-25e7-405b-90a8-821710f7eb08", "comment": "Malware payload", "value": "9913de0d18c6234928092411fee5c8e6a3e01cc16f3b20e65e1a21199d169092", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355196, "uuid": "02f6ca30-d450-4153-997a-df6ffd78585a", "comment": "Malware payload", "value": "539c16c027b67f5cc681986c2f50a3e1386a45dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355196, "uuid": "6c203916-3db7-4fb0-bb94-312d1e7069b1", "comment": "Malware payload", "value": "9b611df5a3ac07eafa2a97426b2f7f0f98f1bbc2720b28ef3be7f1d84317488cf258de9099f9164a07f7498af775791b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355196, "uuid": "44e88eaf-4620-4809-bcab-200f0bd37ee6", "value": "T1E33723B54D6D4EE6AF3531CC41BA2B4E34D9CE44C9A4693B32F2760BE10FA90780E759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355196, "uuid": "9423df7a-4b61-4d94-9b4a-199a16b8a06d", "value": "24576:pNg8zW/Vu3Ng8zW/VuiNg8zW/VuuNg8zW/VuKNg8zW/VuNNg8zW/VuvNg8zW/VuI:7knkMkKkHkbktk7kEkDkEktkzk8kQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355196, "uuid": "5bdf4c53-37e1-4663-b578-7bb71f809886", "value": 22643827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355196, "uuid": "e4600ce9-cc26-4f34-86f0-156dbb71af7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355196, "uuid": "75e20d2b-c6ac-450a-a30e-032e33889564", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa8352f-42b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777346545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777346545, "uuid": "4d41bb36-087d-4922-8bef-80665a856d17", "comment": "Malware payload", "value": "97f2eae4b333afbf4f5071eb15893d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777346545, "uuid": "09ca9a77-017b-481c-99aa-910ccc995e33", "comment": "Malware payload", "value": "99d190e212134154fe3ea94aadb714026ba43d594be30f66409bd6913dac2fe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777346545, "uuid": "212488b7-2f20-427f-8654-a151f08af96d", "comment": "Malware payload", "value": "29315a3861ba17326f9f16fe1c240e7503789143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777346545, "uuid": "6fdefcb2-96b5-47d5-8dbe-d1514fb71e93", "comment": "Malware payload", "value": "5b6281be327580a1c3545859e8965199da60bfe3612ef6bf0d745a47b5bd7d3a8f89b8f3958168e2641e5317ab59ad02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777346545, "uuid": "742aaf75-f90c-4c76-b15a-87103de33dc9", "value": "T1C9468E37BCBB5859C49DB13484726647F676BC441F2227C75A60F2682F7B2E04AF9B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777346545, "uuid": "6ecafd2d-9abd-4382-a738-9edbf3d226d7", "value": "c73e845664e897329f33870b28d0fc6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777346545, "uuid": "3d0d9860-20a8-4678-b2d2-04cd524b0fa7", "value": "49152:vic8TqJe9fd9dbfyQnbcKkJqVAyjNQqxXqHOMfWDtiAToa8NVtk7M2Z+6bjfVdMu:vifAQnbK+XqD0zTQsZLy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777346545, "uuid": "f3ffcae3-b7cc-420d-9843-2a77d869a554", "value": 5379072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777346545, "uuid": "ea2e0790-dd6e-4cfb-ae57-422c230b4659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777346545, "uuid": "5305725f-9d43-4489-801f-f8137f5a7f80", "value": "SecuriteInfo.com.Win64.MalwareX-gen.16821299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d348b94-42af-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1777345610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345610, "uuid": "d4f0843a-6b20-4e42-aa44-d2189175e1f7", "comment": "Malware payload (SnakeKeylogger)", "value": "eb5d39f6d6aa7aff70db5c8663b83c3d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345610, "uuid": "9f29e6b3-087b-48ea-ac00-b35a0013eddd", "comment": "Malware payload (SnakeKeylogger)", "value": "99f0cef71d37176ef7b40badd2beb4a4d75fd4501188c9362a5c17479c6d6f56", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345610, "uuid": "c9c29210-00c1-4af2-a384-ad099de143fc", "comment": "Malware payload (SnakeKeylogger)", "value": "3dd7614a927ae642ca214d45e259592d697bcd2d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345610, "uuid": "99a10aa6-6e61-4018-95f6-5b2d6e150267", "comment": "Malware payload (SnakeKeylogger)", "value": "69edd6bb47b11958231ae6a13d868a2550d4a7671d9a3dc2796ba8d90e34e8fa9666113b218796d3cdf0fe65f86cb22f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345610, "uuid": "fdf3b621-2d3c-4519-b257-224f971575e0", "value": "T15D04C43EC6B1EDD0033E71E4959D3B16116C1B93B2B25BACF5C645AA1D11A82EF3B24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345610, "uuid": "48f63f97-ee6e-41f3-9363-412bfb23e378", "value": "3072:LGW4J+TiWmvqOhuSNzoL+JPD1oWHxfpGpjp7htlAuNlVRMYUgBivn:yWtTiWmyOIdL+JOtlAuNlVRMYUgBiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777345610, "uuid": "afed0b60-52a5-43be-8da7-011f790a8803", "value": 185661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777345610, "uuid": "9bf6ae07-49a2-410c-b132-427ca3fc578e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345610, "uuid": "07adaace-f2b4-4ede-a2e8-5088bbf33ccb", "value": "OrbitalProtocol.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1f2587-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364833, "uuid": "ccbe27a8-add0-4c82-8919-1968c2ae1df1", "comment": "Malware payload (Mirai)", "value": "c78cdd389a23d4c21fbff0b3adac8ca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364833, "uuid": "9fc31b47-8ee9-4585-9d37-140664821d6e", "comment": "Malware payload (Mirai)", "value": "9a35eda79ad319f21b62ccb4106eb277ff1ead5bb36b1007c5808ceb916189ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364833, "uuid": "398c16b8-24c5-4a7c-9945-3588e67cfb2c", "comment": "Malware payload (Mirai)", "value": "3fc9922ec3472349abacbeb0c94e343929fce8ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364833, "uuid": "3c99708c-34d4-41e6-8a89-bec318d48dc4", "comment": "Malware payload (Mirai)", "value": "3e59480519cdda99a93e298f11bb072a51c0e00235dcd3ad0b6f1f69e488ac027019aa386463e4943cf3dccd1edb5d01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364833, "uuid": "1d5f0fa3-52d9-4362-913d-89d07391854e", "value": "T183158D2AB2B3B1BCE017C03407DBCBB25535B47522312DBB26C5DB353D6ADA11369B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364833, "uuid": "c4c9bad0-174d-4bbf-96d8-693ce608037c", "value": "12288:s9hDsEDNgciHFoaVn5daHibeE8yvjA1mGVVvwjr27dlCPr6v2maydPPqT/AUHX:CDTDNgUaYyFCIH2zEr6vHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364833, "uuid": "f2005289-2180-47cd-a12a-a931a7556894", "value": 911624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364833, "uuid": "78501f96-d009-439a-8ca9-da7c3e9ae8d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364833, "uuid": "30fdfcc6-fa27-4212-b501-e54a3027a47a", "value": "agent_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23a4ec8-42d2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777360839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360839, "uuid": "58d3cecc-929c-440a-9e28-dbb2df7623f4", "comment": "Malware payload (RemcosRAT)", "value": "a679aecbdc50a8f3f4872eb892a6b7c4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360839, "uuid": "2f1b18fd-fe92-4281-a405-f92d29c4b971", "comment": "Malware payload (RemcosRAT)", "value": "9a4828143328831a900fed2551b2af530e30ca02d3cfa7e467cad206bbe0dc36", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360839, "uuid": "67d66c19-456d-445a-a037-ece7dec2fba2", "comment": "Malware payload (RemcosRAT)", "value": "cb488001927fe74db75eca6ed4f26d9cdf6562f1", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360839, "uuid": "acf5db67-51ab-4723-9457-3aba8bfa66ec", "comment": "Malware payload (RemcosRAT)", "value": "574e05b4108063ca00f517f92c45b3dd27c071c0623f147c4244210a37d75aa6d160d4aa775b934e67fb87abd5b7af38", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777360839, "uuid": "62caa900-177a-42a9-870a-dfcd61581db8", "value": "T16EC5953A97E0213C1257D9356201E5723F6B4CEF66222EA2E5C39CCDD0427DAF7166E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777360839, "uuid": "f1ee75b8-c0ad-49fe-94c4-6f1a6efee8ff", "value": "192:E0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0Fz:DRh9yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777360839, "uuid": "55fc15c3-64e6-46dd-9e93-4b368d1804ac", "value": 2732964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777360839, "uuid": "223c305a-33a4-4b28-9317-a588900045a4", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777360839, "uuid": "9de096e9-20b7-438a-afed-bb6c04102cc5", "value": "TROJAN PO27042026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea07d0e-432f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777400588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400588, "uuid": "0c3420d3-c198-44b0-aec8-b8efe699056f", "comment": "Malware payload", "value": "8d79179a4eb8e66f8c7c581b051ae515", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400588, "uuid": "9b22aba1-edbb-48d5-b537-05df938cf3c7", "comment": "Malware payload", "value": "9b3296db81da2719713c5af6ad8a09213f7c676f0cc6858174a63a2cfa4f387d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400588, "uuid": "1e4d313a-da5f-45fa-b4ac-3cda9928beec", "comment": "Malware payload", "value": "cdee7f039a4edc3719d837986ea9ee9deed01e74", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400588, "uuid": "a7ca425d-2894-49d3-bc01-5f1ce8e54e7c", "comment": "Malware payload", "value": "095cafc4eadc3b79f0ca4f23e66da31fb2fb621e72609a8a7aa3e33c339f76ba1016c8c86b69ab96f682831482a76643", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400588, "uuid": "99dbcc84-cb17-4ca7-97bc-06ee7a73b8bc", "value": "T1A031125EFD0AC8835F73DAB666618E3DCEB14223582095547A81CC943F2933C4AED693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400588, "uuid": "9bfff5e4-8c97-4949-9510-e138b72e277c", "value": "24:Tb47c+wLldus3x9+y/DWHSfKKE2+bSKpH/7TUo3yNRRKqah7khvCwABMeCAAH:3BTB9+3z32+ZMo3+Ri7avT+CAAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400588, "uuid": "0728af67-b3e1-42c1-9be3-66a9d5c5926b", "value": 1456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400588, "uuid": "555167f0-cd2e-48ed-9e82-2acf152e7093", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400588, "uuid": "031d7a9a-65f0-4d16-aa4c-fba4b818f1dd", "value": "Statement-03-2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca91391-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777397766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397766, "uuid": "40f2210f-9b23-4c3d-92e0-1a31ecba6120", "comment": "Malware payload (Mirai)", "value": "4416868c9dd549d1e876a1c12cd23bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397766, "uuid": "ab35956e-f6a0-4843-ad3c-0148d9e45e35", "comment": "Malware payload (Mirai)", "value": "9b729136c9fc5394b16d55e27dc100ca450457a763f1ced4451359921f472236", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397766, "uuid": "f9d6d69b-bea2-4842-8a9b-2b9255e54c54", "comment": "Malware payload (Mirai)", "value": "90f8ef4f43633796dbfda77a7b0d7c06b5bff6fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397766, "uuid": "2c3032fe-fb16-4bd0-99b9-3cd0988d5abb", "comment": "Malware payload (Mirai)", "value": "7d4e27fe5ad3f0cba8f3ebd3072a9ee33b29095811575eecb25c92a17d3bf38b95f567f6f443468b74e7b282c988b84c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397766, "uuid": "0bfbf1e2-d9e5-45fd-ac46-6eac45d6d4b2", "value": "T142564B03FCA918E9C1AE913586779253BB717C895B3127D32B50F6282F77BD06AB9340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397766, "uuid": "8dffdf0d-99d5-4a34-8f50-f6e4838f2770", "value": "49152:Apt5/08pryuDNMNxnUv/6L6WstIafQ3sHklF9Ubt+qXoWcyv7WsL65iYsuwKlK1g:ApP0c/Cgp4WbHsmK0Ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397766, "uuid": "955517ae-9281-44ad-b1ac-dca5e81910a2", "value": 6090914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397766, "uuid": "76fc90d5-caea-42ce-86de-1a9326fb0063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397766, "uuid": "f2a400cf-28e8-4d3e-ac21-3df9cdb9d1a3", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a76f12f-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389307, "uuid": "d05614d3-8496-487f-a021-80103b76750e", "comment": "Malware payload (AsyncRAT)", "value": "6337a9971a1fdc10a7885afcb72f8625", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389307, "uuid": "c7f44254-5c06-4356-9c0a-24a1d6b73620", "comment": "Malware payload (AsyncRAT)", "value": "9cd074c7107837447039806c403da5014d50cfb4ced643e57adc846c17d3f53e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389307, "uuid": "f20130ba-abea-4916-83d0-fcd18efbb13f", "comment": "Malware payload (AsyncRAT)", "value": "820a46a2a458a9793b3a1a00b0dc99eb2f3365b4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389307, "uuid": "862dfd36-cdbe-4b1e-8ab9-7e3e99a1bfdd", "comment": "Malware payload (AsyncRAT)", "value": "a3ffa857fb8bbbabb7832567658bc80a36a0d1a291d54086acf870a98b3d0b0451fd87088a87f5597ee0118d25ef7fa6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389307, "uuid": "5bb5d134-8782-4f24-a151-bcb3db1e8311", "value": "T1061339007BFC1629F2FE4FBCA87951454236F963A932C74E1CC4519E1AA27C4AA51FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389307, "uuid": "34f1ef56-5a8f-481f-8abb-cf75169b3cf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389307, "uuid": "576a6e60-699b-430a-9e71-cd915a1f5a12", "value": "768:Pq7x+iNv0nZIRWVYgnV3wc5hSvSRCfXuRbheuoVNtXVLvWD+:cv0CgV3H54qQPuRbguIN7LvWD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389307, "uuid": "a754ccd5-f9b2-4c6a-b310-4f7d8e7b12f0", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389307, "uuid": "641e4f7d-21eb-43f3-85fc-bb74cc4f2e16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389307, "uuid": "0b3fff99-d91d-4e47-8f5c-1963d9979af9", "value": "9cd074c7107837447039806c403da5014d50cfb4ced643e57adc846c17d3f53e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bc0406-4314-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389279, "uuid": "40fd8103-186a-4418-8658-76b4b7090763", "comment": "Malware payload (AsyncRAT)", "value": "04ff2761d282f411958d25fa3cbd2cc5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389279, "uuid": "b56bd22b-4ee3-4c63-ad6f-5e2bdec48160", "comment": "Malware payload (AsyncRAT)", "value": "9d384f83db3748761029b525d4f24933a9e31ac6095995423dda9a3eb3854095", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389279, "uuid": "8cd27d7d-9c12-49c8-b952-f7c861d338f7", "comment": "Malware payload (AsyncRAT)", "value": "a171314a22ec538e24ce9683e9fe00367a6611a1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389279, "uuid": "13e97646-8ff4-4c64-883b-422ed31017e4", "comment": "Malware payload (AsyncRAT)", "value": "2bfc7c871f8c9e0142ee3e3b2046b464ecc745b511dee448d7b32c97aa8a9a783cf81026483af01f5bcd7e29d9ab9eab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389279, "uuid": "878012e7-98bc-4d50-95ce-6b6a1028e029", "value": "T1341339007BFC1629F2FE4FBCA87951454236F963A932C74E1CC4519E1AA27C4AA51FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389279, "uuid": "7012b5a5-aff2-42ce-bf0e-4c61f5ae1db9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389279, "uuid": "4870657a-417d-43b9-9480-ee721ea01bda", "value": "768:jeq7x+iNv0nZIRWVYgnV3wc5hSvSRCfXuRbheuoVNtkbTLvWD+:/v0CgV3H54qQPuRbguIN+HLvWD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389279, "uuid": "1a59d0e8-6c70-4e7d-b138-eb62d6d51ffb", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389279, "uuid": "b4adae4f-f5c0-4a44-badd-a3a79dd605a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389279, "uuid": "a4eff53b-11d9-439f-a5bf-f197862790b7", "value": "9d384f83db3748761029b525d4f24933a9e31ac6095995423dda9a3eb3854095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dd341a-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355104, "uuid": "7b129329-70e3-468d-900c-cf59aa210817", "comment": "Malware payload", "value": "03610497f891c449165aec8552268721", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355104, "uuid": "2958736e-367e-42b4-811c-07762fae4e43", "comment": "Malware payload", "value": "9dab2534ed52cf886249c7b9cda93e6188429a46ab1d41aa086778dce2b144b7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355104, "uuid": "af356849-5976-4858-9aea-bea4fa60e9d7", "comment": "Malware payload", "value": "9721c2c24fb5317fe0adf873d32a5246e550d3aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355104, "uuid": "23c7adea-3f01-401b-911a-39fbbd92f602", "comment": "Malware payload", "value": "43125e5680e57f9c5367b78b9129842db83fb0de96b86f397efc911b4e3cb8f8de902f08eb46773e02ad4587465027ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355104, "uuid": "6ce2887c-6ca2-4499-945a-869754d073b2", "value": "T12B372312B668EDDB4D743A7C01EA170E5DF26344BA30B08253C7AD8E6A5FF1A32671D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355104, "uuid": "984e07fb-c3ec-40e7-ab66-af5e51a097d1", "value": "49152:l1nO1nR1nw1nc1nz1n91n51nD1ny1nf1nJ1nHP6VYX1nX1nd1nk1nw1n5P6VYa1Y:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355104, "uuid": "7b62dab3-62c8-42e7-9065-9bfe87d92bd6", "value": 22903944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355104, "uuid": "341a6c08-6e47-4f36-8808-a16617a8f4d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355104, "uuid": "d099511c-78c4-4233-802e-bee87d2e2a1c", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe5bff4-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377827, "uuid": "ec2757a4-1fe0-4286-8c47-cc94c9384574", "comment": "Malware payload (a310Logger)", "value": "5241e18dce73da29606e865a3e87795e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377827, "uuid": "e08e8799-5703-4739-9f3d-a327e32b7ca4", "comment": "Malware payload (a310Logger)", "value": "9e6b4d42fbce23f2a6cd01b31fcc365f3caad019c36fdef4afe9837c2e3214c3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377827, "uuid": "b1861e4e-440d-44f2-9ed3-53257f8a0d29", "comment": "Malware payload (a310Logger)", "value": "6b2ad5f282697f81d539bbd292f9c38f01547dc9", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377827, "uuid": "c4e50772-4338-4549-b05e-5ee24ed9fd9e", "comment": "Malware payload (a310Logger)", "value": "46035bec5a76ce506489d122c9b3b51c87d544dda90119c750e6eb80a2e1b09957fe8216a070b2d538fedda3ee5ca6e5", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377827, "uuid": "ee722c28-3392-4479-a461-9a8f3c285619", "value": "T10295B0BC0DA58DD9801CDA66FD8E5ED4C2CB85D9AD841C93EF686BCD19ACB006B07D07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377827, "uuid": "3388c7df-b099-4390-991f-56811843d76f", "value": "24576:OgsJYiQYBqyHQKeMRHBgYrPd7JJxsTSMS1uDp4I23nOZNJCEE/ftDaWsPEKG+S6n:FsJYiQYI4V3fIGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377827, "uuid": "8d5e7c6e-3de2-4ba9-9a79-95921b2a1e32", "value": 1923292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377827, "uuid": "0f025675-a961-4b0d-a337-4144a5f2c48f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377827, "uuid": "231c14e6-599f-41fa-a088-d0c3a1c88469", "value": "ps_M0Xt89h81fIN_1773826712017.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effe811c-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403436, "uuid": "0488885f-aadd-4193-af5c-68c386ef8364", "comment": "Malware payload (Mirai)", "value": "e8d4ae6211f04bde3c2676da17b80132", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403436, "uuid": "0888b193-e11e-407e-8063-a26328e339dc", "comment": "Malware payload (Mirai)", "value": "9f52e705a1b32b2e39ccc0e9fd4ccb68b49a3272900d162b95f4af36914d373f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403436, "uuid": "8a43c4b8-ced2-4dbf-a6d4-80ec966d4c84", "comment": "Malware payload (Mirai)", "value": "11114de2e7977db6f02b1613fc54d6e101417eda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403436, "uuid": "d3816248-a94f-468d-80bf-282cb7a8719e", "comment": "Malware payload (Mirai)", "value": "62fe9f58a71c55df79c45308bc03b9d8077d22f304a877d901f1ee455f4193660d36063151b634f33b3f832e77d12c0b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403436, "uuid": "33fa6969-7267-4337-9cd5-40b24ba75a3a", "value": "T199333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403436, "uuid": "ac96bdff-7323-4889-8539-e69f2ffc5c50", "value": "768:twzbCo1eCZWUJ2SSpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV983N+s:twdt3SpOzwLMU431ANA0BLBCrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403436, "uuid": "3aa81ce3-d609-4b4f-8191-e5791ab42944", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403436, "uuid": "d856c8f3-786c-428d-99bf-d97c04eaadee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403436, "uuid": "e3cde7b7-972f-49a0-b9f0-85bfc1f7bd07", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4a0dc8-42ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777379866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379866, "uuid": "871a7802-164e-4090-b32c-5922464a7281", "comment": "Malware payload", "value": "42f22460bb23f2f9116fa3fe0002185e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379866, "uuid": "fcb115f4-57be-4a83-af31-486e2d73ea1c", "comment": "Malware payload", "value": "9f5c90ab0f2f0d215c8290658a1b962a2dc127f911b907314bf60d68c4a2dc3b", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379866, "uuid": "75964004-cf5a-4849-ad56-102c016a3bfa", "comment": "Malware payload", "value": "bb94c520d9fa8172c948a9e28cf15a988fa8a2c8", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379866, "uuid": "ab12f41c-0927-4a33-b644-3d3596b2bf0b", "comment": "Malware payload", "value": "9f1038d0cc0b39ec2147d13ff39913a9fa7e9453eff854d32d961ef10d23d69b8983a9700182e66788756b6675b18842", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379866, "uuid": "f9bdb54b-e6a5-408a-9531-86aac1e66248", "value": "T123B423BFCB77E2DECED822FA7682C17D209CAD265822283E01215386558FD114F7A7D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379866, "uuid": "64f7897a-97af-420f-a57e-7a1982cc9cad", "value": "1c1b9fc976c9c70b5653a407061f71fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379866, "uuid": "3e378228-4fe7-4adb-b1e6-f41cbdb06683", "value": "12288:WG5qAQDa6TGdEyLU0FNGBYx7yqR5DY/wDb31BAhH:vwRyImNGBkR5Dg+b31Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777379866, "uuid": "057aeb8f-e55d-4d1f-b2e2-546f531ff11e", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777379866, "uuid": "92f71cff-76cc-42ec-8528-c8411bc72cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379866, "uuid": "397927a8-2b0f-4d12-90c1-f5d8c51bf182", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f83400f-42d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777359814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359814, "uuid": "0f03a3b1-5946-4ec9-bc6b-8443acf3fb59", "comment": "Malware payload", "value": "92f0277ad8d4de8b704dd3406684a112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359814, "uuid": "49c5d1cd-3160-49d6-a9fa-14cbe1a2a0be", "comment": "Malware payload", "value": "9f83da02dedfbcb29e357e652df8ad59e56ac797bf236d26fe8d9aebd6e17d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359814, "uuid": "37bd024d-caef-4acd-8f43-942f0bf6fc0d", "comment": "Malware payload", "value": "50739398b94a5293915fce98909895d2089a7851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359814, "uuid": "dfbe045b-62be-4e7a-a709-2e5846cf2627", "comment": "Malware payload", "value": "01714fcb69570358becd3d74faa990a8e6d3f36989dc726e743f534253e64b90ead1583c3c0b6a5690f45fb05d423f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359814, "uuid": "b13f5a76-029e-4294-be89-8dc7fb619c14", "value": "T16D4523E1BB55E643E4C227765E73E3B242E14DCCF050C3868BDDDCEB74766A22899206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359814, "uuid": "758770f6-3e15-4d64-bad1-3f7d84aecaf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359814, "uuid": "900def52-7b18-463b-ad05-c4fa29cdf0e3", "value": "24576:1KPKoj5L39LE/5NUdh0ZNA2sou007KOSBe2eFZpflgLcp25J:TodL39QDy0ZLMOOxTZpflgyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359814, "uuid": "0d223507-08a6-4c4c-9f95-d6768b0ef64b", "value": 1192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359814, "uuid": "0c19b2d8-3deb-4ee9-a1fa-c18048745eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359814, "uuid": "c058e7d9-6a4d-488b-ad33-ec3cb7968b86", "value": "P2ELJwGu6kZ4Vyd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b5b4dc-42d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777359694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359694, "uuid": "838ea56d-9e24-4dc2-9eaa-d07e4db09168", "comment": "Malware payload (Mirai)", "value": "59de2d0f1926b4eeb54fcccad47a47be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359694, "uuid": "4e6b4c1d-4dfc-4022-bdf2-71d0507fc4c4", "comment": "Malware payload (Mirai)", "value": "a04a4381b6d28196c6c937434e318e91f856cc74ecb661def5de97760a47e761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359694, "uuid": "6ecaa7be-b987-40c2-a457-a78794292fc3", "comment": "Malware payload (Mirai)", "value": "1384f30654057b309f2992000995ff668d88ad43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359694, "uuid": "df38534b-da6f-4047-b11e-91e48a22d3bd", "comment": "Malware payload (Mirai)", "value": "a4c91edaf8b2617e95d15799fb2de6d991ddecb4cb7b6e5f419c04f8d74f1a8cec98b0ec2e64aefe51ecfd316f0b5fe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359694, "uuid": "a81c817a-b98b-4a3d-8c53-ff0abe4f17c6", "value": "T1B7C44A55F880DF62C6C5297AF65D82AC33174B79C3EB720689254B343BE786B0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359694, "uuid": "c7d276c2-ca87-48fe-b2ae-cd040c568d73", "value": "12288:Kpmiv8WnvWsUmd3PFRnxxNDbfqCbHqoh82NugpMhtnq:EWsUmRPnNXq0H/h82Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359694, "uuid": "f6dd59aa-6e89-4c58-b0c2-1c17e6a8ace4", "value": 578856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359694, "uuid": "d878633b-1eb8-453f-b3aa-fcdf6083a4c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359694, "uuid": "154ab776-7786-4fa3-8ca9-7af6d7d4519a", "value": "agent_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f57e21-4342-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777408897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408897, "uuid": "e8387f2f-9f5a-4b18-8bf2-72b77cba7527", "comment": "Malware payload", "value": "6a82425afa8dd9db791d4ff11e89ee8a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408897, "uuid": "eefd78b4-25ac-42de-b832-33f3779d4601", "comment": "Malware payload", "value": "a1686d5d1d512419648bfd4671e622ec1de5151bf609a17c6efe47b6db7b8dd0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408897, "uuid": "75e5c424-c8d2-4aa1-931a-3c20ae1564e2", "comment": "Malware payload", "value": "ab377612dd43fc6c44fb35c09a12e55667a7dbc7", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408897, "uuid": "130bdbdc-7636-48a7-9663-34949d0f5015", "comment": "Malware payload", "value": "1803671634b1832c8c7888e0c68e3de894feaf64552edded70158ef72b95695ed61cf0cb7a7bea71ea6b5948029ee057", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408897, "uuid": "17c60cd0-e6f2-42ec-a4b2-49d22942ca95", "value": "T1B0957D05AF37DB07C8D3B0F5A77DE0B93430A5BD54F1FB901E892943AA05AD0B461ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408897, "uuid": "56650da5-edd9-48a1-b906-ea2179e9d997", "value": "24576:JZFHSErXLfQPkPaNpPL6+RtdOORj31bruzDUahWifCq:JHnXjw6QGOvOCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777408897, "uuid": "d6e4ba39-ab86-41a8-9364-d3ea7ebfa305", "value": 2051684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777408897, "uuid": "a4bc48e3-2126-4302-8ff5-0c394ddfefa7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408897, "uuid": "44406ea2-aa9e-4820-ac76-ff891ce44d3b", "value": "ps_PM72ztbLWEqL_1774345835086.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29514f02-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355428, "uuid": "c6d79933-c156-4ae1-88ae-ebf4f049d0b8", "comment": "Malware payload", "value": "51ed777b3966096031763c1ae595c6ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355428, "uuid": "c8b4ad00-4507-4732-9c98-418f3d6bf43d", "comment": "Malware payload", "value": "a19c0acb9347669aa550197d7974e6cae016442598b3aa0c35d38980a7b60166", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355428, "uuid": "4a383795-01fd-4231-a86c-b3f3ca6dd276", "comment": "Malware payload", "value": "0c7948de1e049404b4ec7f7f5b55cd7d75131b23", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355428, "uuid": "4ae1c636-ea8b-4eee-b6ad-fc2906c5bd4e", "comment": "Malware payload", "value": "545ffb3e9dd71bbaa9422cc38465c0b1cbc2a97615ecb6b0606c843e322813715acec61f25ad2deedc170040c4f621c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355428, "uuid": "37b0efd0-4544-40f6-b0d3-9edddfe44fb4", "value": "T1EF3723884D3DBCBFD2FDC15910AD0A8A16D84E9094407DE9A741AE5DF43EFA3217B92C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355428, "uuid": "b2f5c377-3522-46a3-8862-1cc1afc6d9b1", "value": "49152:IgoPgoygoBgosgougowgoCgoegoDgoAgo0gol18QgoAgohgozgoTgoq18RgoZgoY:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355428, "uuid": "23833e0b-bac1-4d45-8365-184742339ed2", "value": 24204591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355428, "uuid": "01414de5-ebdf-498c-b5d6-c33b8a789bc2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355428, "uuid": "08ddb323-81a7-427b-a20d-9ec10db80340", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e839c7b-42fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777378147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378147, "uuid": "a96f24ba-2cbe-49a2-8c0d-fe360d6a5741", "comment": "Malware payload", "value": "ca88a6c055a96e1a6fa47e2586d41d2a", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378147, "uuid": "fe1e6130-bf79-4724-a04e-724ec056d81f", "comment": "Malware payload", "value": "a23515885d04de1475321b8fb463386686ac0bff4d3ba62322525253aae5e22c", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378147, "uuid": "e606fdc4-161e-44c4-a9cf-b0064dbf74bc", "comment": "Malware payload", "value": "339e1af0b279040e4a3a4e6c95193491b3c6cfde", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378147, "uuid": "b87076c7-96cc-406b-a1ae-7ea3895b18d7", "comment": "Malware payload", "value": "e2e1f3cdcd1285ddd0c945576e445e908f1ac5d2a6afa7afe163496f86d937ab60fca364a58c14fafa58791e942cb942", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777378147, "uuid": "83137e04-6d08-4349-adac-25978f708150", "value": "T1BD2733D7041951769054C27CABE4A396B3E38C9D18E3CB09B3ADA2AAF0D5372471DF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777378147, "uuid": "6567d802-bbc1-4bfc-b760-148dd9a65735", "value": "393216:4rmuX05apQTWU9Hw2Eg5U+iCAo33ulrkg+1ZreqIckZllbLNEWnE/:S1X0gpQTWU9HwllIArcenltLNEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777378147, "uuid": "e808c446-9305-4d4f-a343-8b9354abf37e", "value": 21280574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777378147, "uuid": "1b36a2ca-05d0-4583-b738-d05919e9b4ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777378147, "uuid": "1504799a-8f48-468e-a9ea-a13661be26c4", "value": "python", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fb6e06-42f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777376148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376148, "uuid": "f5da30a4-8b47-4c23-acfc-09d1bad27cf0", "comment": "Malware payload (Mirai)", "value": "e6b8e6d6ee0c5ea3cbac009ace4c037b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376148, "uuid": "ecb40066-6d78-4b2d-9f4d-dd6b082f049f", "comment": "Malware payload (Mirai)", "value": "a42be2af43eb9ac0a3728d98ff4db910021cf96077c8102b4c330b512ed34d87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376148, "uuid": "d54a74d9-172d-4565-a6db-890e91e46b86", "comment": "Malware payload (Mirai)", "value": "0511b35140ac413b925794b1c473c5f2d1ac44d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376148, "uuid": "c135652b-77ab-4a60-bb5c-f929eca662c0", "comment": "Malware payload (Mirai)", "value": "c6502a03f59dc1aef20e7dd9a407db71672e544de8def292cb47a003a958e7923a606f5b90919fcf1bea1a14e4740187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376148, "uuid": "1b1304fa-8801-4c3e-8963-96db3a995b2b", "value": "T17883D606EF500EFBC86FDE3745A90B4634CC554722B93B3A3674CA28F65A64B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376148, "uuid": "cdca7c30-f97f-4895-abbf-c93ec7d883aa", "value": "1536:DxaOVDNg6MvRxd4ZVG86+gZjgW3IX5Vud00rMscRcawK4:JNovF4o3c+MpSK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777376148, "uuid": "435b4f8e-addb-4726-ab74-311e32592c32", "value": 81676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777376148, "uuid": "c57f471d-a995-41ec-9bad-52a4ad9b7481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376148, "uuid": "762f088c-ad1b-4c18-beef-c684d8563ed2", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367fb5cc-42a2-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1777339989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339989, "uuid": "7252d6d8-e691-4cb7-bdb4-31b2b0323cc0", "comment": "Malware payload (EternalRocks)", "value": "878d2bc82acc852eeb849c1ed6fd5106", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339989, "uuid": "2aea6443-f258-40f4-b4a0-81cc8a272a12", "comment": "Malware payload (EternalRocks)", "value": "a4c271f06767e1497260cfb7bac4abeac8764bbbd9408c8dd9e2c1ae164903ef", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339989, "uuid": "9772ff68-30e8-4817-b2bb-009864042808", "comment": "Malware payload (EternalRocks)", "value": "c9701003cead8bec6281b201f1e4fb537fa03848", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339989, "uuid": "0220dc9e-b4a1-4676-9ffa-0f8935e036b4", "comment": "Malware payload (EternalRocks)", "value": "090d75985f130c5ddfd1c6174ddb1f03acaf7bde99ced22a93c7970962ee097beb81dff036fa574ca5d44dc199f568f8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339989, "uuid": "8779f781-b9f7-468f-8d6b-f08bfea08a75", "value": "T15EA523A36F8B2E744758F127BCDE8F217E4F05FE404849A693C5BA8AD74FB11425682C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339989, "uuid": "66788f55-418d-4327-a831-f35f881c0d88", "value": "24576:cvY8LoYpWuXZ8leR5wWk2cyen9piS5JmOxeGOxTIyGATLMMDv83NLYo+dk1XnCZy:780cXSuw9p1LZxkGaMWkNY1B+d3px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777339989, "uuid": "c8e283b9-37dc-48ff-8993-48ec7df556a3", "value": 2229733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777339989, "uuid": "2c8891e6-261d-44fc-897b-108712939d38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339989, "uuid": "37c199dc-ff58-430c-b002-cd1ba8fbe89a", "value": "svchost_db9e.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ae5c71-42af-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1777345618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345618, "uuid": "67bceab6-fb3e-4fd0-b24a-653056aaf952", "comment": "Malware payload (SnakeKeylogger)", "value": "74957cd4d304d28c761dcace0ae7f8d1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345618, "uuid": "04ada389-9af3-43d6-9963-48543b2598aa", "comment": "Malware payload (SnakeKeylogger)", "value": "a4e9bbd5382dd359ead97183d42c9e19171e24ab8daec58096e67a19cdf80db8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345618, "uuid": "611d8024-84c7-475d-bf4f-7f09a9d6958e", "comment": "Malware payload (SnakeKeylogger)", "value": "4754af7a536e1c1444530c64609d3039445993b6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345618, "uuid": "94a3abca-5666-4130-8246-d0efab41e9b3", "comment": "Malware payload (SnakeKeylogger)", "value": "1350daa7d14cad6a1c1d90feb0dc038b0c87792d50e7cb9f4442bc2e60553aa34d9d5724d9c3762c26e8400f2ddc6893", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345618, "uuid": "44da55d4-138a-4512-b335-e5891430e071", "value": "T17F04C53EC6B0FDC4072E70E0916E3B06205C0B93F6325B6CF4C95AE61960695EF7A69D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345618, "uuid": "6621dd12-e215-4df0-b871-ca2d53fea356", "value": "3072:U2aWlAuNlVRMYUgBiMVC/p4QhoMfxcgdSaut2a7isiStBTU0RiB+Etwc:DlAuNlVRMYUgBiMEfj6gdSVNGsJtBgG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777345618, "uuid": "93317926-47d9-42c8-a7ba-65e90826ada8", "value": 185664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777345618, "uuid": "42245694-2855-4bec-8270-55da88b0c51c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345618, "uuid": "50bd64fe-6730-45ad-9623-c115283576f1", "value": "VirtualProcess.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bd25ff-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355317, "uuid": "aec6ecb1-ed44-4d00-967b-2df643e84ac0", "comment": "Malware payload", "value": "1ad34daa1efd57b1869bef5db465db0a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355317, "uuid": "8f8c3d39-59d2-4d0f-a32d-e9564d806617", "comment": "Malware payload", "value": "a52b8bb790e7c6c99d9fa6e064884f18ad99b080c10fe2f57f54d4b3cbb58c1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355317, "uuid": "219993ab-a1d8-458a-9eef-b0de5d7b74d4", "comment": "Malware payload", "value": "238947f38a7426f30dc89f4fd445af2ab26dbd0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355317, "uuid": "1660f4ae-e363-40e7-b9e2-53a4ef0f1491", "comment": "Malware payload", "value": "630a15bce3fe0a5fa3adba3e72f1bb1e4334e073d75f3400a66c6242bfc8f445d40af7970ebd3863c9ed6cca2b39bc51", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355317, "uuid": "2881f069-7500-4112-86bf-dfa4b62bff8f", "value": "T13727234C98FC4E9B8E68C60908F34FDD24955A10D1D5FB7891E0FC46E46AE8EA70E17E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355317, "uuid": "8a381e3b-835f-4c88-9e6b-eb03ee3573d1", "value": "49152:tXHodXHoKXHo1XHoVXHoyXHoUXHo+XHo4XHovXHocXHoqXHoys2XHonXHoNXHoUW:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355317, "uuid": "71b5d30b-5a76-4e75-a1a4-0df727ca6b35", "value": 22123546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355317, "uuid": "3581ee17-d909-4805-90f1-571bb8671add", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355317, "uuid": "b76109a2-4cc3-4201-a6f1-093a60bf3fb0", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2076a727-434d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777413396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413396, "uuid": "e7c1d2fd-6130-4455-bd70-faec8e240038", "comment": "Malware payload", "value": "587f9878cbde646f812b20de2b0fe579", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413396, "uuid": "620958b7-84eb-4635-b6d6-1468139450f7", "comment": "Malware payload", "value": "a794a65869720942f913b95247e14943245117720661073bb184b9892f77a12d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413396, "uuid": "9e864260-147e-4ba6-bc9b-ccecbced96d8", "comment": "Malware payload", "value": "4c335850f699482cde7d754dcb6094ecbc242673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413396, "uuid": "45b45ac9-6300-4d1f-bbec-e382b6040444", "comment": "Malware payload", "value": "0d6f1513f0ca2bc564dbfba246090c71eaea54e928ee52f917baf5f14d81b36beda292b462984e3614c41da4477a7d83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413396, "uuid": "7b15cf8f-f851-479e-abf4-ee8bac19285f", "value": "T15E43F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413396, "uuid": "731b22f4-a107-4081-b519-68cf96b280be", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfzt:5AG8nY5BZG2xxmLQLS/S7hHnQfzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777413396, "uuid": "d34026ea-6cf4-4bc3-9e3c-d4bfa4ce3bf6", "value": 59611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777413396, "uuid": "cc898d32-eed7-4d81-91de-8ffbc4a18efc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413396, "uuid": "e61c7b1f-74a4-4717-bdae-f46dd29d52a3", "value": "motd-news", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13de8eab-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (XFilesStealer)", "timestamp": 1777400490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400490, "uuid": "caea6e42-673b-47fd-a896-7865d54b47ed", "comment": "Malware payload (XFilesStealer)", "value": "266b20da1355f9c66236be3b2e748d9a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400490, "uuid": "65d66dfd-1111-46b8-ac89-700b97951c03", "comment": "Malware payload (XFilesStealer)", "value": "a8468ffaa856f18daf74faefdb176e8d5781c36cc962e4fefbd081334606075a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400490, "uuid": "905b8c2b-8fd0-42ec-8fb9-37aa934c33e1", "comment": "Malware payload (XFilesStealer)", "value": "cbbbb27177329751905ccd57ad46ee609272d6c5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400490, "uuid": "04295528-cc64-43cc-b28a-259e748d1387", "comment": "Malware payload (XFilesStealer)", "value": "eff2a27d178087f335cf3a03ef487b299c4b5a611f1ba94b17ddccb18c434dfc173da99ab6ffef0c8ebd770d46f387fa", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400490, "uuid": "af0ab3b8-a3e6-4dff-b842-2f7eb946ced5", "value": "T14317339BCE037F76F263DA3F47E1171D59A12D535453C09BA3263A2C0A36B816FE6089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400490, "uuid": "431bc07a-a886-4709-89ed-4d8e59c23876", "value": "393216:5yMlmCjkFXIR3RM92hJqaiWF0kbaAHbEcN1tH0f6pvm8pG1S:kCj8XUW27YWFlbaAHbhLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400490, "uuid": "304eb79d-e75c-4701-b77c-5b83795bebed", "value": 18878464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400490, "uuid": "dd3d6cd2-436c-4aad-88ce-4df775452a47", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400490, "uuid": "43846b8d-fa03-4971-8ce3-26e5eade3178", "value": "EventDetail5_2026Invitation_instaIIer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8538ac67-4347-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777410988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777410988, "uuid": "6099d679-b0e3-417a-bb43-c151506bd6bd", "comment": "Malware payload", "value": "872f49e6b09327a16e412e2ed1352ccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777410988, "uuid": "c61a3c45-f9ce-4bc0-95c9-bd4bd55c98d6", "comment": "Malware payload", "value": "a8f64c40001a60e1a37e00087fa2e5855fdc0db4daf24d2dd35d565439e80b1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777410988, "uuid": "585328b6-2918-419e-a9ce-835d892072bd", "comment": "Malware payload", "value": "f4eade9d1b72f96783efdfac6cea1911332528f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777410988, "uuid": "dbf34b9c-8031-4d53-87bc-d773f3962f7f", "comment": "Malware payload", "value": "cfa43ef5d800653ffff433ab912afe64ca5039cd3a950fa5f55ef98c2603a2a6228e7057be58d9e1d6ae7e73522f1c26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777410988, "uuid": "e1322489-a816-404c-95e0-6b5e9e54aba6", "value": "T1ECF733C8DEE2793DDCA5C47FB11026284D7C6AC6E958477E8E4EBBFC44A05761329388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777410988, "uuid": "cc2dceea-d969-48d0-a7ef-7d063f42f771", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777410988, "uuid": "62eaa4ca-c610-44af-a86c-03f6a88d12d6", "value": "1572864:gejOS33WIubX/WEjWPfOny/tmy5DV8bxuNJ1B/4L1ht3YcIPTvgA+7:g6WIuOEyOnyLYxuNN/O3GcIra7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777410988, "uuid": "dc698fd0-5699-4d64-8e62-33959da2fa5f", "value": 75212568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777410988, "uuid": "01ad24eb-3781-4391-9069-288fe93e0f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777410988, "uuid": "c38e059c-84af-4707-8fdd-4256974701d1", "value": "java-2dj9CY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577df71a-42f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777376122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376122, "uuid": "055ea806-4a2d-4584-836a-b86c825a8637", "comment": "Malware payload (Mirai)", "value": "4f69d5d317af8399fc8c3dad4bf92406", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376122, "uuid": "bfdb7a88-eb07-48fd-9c34-fb191ee32bb4", "comment": "Malware payload (Mirai)", "value": "a9f89d4bb4cac2b99471db8ed0abe9a7c53b8579d7345e7c9d998b8f022c0542", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376122, "uuid": "23dca6b4-0ace-4669-8d40-586e88ff5b18", "comment": "Malware payload (Mirai)", "value": "6d34d33d6cd817df584fd78739115e04d0afe97d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777376122, "uuid": "50297239-747a-43e7-8e40-0204050a3a2d", "comment": "Malware payload (Mirai)", "value": "f19038cc5f65d9ec935d70675c64c452257ed7a977f723b3fc615d1b6971321fb709979ebadd2add09bdc77f6408ad0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376122, "uuid": "d2afcd42-1838-448f-b735-88d466cf971d", "value": "T1E6C43955F880DF62C6C12976FA5D82AC73174B79C3EB720689254B343BA786B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376122, "uuid": "c6aa7fc8-2281-45dc-996a-420c08b63598", "value": "12288:GTUlhKP4ePusaLp0p9F+5wo3ZfEjvaNItsppPgpMht9/:sShOusaLmpnoxELa2tObf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777376122, "uuid": "06276e7e-0b47-4b07-84f9-05646dcc4b56", "value": 578852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777376122, "uuid": "69d50fe5-5232-4f8d-98e7-5fbd3ca413a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777376122, "uuid": "ad93588a-3050-488e-b6c4-617793fbc335", "value": "agent_armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15751a77-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355395, "uuid": "7cd46281-feab-4782-b37b-23e4adf1ebd1", "comment": "Malware payload", "value": "0987de2d8d23e1ddc54364e2c83d806c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355395, "uuid": "872b7abc-6285-4db0-b728-f2f4b40a3c09", "comment": "Malware payload", "value": "aa22193732485815d415733795f145aeec8fd93c9b935848935bc8463978694e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355395, "uuid": "a2c6c91d-cdba-4682-91c4-917e8630af17", "comment": "Malware payload", "value": "2299dff15e689718bdb342268378a041241a40a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355395, "uuid": "cb22868a-d6a5-4180-8885-40b8b845c7c2", "comment": "Malware payload", "value": "03c0e405504cdb1a73a56a7b3a6405cd87addac7362eb73ad7aaf6998e4427861dc7232a1aa2e2599b34d8a001698294", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355395, "uuid": "bde32b2c-03c9-4880-b59f-925464d74c03", "value": "T184372302CEE3BEBFD6E7FA9C9568873D53885D0146B5B642A6F940FF9B54F60000A49C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355395, "uuid": "82f9e71b-0c19-45c3-b57e-a52ecd3c018e", "value": "49152:FMbrbMbr9MbrIMbreMbrhMbrDMbrnMbrUMbreMbrpMbriMbrdZA7TMbr2MbrZMbR:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355395, "uuid": "51930002-2f03-4b80-8598-280b16fbb1a4", "value": 22903944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355395, "uuid": "8a269cad-2bbe-47fd-8246-cc6f557b9263", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355395, "uuid": "c0c8dcfc-403d-4952-8508-40a32bde1841", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb283145-42a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777342010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777342010, "uuid": "1fe0d603-499e-4803-81c9-30a32b7fef05", "comment": "Malware payload", "value": "166c5e02da3d507e6510d155e6a4b9fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777342010, "uuid": "145c555e-13f5-46c2-973f-b4e2cd19854a", "comment": "Malware payload", "value": "aa6ca59a847a4cfce509bf8b87c4f9c35f063a2db61837358b725413e10e84f5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777342010, "uuid": "1e816aae-3a71-435b-9ddf-0e2f9ca84260", "comment": "Malware payload", "value": "e355d3c585dce5005428a729bc8363b4d6fedfc8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777342010, "uuid": "f690129f-eba4-49b2-aaf4-91b48618b7c9", "comment": "Malware payload", "value": "d1c0f7f64d6914394ade931913c1106aa15501a6070c59ff3e593402317415a5b62948074f20b6a290bf57f6300f03b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777342010, "uuid": "24303b46-084f-4c70-a168-a874441012b9", "value": "T1788321D67B0395C39065A32EAA5D93F68392393463893F0F47E422579A8317F5A3B133", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777342010, "uuid": "87061a7f-ae13-4225-9e1d-878bbc745f7f", "value": "768:ihHtu6tgIYWpLurNzBAV7OGz6Cpz0sZ8YqCCWYl/gp2fDCHZ2qyx5DhWwW7ZVH6S:I1uAD6kz0K8lksJG8ovMFqA+RWL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777342010, "uuid": "e8a0cd13-81e6-4cd2-b494-cf4142808cbb", "value": 80838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777342010, "uuid": "d699ed7b-6383-45ab-bae2-14d86ef67292", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777342010, "uuid": "10c683e2-94e1-4795-b850-e05b4a017e91", "value": "dfr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b249d67-433e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777407132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407132, "uuid": "40da9466-b23d-43bc-b5fb-d47c40deeb52", "comment": "Malware payload", "value": "083bf3b0a652673ce8cf137001a787ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407132, "uuid": "e9d14c3e-9dd1-430d-92d7-33e9a942a0fa", "comment": "Malware payload", "value": "ab09dbaf8cb206bf1ebf487cf2b231e7c42d9d52591b5d4a224434d69309ef62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407132, "uuid": "5c528b95-e86e-4ca1-bf33-56b91bfa2c8f", "comment": "Malware payload", "value": "80c1889c0088ede3ddc4bbc2d946c399a0378891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407132, "uuid": "d62a0359-d59c-479c-a285-d478f9a81d53", "comment": "Malware payload", "value": "5aa66b6d2611753f85284c867bbcef1f3767ddfb9bbe030d9e0fc9b7808c975eff98d628716407999501a11fb77e72e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407132, "uuid": "6be484e5-4478-48a3-973a-a7536da42c5b", "value": "T14D08336A3C8A95E7D171573981C0A01B87E0816CDBA91EBC2E9570D75C97F00EBBB378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407132, "uuid": "c7bbff12-4fe1-4d6b-ab2f-37dd0d688c77", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407132, "uuid": "575a3a45-d45f-4086-988b-d5a8ff9825b5", "value": "1572864:ZtLozz7teVpT2QeiWoueN95LSysb0ilhVWZZCz3LmSm7:ZZon7qp6PiWoueN952b0itWZZCqD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777407132, "uuid": "e5a516f7-9208-4e65-87a1-0c038703c0fa", "value": 84358849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777407132, "uuid": "8c904c3d-9618-4c3c-8317-f2852da865e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407132, "uuid": "85683485-bf0b-45ad-94b8-4128fe64357c", "value": "Doma_APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d395af69-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355285, "uuid": "59e1fcff-512b-435e-8f75-07d737a75a49", "comment": "Malware payload", "value": "3d644c875bff42bce96a8a95031cd10d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355285, "uuid": "e2f0310b-1b41-46d8-82ea-586e1a7e7822", "comment": "Malware payload", "value": "ae7cf6ffc1d2bd3429b61fdb6de570d9eca1bf8a255e77da22352982ef52d417", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355285, "uuid": "8644765a-3ac2-4449-a02c-f137c63d2c5e", "comment": "Malware payload", "value": "c61e8c008363697300b6347655423f3fc85d5943", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355285, "uuid": "24526b4c-eb12-4cae-9d80-b6072371e114", "comment": "Malware payload", "value": "bfb685f717d751a7db8a2bf9eefc1c8f8ca3c65caabbede083cffd82a3ed30cef127581e05373d704ec1231b7048baa2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355285, "uuid": "07eb5c5e-07aa-4e74-a058-db7f749cf26d", "value": "T1E637230F9B992BB4C774B33C045F1646B7F2BF0496058BE437F2B885AB5EA14123E166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355285, "uuid": "dd101eb0-a8ea-4efc-976b-fb46f01ad412", "value": "49152:6gdjgdcgdYgdQgdvgd5gdIgd3gdOgd2gdtgdq/q80FN9gdEgdcgdLgdfgdj/q80r:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355285, "uuid": "3e61d375-6f7c-4a24-ae1d-376781757fc9", "value": 23164067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355285, "uuid": "6a47fd2f-05d9-49b0-a8b0-a84361c7768c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355285, "uuid": "6cd3dc14-2e3d-4b0f-bf4a-e719c3abb263", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac3745f-4342-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777408903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408903, "uuid": "14bcb95e-8796-44ec-8bb0-8b9bdf57fb4f", "comment": "Malware payload (a310Logger)", "value": "6398cea3dba7b0ed5b5e618aa3dbf324", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408903, "uuid": "1d16f919-0847-4317-81e3-dc5666412c9a", "comment": "Malware payload (a310Logger)", "value": "ae9f0254a4602feb744185aa145e7ddd95f33d35c1834f0e0799c73fefb064d9", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408903, "uuid": "79e97fc8-7efc-464a-93f3-6d9361fb9b05", "comment": "Malware payload (a310Logger)", "value": "56cde9dc44a7fce07d7491973b6ebbae2ca56e43", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408903, "uuid": "d5742f18-2d06-44ca-b67c-cb0c3c646694", "comment": "Malware payload (a310Logger)", "value": "2c35fb1a1dbda34e024d6b7729cfea7df5957deea4facbe1cd1c442cec74ba0392b7460aa5f8a71ee5859216b49ef144", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408903, "uuid": "b18ec7b5-4654-4f32-af8d-6c7f2c109756", "value": "T141955BF78EC561E1EB0EC7A1665D4FA2525EBDC6322150C6430EB21F49E3787BB0588B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408903, "uuid": "807ba7f0-4ea3-45e9-9821-27637269efd2", "value": "24576:RlJajEh1we4oIb4R+f8y4xhjd4AzhEX9WRXND4ucL3:jcVbGEEykTNND4uU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777408903, "uuid": "b5b54218-feda-46ae-975b-0771423ecef6", "value": 2052919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777408903, "uuid": "bb41e029-ee54-4dab-85b7-b4ff99fcc810", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408903, "uuid": "0fc51f29-e944-4b38-8fe6-8764da096898", "value": "ps_U8oyqNws6aoH_1774515033019.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb505551-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355351, "uuid": "4c449327-8123-4a36-80e5-b5e85b908547", "comment": "Malware payload", "value": "21f2765b5ba97863d236ed3af0965349", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355351, "uuid": "790396ab-b559-471c-b019-5591904e15db", "comment": "Malware payload", "value": "aed1484caa461bd93383ed95cd6854d30eacf4a5ccb52065076cd03e7f59b447", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355351, "uuid": "464b7488-b3b0-44b6-92a9-0d86d2b12703", "comment": "Malware payload", "value": "a08c7f494b8ea0c554571b302b7aae49fcadf246", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355351, "uuid": "e001227a-3ed5-460c-a98b-71384c445db9", "comment": "Malware payload", "value": "b20267ce99c04db4d5c60c0c76f357a8f3306e05ee18a15c3ecc642006f18f52e4b9a13daf2a1e989b70703644675379", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355351, "uuid": "8ea06797-dea8-45ff-bceb-640dea7e6474", "value": "T14C3723024F3E7E7ADDBF1234018D192F6F6C1F040112808E5FAEBD64CCB765A9DAA659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355351, "uuid": "94d96e0d-aeeb-49ef-a36d-e36e7488e067", "value": "49152:nL0tgL0txL0tfL0t9L0t8L0tqL0t4L0tRL0t1L0t6L0tfL0tfuNL0tRL0tOL0tOj:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355351, "uuid": "74b023d5-ca53-4f61-82d0-283820f7cc83", "value": 23944465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355351, "uuid": "e9a13869-2636-471d-9474-7687b115ffa3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355351, "uuid": "c4118e27-cc2c-4226-ae57-08c45689990a", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee12026-4314-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389287, "uuid": "598e2450-f37d-4b78-bcd2-0a5f555f2d5c", "comment": "Malware payload (AsyncRAT)", "value": "0db8d592aea945604699ebc67573bb40", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389287, "uuid": "0b6292fa-391d-49c3-885e-e86e19130913", "comment": "Malware payload (AsyncRAT)", "value": "afe7f0736483fa304bfde77d330e109c6137338d1a1da31735de02485d9d2ce1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389287, "uuid": "20eafab6-be82-4995-bfac-1f7bde1beaf1", "comment": "Malware payload (AsyncRAT)", "value": "41bf785b3cdbc77b31dac18f577ab935286cc9e5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389287, "uuid": "693ab452-527c-4a90-a425-ae049d479203", "comment": "Malware payload (AsyncRAT)", "value": "1e203414a6ccdca9ccf774c3fa5503bcbc3f10fc274e4b4af6f88152f61453c2b51656e0b60e3ad018ff7a24c5c9308a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389287, "uuid": "0a65b115-4d24-4fcb-8487-639478506acc", "value": "T1BF1339007BFC1625F2FE4FBCA87952454236F9679932C74E1CC4518E1AE27C1AA91FE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389287, "uuid": "af4f949e-41c2-46f7-a2c4-438a0b4df964", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389287, "uuid": "54104a27-143e-4cd6-9b92-9ebbdac22a64", "value": "768:3q7x+Ds8an6n+IRXMYOn7Y1VZfanSvSRCfHuRbheuoVNtLfLv2D+:K8an67O7Y1/fjqQ/uRbguIN5Lv2D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389287, "uuid": "2fba78da-29dc-4f7c-807c-12bdf0838cc2", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389287, "uuid": "9159c083-5de7-4302-884a-3272c8dfaa4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389287, "uuid": "78941820-fa74-4715-8e0e-0fffbbb971e2", "value": "afe7f0736483fa304bfde77d330e109c6137338d1a1da31735de02485d9d2ce1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f1f6ba-42ac-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777344607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344607, "uuid": "531a9431-ceea-4347-8107-391cbc72b21b", "comment": "Malware payload (AsyncRAT)", "value": "e620939028b2a5995bce255db2a0fc0d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344607, "uuid": "67e2db33-1533-48ba-9e14-05b0a92b4a1c", "comment": "Malware payload (AsyncRAT)", "value": "b056e1dfb6566ef0b2e10023d25b5bac3666a93b9f7a699afdff76c33b31793a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344607, "uuid": "8a5329b8-a98c-43e7-a9e7-98e39d4a55fd", "comment": "Malware payload (AsyncRAT)", "value": "66f62126104e7cc63a30970e7ea5cf4f377f1fa3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344607, "uuid": "20ad3ee9-26fa-4f90-9acc-b192b3a78b04", "comment": "Malware payload (AsyncRAT)", "value": "f73516cf5924bb201e0b7c43db73ec8a092a161517bdadf75ee6857bdb8d91728af117191512865b82dc2a048973b218", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344607, "uuid": "7bb1f041-9cf3-4f4f-8c80-0571dff7151f", "value": "T14744A0E4DD752EDC296EEDF2B4EB98A9E8177B8DB70721683A20758023740363F74194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344607, "uuid": "16658d09-0381-4e15-9e46-a8abd515febf", "value": "6144:99CluE3tL/aXepbNp/bTZ8gZq3mbA5R9GtZXlw7PRXfwZ70zMMni9:/ClvtbaXepZp/bTZ8gZ6mbOGtZXlw7Po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777344607, "uuid": "5f675dc1-91fc-45bb-af7d-64ef1d0a0c82", "value": 255328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777344607, "uuid": "f9107057-d9e2-4331-9a03-e9fdcdcec56b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344607, "uuid": "07884cdf-9f53-42eb-88f5-68264b675511", "value": "ps_TqNz8IFlJjeP_1774512637483.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a6f4a1-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777364849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364849, "uuid": "9ae09ea1-67f4-4b1e-a8f3-c5850a290505", "comment": "Malware payload", "value": "7107f6b758cedc5a0b160e015817174e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364849, "uuid": "1e1bdd68-48c2-4849-a90c-76f85482926f", "comment": "Malware payload", "value": "b0fe7c1a36860bd7898c848d59bd5dfd07e50f022497c08e7fa4afeda868218d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364849, "uuid": "8f341365-7503-40da-b25e-8fda2ea4d31a", "comment": "Malware payload", "value": "d46067f77eb8c80637800ba0f69b665d0a2eb8ba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364849, "uuid": "ee6f443b-df03-4d66-ae4c-91c21b6a525c", "comment": "Malware payload", "value": "9eadd5c46b8dc0bbbb5e0737bc0b5d8faae4c6eb093accc8f968f9f73037a8d0bdddeb5b7521b31d7912385518b5b728", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364849, "uuid": "aee92366-f3c5-4797-b999-4d94e91cffdd", "value": "T186137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C19ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364849, "uuid": "0f3ca9f0-23c3-45af-ae22-cb6b4692feee", "value": "768:bN0H+g9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bNg+dcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364849, "uuid": "cbd40164-fba3-4b89-a04f-42f0b962c610", "value": 45437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364849, "uuid": "69d3aed0-c75c-4a46-9c25-be1449989593", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364849, "uuid": "bed5d134-380c-4c32-af75-e28c1e418261", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ecc40e-430b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777385112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385112, "uuid": "fad37226-3d7d-440a-a950-faa976a5c8ad", "comment": "Malware payload (QuasarRAT)", "value": "bef7a398fe8eaa420ae49cc1f55a867e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385112, "uuid": "e356972b-bf6f-423a-8955-4027eea1e6a9", "comment": "Malware payload (QuasarRAT)", "value": "b11b82e5cf984a4b507b0ee247460017f882a30e9d0051cc85246e0f2758a301", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385112, "uuid": "37c0da2f-d602-415e-9a8e-10710b52e9a4", "comment": "Malware payload (QuasarRAT)", "value": "fba4a30ba1b640db85c3ed161665a71a6e8196a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385112, "uuid": "8f07069f-081b-431b-be68-a50175fc4c3a", "comment": "Malware payload (QuasarRAT)", "value": "e7bd87094b99355b48b755ee69f0d8c4ac20726f2e2c0b96efa7732e7062aa9405fd52afcf6e843b3fd10ddd97a89518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385112, "uuid": "2d6de25e-3ffc-47d1-af59-fcaff68afe99", "value": "T1634533C62BC12C17E28D2FB7AD553ACA31E6CD7D9BA4B67E68D607239B205C35B43140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385112, "uuid": "1ca81912-47ce-4328-990e-2fe8f9a2cc5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385112, "uuid": "e6b4d0be-59c1-496d-8279-6efef991f821", "value": "24576:BoWkR1K4KuD3QLhZGSyRaeq2dwbzgAAHVG5kZNo:uWruElZNHeJm5A1xZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777385112, "uuid": "7622ad42-561f-4c01-9611-e12d0aec162f", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777385112, "uuid": "2c3705eb-32af-4f55-9a27-86251eff36d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385112, "uuid": "47bab78e-4e6a-4a82-a1a4-c8846a12804e", "value": "GayLocker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88546428-434e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777413999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413999, "uuid": "0f129e98-b67d-4f59-a92d-3f3ff2de0faa", "comment": "Malware payload", "value": "6d2dd95454f1e5639694ddb4e7c2517a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413999, "uuid": "767bb73c-f2fd-426e-9020-304d4709c09b", "comment": "Malware payload", "value": "b1a5430fff793412d0e5d32ec652029c2c05a2f9e558457e8f7027854ec42f1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413999, "uuid": "0cefc304-54e5-4c4f-a2f5-a8a489c1fa9c", "comment": "Malware payload", "value": "db1dc7ae07a504c68caf75dec2318eefa19f0566", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777413999, "uuid": "55954c63-2bae-4adf-9a87-22de89a30dca", "comment": "Malware payload", "value": "8c66bb65200662ec7d5487f2daefbb3e7fb534b8c4849a8a7ee238898b20baebc06c6b8acb88202a19db67495526e852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413999, "uuid": "f87439a8-e55f-49f9-9236-d85749165486", "value": "T12143F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413999, "uuid": "f34f494a-f42b-4160-bb58-5ed5aeb8cb79", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfzW+:5AG8nY5BZG2xxmLQLS/S7hHnQfzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777413999, "uuid": "10b06205-e0f1-4bac-805d-0aefca4c28a9", "value": 59688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777413999, "uuid": "738758c3-e607-433f-9eb4-8c802e0ddfad", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777413999, "uuid": "86afc855-e5eb-42a7-ae40-50b7158f3619", "value": "irqbalancerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1beb5ce-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355255, "uuid": "78881f93-05eb-4d92-8325-ccd535d450f6", "comment": "Malware payload", "value": "fa0f3e417f3157fe4ef2ef5663ad4e33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355255, "uuid": "9eb0368e-2a64-406c-8e73-32f42db7073e", "comment": "Malware payload", "value": "b1a66d220c5c99b3de0fb68f85ca8a6d0c5f18d770051fa80b4b4db386590a10", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355255, "uuid": "d00587ad-c853-4fb9-a167-31416c70e7dd", "comment": "Malware payload", "value": "0a245624676a46d4ceaa884348c7408b635f8f0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355255, "uuid": "fe867e1f-934c-4d8a-b553-cb6f9e886789", "comment": "Malware payload", "value": "44a57512ba01fd77947503fe38b27ca684628a0753b77f8b1437b961dbaaab131d224d5ceeedb52a1206c6d71e609d66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355255, "uuid": "3ee15784-ed9b-4d58-815d-3191c97ef2e7", "value": "T16B3723138EB4EC5E8FACA54D5D2ACF6A3569CC14850FCD70879ABC8B07417D892A3C6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355255, "uuid": "b7bed6dd-70a4-4581-b376-f5ac3985c089", "value": "49152:jUCRmUCR7UCRdUCR8UCR+UCRYUCREUCRxUCRVJUCR2UCRvUCRzlz9P2UCRMUCR3I:ANIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355255, "uuid": "7fe0a25b-3244-4b20-922c-d6744b3a8ce7", "value": 24204591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355255, "uuid": "7dd6e6ba-92f0-4200-8e60-7e8b1c484bfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355255, "uuid": "54d6fc58-0985-4ffd-8744-ddaef93d1232", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5425c46a-42c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777353782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777353782, "uuid": "46f064e8-19c4-4476-baee-278139adf369", "comment": "Malware payload", "value": "f60fb4eb7686515ce62ab98fc9e1527b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777353782, "uuid": "be18c9bb-8821-4993-bcd5-4fed1045adbf", "comment": "Malware payload", "value": "b40c2a5cc76e4c63a57f52b963baa33e8802a90891a76eab455001265475eefe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777353782, "uuid": "ebc2b2e5-e4a1-4e27-adc2-0589ae7d1a62", "comment": "Malware payload", "value": "b6fd3a66df12a985f1aa2e55cba7f79b0f4b4d6d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777353782, "uuid": "f8e85406-d464-4b3a-81aa-2a49110555cf", "comment": "Malware payload", "value": "6bad55efbfa280b8d955f6b123ffd02dc917c033b686d27c0ba015aaa65dd9edc9ed7eb14355f3800069b9902833b675", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777353782, "uuid": "4816eaba-2b05-4dc4-a603-ea8e33da4697", "value": "T120136C6566913C28AA9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777353782, "uuid": "1b4a4999-7020-4987-8844-84b6b3e49b3f", "value": "768:b/XRWNGxVZ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b5lxccy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777353782, "uuid": "248dfca2-1519-47f5-8d4f-f1ecbcf8c1a3", "value": 45449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777353782, "uuid": "aaa6bc3b-ee0f-4628-951c-fb54ac6e4eaa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777353782, "uuid": "f3092038-d9bd-4839-a84d-75261422600c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdafcf43-42ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777371998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371998, "uuid": "126cfa15-b106-4bbd-99d2-c5e2c07b5cb9", "comment": "Malware payload", "value": "51d06ef18bec0aff2c359137dc79291b", "object_relation": "md5", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371998, "uuid": "c98609b2-f8cc-4a44-89fc-2db2fd59989d", "comment": "Malware payload", "value": "b450e893aafd94f2a81e2b70047e6d2faf20cf4056d39cfc17b69ee78912f8b2", "object_relation": "sha256", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371998, "uuid": "4b2ff7b2-721a-4a49-bd46-0a8d14ced8ae", "comment": "Malware payload", "value": "f28318b0eca99ce8fa3d471c53a9eb634b13ba05", "object_relation": "sha1", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371998, "uuid": "2d604ab8-114d-4b25-92dc-e6b0ff5c9d2f", "comment": "Malware payload", "value": "ce70781c0ca86eadca5ed5054c829a73c51743054926da6639c7d9268d2b5f0907da5062061d793ac38d97b4338b9459", "object_relation": "sha3-384", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371998, "uuid": "40b28e1d-a8b3-4ef5-9497-8cd731fefe35", "value": "T118512C6225F92008F37296B1DCEDA7898A57FBC31639EA0B4C105D0EC4D12436B8F7B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371998, "uuid": "cb772fb2-6e08-4b88-a33f-82f10c48d2ef", "value": "48:8FNg3ymZYhorbT6LLH9laIS1SVd9S6YHLO1gzth/dyRMWSExdmrhab:8Hgiea+b2nH6TC96i1gz7lyRMGLmrh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777371998, "uuid": "2fcb8938-faa2-47a4-92c0-d008be95dd55", "value": 2953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777371998, "uuid": "15657baa-f2b9-42c6-943b-1036e04ba5b4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371998, "uuid": "8df3aff2-be7b-48a8-9432-9415e2c96a99", "value": "Screenshot_14_04_2026.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3d4b9c-433c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777406379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777406379, "uuid": "dda3f61d-93ca-4800-99dd-4de12cff5d8d", "comment": "Malware payload (Mirai)", "value": "55044f0df7f6b8d6c439c50660418c33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777406379, "uuid": "30fbbdb2-38af-4cb0-ac78-b4e1109142f0", "comment": "Malware payload (Mirai)", "value": "b4be79dec7f695163a802712e62c8316c23c4c67ae33cb1ebd2e7a40e99f0aaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777406379, "uuid": "ad5833d8-b98b-4424-9238-7ba129970189", "comment": "Malware payload (Mirai)", "value": "2c2ed4827f9072e0a27ecf87e48e15b7a8daea70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777406379, "uuid": "643c7a61-f262-4e8d-9a6d-4773e52e48e2", "comment": "Malware payload (Mirai)", "value": "9a274779a4f9325c81c09a9045146cd3d286340a178c01441ed435c906f87a0a5063cb7a9130a83ae8db2a50cb2b8215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777406379, "uuid": "d8d115c7-2a1b-4d96-9024-73fbcf21f0f2", "value": "T17803E15FF188BCA9CEBD5D71419059A38644307073DF0BEC66250D90FEB595B218D4BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777406379, "uuid": "1bb3a35f-dfdd-488f-9e26-cc664e2f8905", "value": "768:NuqXUwtY+mGBBdGZzI6fODa2CiTrtrYaquX3WoujJL59/Wv:NuUUp+wzITDaxyrSaN3jujJLfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777406379, "uuid": "39537931-c951-4638-a0ad-5392881101de", "value": 41216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777406379, "uuid": "a4e0a0ae-5be0-4911-88e8-464aa715f0d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777406379, "uuid": "c525927d-9593-44d0-80c7-c461f085af74", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541c03b4-4320-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777394155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394155, "uuid": "b96cbe5a-5d9c-4a64-8778-7396f1dfcf08", "comment": "Malware payload", "value": "f07686cbbcb47f23f4eb15403a5f287a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394155, "uuid": "9738f84f-d3c8-46b3-be2f-1cf2c6f25838", "comment": "Malware payload", "value": "b4d089c70ccd2bf0ea3eb9fa19e9dd232b40893c43b3b308e30eb1c1786961fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394155, "uuid": "5861aa24-a8e3-49a6-8c84-fbda6b72dea1", "comment": "Malware payload", "value": "b751a2623bdee6dea7f8b96c81d6e302aed0aa95", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777394155, "uuid": "4cb64b4b-2e82-43c4-bf96-4c7765ad5150", "comment": "Malware payload", "value": "715ae1d3d217fd81fa615a31be27ecad6efa40225f4fdb8d4f19f96e1fde9bffaead72bd82580b5a47db19e6ba9340cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777394155, "uuid": "8b6ecca0-bfef-4a34-ab52-6dc7d3a386b1", "value": "T152512C98C7421632FF57183FFAA1205847C6AC03D764505D5EFB5CCD01A0956A67CF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777394155, "uuid": "d872bfce-7233-48e1-9690-151148e50151", "value": "48:C+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:CkatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777394155, "uuid": "04eb9228-3d9e-4598-8568-57579863631d", "value": 2494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777394155, "uuid": "4520ed35-758a-4149-9422-6ad6f79a284e", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777394155, "uuid": "4cb3b6e1-d796-4952-8212-cc63bf2c9d6d", "value": "164.90.195.107_1777394131172487_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73f7698-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777397757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397757, "uuid": "3453263b-cae1-46db-af80-e181f3da0c03", "comment": "Malware payload (Mirai)", "value": "1157fc0bbf707257ded01356fc9da2d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397757, "uuid": "2bc60615-c90a-454d-a1a9-1f4ddcaf9c8d", "comment": "Malware payload (Mirai)", "value": "b4eaaa783f1d360c5f3b63c89de0460234d9bb51762eb44f526c416d86ec23eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397757, "uuid": "427e3be7-ed73-494c-ace1-f1dddc3e4c37", "comment": "Malware payload (Mirai)", "value": "77d1fd14550dc0b4bcfeb92c0091bc949007708a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397757, "uuid": "ff466e25-71a8-43a6-a198-710444b17770", "comment": "Malware payload (Mirai)", "value": "b549bcf1aa2fb9235c9affaaf0c794e7a0ed44b249d788f68ff6bd1e839a7da3a4755eb7cab95c4eb63fac03b297986b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397757, "uuid": "99fa5d77-17ca-41ec-ac81-b25ec98df2a5", "value": "T17D563811FECB14F6E5031E3100BBA26F67315D058B24EBD7EB507F2AEA7B6911836219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397757, "uuid": "bae04679-cfd2-4086-9682-688b3aa03202", "value": "49152:pPDbru884F9g3y2efGnUl6NUnZkeld8yqk7KqNbc1P3BUhhX7d0eM5Ea:pPjuKFycGnUbkSd8yF7UP2teEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397757, "uuid": "e01b4702-6314-45b0-8b0c-8b3ecdf78aa9", "value": 5914786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397757, "uuid": "942ee48a-3b1c-4033-9306-bbc9038cd9c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397757, "uuid": "19469989-fffb-43c8-a465-3cbb9adf1473", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d927353-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777400586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400586, "uuid": "6583f7a3-532e-424b-9728-ed2302d0f21f", "comment": "Malware payload (ConnectWise)", "value": "e460dddec376cc38e66e391bce2cfbc9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400586, "uuid": "1f4e4a38-8be6-4749-9c9e-e35830621954", "comment": "Malware payload (ConnectWise)", "value": "b4f7ba8f6c28cb3fc207eee5cd2b713f497cd0eec392183aef52a673f18bc7c3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400586, "uuid": "9def20d1-033d-4d31-a0d6-407169fb5042", "comment": "Malware payload (ConnectWise)", "value": "d3af12d62a16d2d0ff3fb524d697cc640df277cf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400586, "uuid": "fe8f52b6-6ccd-4fe6-9a94-86d9f83820c2", "comment": "Malware payload (ConnectWise)", "value": "d1c3b0b83300f930465008ab4ccdd6115ce7cfe8046507c5c720f7e32dc23c419859ce8a49c4e5b4afedf22403053927", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400586, "uuid": "dad68e83-f303-4b49-bf05-b51f9edf0f80", "value": "T1E1A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400586, "uuid": "d896c93a-788e-416a-affc-03c99337f4e2", "value": "196608:AnCtVYqI5MvbWEpKkqRIJqKxnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqgnCtO:0CXvI5MvHxJJXCXvI5MvHx6CXvI5MvH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400586, "uuid": "866dcb5b-fa0b-4687-acac-f2a0668fc6ad", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400586, "uuid": "e8944753-8fbe-4a9a-ab11-9952921483a8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400586, "uuid": "3141c0f4-cbdb-4a8d-a193-fce4a975793f", "value": "ScreenConnect.ClientSetup2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be664f6-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389309, "uuid": "5bd839cd-c063-4640-8436-94bcbe996101", "comment": "Malware payload (AsyncRAT)", "value": "df320e33c35c047e32bdb29310198493", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389309, "uuid": "2fe09f07-3e0e-4a27-8228-da7bfd168631", "comment": "Malware payload (AsyncRAT)", "value": "b51627bfdae764031650028e93c654a3abaf503a5964614ce83cb0febbc5c51c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389309, "uuid": "009d3349-16ed-45ab-b4c9-53aae92662af", "comment": "Malware payload (AsyncRAT)", "value": "5ecd4487ced8353a4571e91da7a1e0e0b9369ebe", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389309, "uuid": "6d8bf961-f107-49a6-bb63-f291bf89847d", "comment": "Malware payload (AsyncRAT)", "value": "17579c302c1574a1f51a7aacb716850a5a655569c67fbde30a7b6161d85c91067500ba11ace6ff862ddbcaf00d97a6e7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389309, "uuid": "9990fa86-24d7-441a-bed4-9d48c2c966a8", "value": "T1381339007BFC1625F2FE4FBCA87951444276F9639932C78E1CC4519E1AA27C0AA51FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389309, "uuid": "537f07cc-5e14-4912-b58a-2c78c7acc4ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389309, "uuid": "88c0271a-e272-418f-b619-c74d56e83eeb", "value": "768:2q7x+2TtNwCnbIRs0ZJnZY2nzX+OBvSvSRCf/uRbheuoVNtsHLvRD+:DCCn2zXbBqqQHuRbguINYLvRD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389309, "uuid": "94ca7ccb-3afd-4337-8052-19110d0d1d99", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389309, "uuid": "92df5d7c-c3f3-4e3e-a592-76474f8af9a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389309, "uuid": "2949d896-ab00-4a51-b452-f0e59793d877", "value": "b51627bfdae764031650028e93c654a3abaf503a5964614ce83cb0febbc5c51c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf75103-432a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777398357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777398357, "uuid": "9c935240-8bbc-49f1-bdae-270f3967cafc", "comment": "Malware payload", "value": "75931ea016927d10e2a14c8165055897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777398357, "uuid": "2dbfbd37-686d-4b7f-8ef4-e899657a4631", "comment": "Malware payload", "value": "b52e4a724d489266f457e3ed9cbe45b2696b9aafd6bca42f2c542ccda649bfc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777398357, "uuid": "560fb333-17c5-4178-9c26-07fe3bb11ca5", "comment": "Malware payload", "value": "c66f1c5d6de8111436bb70cfc05a2f30feaf2168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777398357, "uuid": "edd2a427-1bf4-44a1-b640-236c1076725c", "comment": "Malware payload", "value": "836ae19038cf9f4b92c9bb38927657096bd69d5ecb9ec4fc5aeaab87185518c9bf40d7a6f40171116657af12234d0f87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777398357, "uuid": "c4b90365-c21a-4ee4-b148-8d6e1a2819ce", "value": "T1CB46BEC404AD8054F8E6BA3C13E7526BE77D3F247218FDEAA2E0CC971607BA4F41A559", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777398357, "uuid": "e3b513fb-008d-4925-ab56-08a838a56078", "value": "d4d8a548490910c2e9bccf34d2b22d32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777398357, "uuid": "500bdc44-eee8-4a20-8733-fd1e1c1ebb22", "value": "24576:iE86+2CugU3vFOtQOjySiBtdCOFIygOB2hRcxFVY85E6PN/9CLwJ4k1HX2fApTro:DqFO7nChdy7QhX05xTupEbcHe+2hJAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777398357, "uuid": "b4fb928b-d5c9-4aef-b198-b3dadc7c1e2e", "value": 5462528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777398357, "uuid": "dcd7b25d-bcec-4d81-8dcb-1384e4f93e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777398357, "uuid": "0fd875a0-ee76-4570-8667-79266a85d316", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b748d324-42ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777371987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371987, "uuid": "c0c75199-db2a-44b7-9b58-ef12706d3611", "comment": "Malware payload", "value": "341c4b1df4b7766c171d3af33ada98bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371987, "uuid": "f43ae19b-9e70-40fa-b3cc-f17dd336a2ae", "comment": "Malware payload", "value": "b55744aae0b02269036f9c4d21a363fdc82409bbd3c462c8b2bc179574f64bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371987, "uuid": "9c7d092e-9f2b-46f2-aeec-6cf59ce4a294", "comment": "Malware payload", "value": "b26953598193f64ff858a04abbf7ec4979864976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777371987, "uuid": "de117f1d-9f31-4896-92a8-bbe1adaa0673", "comment": "Malware payload", "value": "4ea2a10b6b1ec67dc6f58cff6aae6a4b06a7de8a9e754b2d5909ff475246cec9a3ca62e6c01e64514ba9fb75bd221f98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371987, "uuid": "66c8075a-b3af-4002-bc25-0e28b768cbe9", "value": "T17454E801E20551B7EDD78F3C85730ED2DF3639027F50A88E134C2D6B5E6BEA7859AA81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371987, "uuid": "814abca9-a959-4583-af46-81ba38f91574", "value": "91757dd152f1f40c06d2b568f2fd94bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371987, "uuid": "00431d18-39e6-42ea-8a51-ad98cbb375cd", "value": "3072:RCYgNdy9H1FGkuU0DTPgjaiiZ6E3MJ4rywmmjNbplbo26XPbrj2v2XM5twD:6I51FGJdPgja1s8lpl77vDt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777371987, "uuid": "d2dd4762-3127-4434-b681-3718d2c970e1", "value": 292872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777371987, "uuid": "77775523-65b5-40e8-bc53-f9ec4e14ff2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777371987, "uuid": "37a33662-fea2-46b8-bec3-cd2b317b6f46", "value": "_1_b_5_b55744aae0b02269036f9c4d21a363fdc82409bbd3c462c8b2bc179574f64bbc.file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c03be16-433f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777407375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407375, "uuid": "8c0d3641-2db2-416a-991b-1c3a2bfad415", "comment": "Malware payload (AgentTesla)", "value": "2989791c2d303e78ec189f39b1251c6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407375, "uuid": "c84ba4ff-3288-4a35-8930-1dfd53f3881e", "comment": "Malware payload (AgentTesla)", "value": "b58f9968eaed4850c227db0e588b5386b2f237737807f7e4f1c375b01bd3d923", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407375, "uuid": "d2c7e902-0399-4b7a-83c1-97d53b412cee", "comment": "Malware payload (AgentTesla)", "value": "5dc7b6cb4ab960f6d45fd2607a5a840794c07680", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407375, "uuid": "b9844a4d-814f-4b1c-95c4-899947823d87", "comment": "Malware payload (AgentTesla)", "value": "4ed50718db1e8bdfd8bb9c1bfde75801588c05b4b671779f91b1dc062c05fba7531fe732f2e14e047817e7e9b20d4a06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407375, "uuid": "a621f4db-7c91-4f7e-a990-98344060ade8", "value": "T1BA252328E4C6EDDA5D2C325E816D9F6F49F10CA3481E2E4AEACD98F7474F0D24363A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407375, "uuid": "1bc0624a-04fe-43b7-8c85-6590997cdff7", "value": "12288:DHjBCzAPdyh7uyDk74zz7O3d5W5/3JlKUe70okjtsaKlAo7moHCYWhrBCzx89w:AzKdnqk47Y3o/3JBeA9KBBkBax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777407375, "uuid": "068b6882-3084-47ba-9ebd-799a0f408c03", "value": 967801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777407375, "uuid": "a0ef528f-fff0-4d93-b8ee-7b2ab4091d1d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407375, "uuid": "fe647cc2-2578-43c9-87c9-b9f128d5cd07", "value": "ps_IrOzYWoKxXse_1777395258665.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9357f26-4330-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777401304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401304, "uuid": "ba21074f-601c-4020-93e1-87acd49db143", "comment": "Malware payload", "value": "a60e434b5039b334e0170f7fe4474d57", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401304, "uuid": "8dc45c85-e41b-44f5-8b82-fc512b7de5ef", "comment": "Malware payload", "value": "b5c91ba1ef4b957a7f40b158e332cc3d898474ead304459d7665373534f89b06", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401304, "uuid": "ed112eb5-6b2e-4dbd-b095-7a39c1b85bff", "comment": "Malware payload", "value": "a344ad48c94a6f0ee9d65d19e2729608e04b1bf3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401304, "uuid": "d4688a94-7527-435a-a92d-329085ea20a0", "comment": "Malware payload", "value": "c29f8c02309c956950cc1aefea689a75d4db5d5a51afed84eebd672b7613f38e497b0e768fa05d729d357ce77a313d46", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401304, "uuid": "0f33d5e1-a515-4145-8e9d-efd5dce92121", "value": "T17C872217A2E61154D8BAD138CA6B9647FB723C06433066DF12A4B61A6F73BF01A7F314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401304, "uuid": "4cbdcb05-4c6c-46d8-99eb-c5c234e72f27", "value": "786432:kfBBz66DIpCRkxjRlKjP1UrZ21G7KulNNm:kfBF66iGkxCtyZ2E7KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777401304, "uuid": "20f771c4-9a97-4391-8ab3-a2ab2d05daf0", "value": 37085184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777401304, "uuid": "06722dfe-66d7-4014-9e7b-dcd5ffb5c8ac", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401304, "uuid": "69a8cd17-8f5c-4987-a573-049c56f4b2e4", "value": "LogMeInResolve_Unattended.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018c53df-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777377696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377696, "uuid": "bd0aa0e9-dd6a-49f9-ad79-303078e39f52", "comment": "Malware payload", "value": "df47fcaa4a77d184c30657d6ff61e54b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377696, "uuid": "d9ed4fb3-2faf-481e-b0d1-b0ffd854d967", "comment": "Malware payload", "value": "b5e51ddde4e9e443a2d057defe033ab3b63c6ca66b07675749ccdc53e2463ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377696, "uuid": "702871f6-a2e5-44c7-83de-3d9a12f4a87d", "comment": "Malware payload", "value": "8711a681a473115971111dfe8421d720bb052de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377696, "uuid": "0c8805dd-ae33-464d-8aa2-a8dad6eb0e53", "comment": "Malware payload", "value": "13289bd7b77972378e17d84627b1a768c307119c0702619068f76ce0b8a1b7be0dedbb0da68da779d8872ccd5e43f522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377696, "uuid": "f8b5fe0e-a265-41a4-bf1c-adf6f3534235", "value": "T1FEA3EA07F6A185E8C1ABD238D7EAF233EA20BC4D553477195F90CA226E24F50ED6E714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377696, "uuid": "78f7be9f-5dd3-4418-8a6c-38f16fa9eb6c", "value": "b3496bf9956b6a34fc57c12c3b9615d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377696, "uuid": "0ad2cd67-8792-4eb3-ae4a-35755989e93c", "value": "1536:BrYcWd0wrGTbe28/0lrs4shr5oPKDTHs7AsfM9I0E7iOJaDh9JS5K6HWBacw:BrYcergDchGqgM62GaDhS5K62Bacw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377696, "uuid": "9e113b7b-fe60-49ee-bf44-b0998230d8aa", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377696, "uuid": "ef0ffcf4-7ab4-4f57-99b2-e556062c8440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377696, "uuid": "b209a93a-7491-4531-8f05-05515aada333", "value": "Xceed.Wpf.Toolkit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1360dd-4336-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777403538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403538, "uuid": "2469dd06-df4c-42bd-81f4-f79efc4ff089", "comment": "Malware payload (ConnectWise)", "value": "fe6d7c7bf0cfe65c66cbd63d43b822a1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403538, "uuid": "00a377cc-41ab-4049-baba-475dd81b363f", "comment": "Malware payload (ConnectWise)", "value": "b71670e79f059d535a9b60974d34c8759e8d5db23206eed403bc826f5cdde0c9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403538, "uuid": "5cb68d4c-542b-4c8a-875c-f0bd1b75d8a7", "comment": "Malware payload (ConnectWise)", "value": "79faa83b00f297ebfcba6f86f3d352afb7026438", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403538, "uuid": "aa9af941-5603-4414-88fa-1ca9c760ea3e", "comment": "Malware payload (ConnectWise)", "value": "646be7adf73e5cc2a9faf39e0dcc68191e32ebafed1b0d0b52a2d2515ff3f23d9dc1a9efd3065a8985d543bd31016154", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403538, "uuid": "24c5b24d-60a9-4eda-9325-0a1b75342400", "value": "T1DB46E102B3D295B6D07F0678D87A56A96734BD049312CBFF5394BD692E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403538, "uuid": "57ede636-cc7b-4309-84bf-707a25899c06", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403538, "uuid": "9ac4e3f2-c4ef-4e1f-91af-857b46c101a9", "value": "98304:ZzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ZhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403538, "uuid": "f35bce46-12f7-43c3-b401-a9b38cc671ce", "value": 5708248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403538, "uuid": "27738b97-062b-4893-b440-58c00a614523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403538, "uuid": "ca1932ff-b893-48e7-b5c1-0b7727ef84ca", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2285798-42ec-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1777372086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372086, "uuid": "cdd15735-00a2-493c-af19-d45224cf9908", "comment": "Malware payload (ChromElevator)", "value": "960688e3484eb744cdbbee55a7415bd1", "object_relation": "md5", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372086, "uuid": "699b1b84-8fa9-46a9-8ad5-e823adb49829", "comment": "Malware payload (ChromElevator)", "value": "b7b322f4638ead5c39031ffc7ca8c791c8d47211b09449f7ceb49f0c32a19b45", "object_relation": "sha256", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372086, "uuid": "2f442012-001e-4d2b-811e-4bf93d4b5a59", "comment": "Malware payload (ChromElevator)", "value": "d48d1a4dfb6d015df1ee019ea70ec59137c4b948", "object_relation": "sha1", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372086, "uuid": "5bd6e63f-96c1-4e64-a539-822cf07bfab4", "comment": "Malware payload (ChromElevator)", "value": "7fa9d3d3027fb56427a4c6837b70a461ad178e377ec3908258c11d35ac234c1bf8797e8c5aed9902e28cb6d05cff7224", "object_relation": "sha3-384", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372086, "uuid": "808881be-0737-493b-b5fb-6e8da03f74e0", "value": "T17B65121757F500B9D2ABD274CD435D0ED672BC4A4BA0F68F17A40EA25F277A06A3E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372086, "uuid": "a2aa9b03-3f30-4258-b3d6-2c306df8870f", "value": "87400cf138de3db604008e702f107c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372086, "uuid": "ebf41556-af1f-408d-9ecc-377f6adb149e", "value": "24576:PApmA5EfyV89e1Cn9Gdo4DzUw4UKLmrK4LUKFVQxvzCu+gcSlnbSEN5:I0zfnCdPvLcIUKFVkeQvlnbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777372086, "uuid": "ddfb2463-15d3-4932-b025-533e9017e2c8", "value": 1462272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777372086, "uuid": "3cd307e5-10cf-49c9-96dd-bd8acb330582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372086, "uuid": "887bc327-dbfa-4a1a-a11d-c13a5d71f87b", "value": "chromelevator.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65459fe-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777377677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377677, "uuid": "686f9329-b195-4670-bd24-4aad3fb2ff1e", "comment": "Malware payload", "value": "ce95605458c4ef6e06cc049775a8c378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377677, "uuid": "464489b0-88e2-4ef6-a2ba-3eb8e5a80c63", "comment": "Malware payload", "value": "b7e1b810cf2212882fe3e2f799cccd55435ffd769063fb57a6507665215716a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377677, "uuid": "41a789e7-2d10-4d22-8d55-e2f898a2e2e5", "comment": "Malware payload", "value": "2dc22769c9549e970f24b9d252610ce2d39c0759", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377677, "uuid": "601c5bf5-bb3c-4214-8b57-b63cbfe7d9d4", "comment": "Malware payload", "value": "13467398682ebaf9b5d488142d84f39e8908677e6e9b3a60caa3ed56a19de98b57f79270893aa8404bd51d9e8a55164e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377677, "uuid": "92a7f93c-8b1e-456d-b53b-673c6d80af31", "value": "T1A383E707F6A180E9C1AED17887EEE673F620BC4C4239732A5FA5CA112F25B50BD6D315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377677, "uuid": "f2e0ae62-e9f7-450d-abbc-fbcaaf700267", "value": "055fd68e4a31ee65032b395a22bbe103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377677, "uuid": "5373a4b0-728f-487c-a808-9c1f5a629463", "value": "1536:cJbGtlCTn67wwo3qIGjS7UPQTtNU0xY90A5xwMLysGTMCrIQ:cJbGz7wMID4PQpY90A5xwMuP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377677, "uuid": "bbac4f6d-636b-4394-93c1-c12ebac7fdba", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377677, "uuid": "e5273bf4-8f61-40d8-a907-2a72e9d25c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377677, "uuid": "db82fdba-7302-45d7-b96f-97d2c12962c1", "value": "usb-g.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d284269-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364884, "uuid": "59962cdd-188d-43fe-9cba-7ec3eefb51c1", "comment": "Malware payload (Mirai)", "value": "a8621a58bff6c57644b089c5da19c0c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364884, "uuid": "8f44ab1f-6a99-401e-adb9-46a32ab5a1f1", "comment": "Malware payload (Mirai)", "value": "b817fcbcdcd9ccbf845cc43e53645ffe4322a4f2fea2d50a8d31e0828fae02c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364884, "uuid": "e566cae0-11d8-4167-8b2e-5fea8033fff9", "comment": "Malware payload (Mirai)", "value": "ecf331f4d1040dd61284f29e56c3e477a5971e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364884, "uuid": "96f5cf97-76cb-40be-9b29-3b23663d92d3", "comment": "Malware payload (Mirai)", "value": "af76982790c43a5af0ab8ac3ec4aa2e151a5db8f6a337f7a80d4f91f97acb68df26bfa3ed5e7462baadf41a9843432fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364884, "uuid": "8761222f-28af-485f-82a3-20aa0c580c15", "value": "T1E2633C22F9720C2BC5C4957A61E30735F2F7839A24BC8A173E610D8CBF65A5432677E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364884, "uuid": "a3b45ae6-352c-45bf-9c19-bb53eac0f6a5", "value": "768:kdL7UkFSfcbghmO+Nk5VIDPN4YPkvpJ0r/F7ex8tVNUimwdYr5a2tydmE3wI0h:YvUkFqONk562DJ0DFK8t52tyMEw7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364884, "uuid": "b4d0329c-4d55-401e-abd8-4c6ed0182b56", "value": 68628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364884, "uuid": "8929400a-4877-4125-b82d-789822d8b413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364884, "uuid": "dd1a3b4f-f53c-4589-831f-857caa3f6366", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8558be42-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355153, "uuid": "c083eac5-a5c9-455b-ad43-a623a446043f", "comment": "Malware payload", "value": "02ff40740181550b0f7e77f0f31ab6c3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355153, "uuid": "3887137d-c63f-41ad-8514-632da90ac4e3", "comment": "Malware payload", "value": "b92156e1e75ff5b534a0e9bf61406239a763fa7f167cf9f8aa4b47d0557fb60c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355153, "uuid": "bdcae879-82e8-4213-ae9a-235c947eff6f", "comment": "Malware payload", "value": "57a2a71430657b781dbf10f160c9b2fbdc8c9d78", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355153, "uuid": "35e61e31-5eec-4fbb-a223-5f2102bcf48f", "comment": "Malware payload", "value": "2cbed1f3574ae6d04c5a1dc1e5bdd439102b27c19c074065b560f4d014e4c13f0e3ef8daac8a3da1f3e12be5a9fdf8a2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355153, "uuid": "9876b7a4-5b19-4539-a249-2a7e17998997", "value": "T14837121DCF82496F41C9713865295ECF6F7D030898D9FE9ABA554C82234FB0BB0573AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355153, "uuid": "8e288a05-f953-40ee-974f-be0f7141c753", "value": "49152:Mas1tas14as1aas1has1Fas1/as17as1Fas1Yas11as1Das1Oas1Ias1das1TasM:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355153, "uuid": "16625cb8-3566-420b-95d1-a343725dcb43", "value": 23684330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355153, "uuid": "b3652fb8-248d-46a2-b406-6166c6a7fa76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355153, "uuid": "116fdc06-3391-4df9-afde-7e5e31818e2d", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc48a20-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777397768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397768, "uuid": "2456666b-96aa-44ac-a96b-6d4756ee613c", "comment": "Malware payload (Mirai)", "value": "ec2b1bc1b733e90a2aea59152f3c3e1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397768, "uuid": "be2388c1-04cc-4db1-8b49-e5cca0bb4d1f", "comment": "Malware payload (Mirai)", "value": "b992eda6201f4c997bc6b229905e2987a363c9ee0d93b17b31022c7a788fdcb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397768, "uuid": "7a01bc51-34a0-47a9-bad4-0a3f9bc39223", "comment": "Malware payload (Mirai)", "value": "ff846ce5702b474552d1253f6dd8154b53400a82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397768, "uuid": "02dfe290-5e5c-42b4-b3f1-d254c856fb1b", "comment": "Malware payload (Mirai)", "value": "7e5ee2271b40001dec1786d35f61b4888bd4329a1f397859044a7abfba1bf90d4623499d17ab7fa6be9c8e4992e3d346", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397768, "uuid": "0501ccad-4c38-431b-a892-c68f5449b04b", "value": "T166561897BDD24942C4E43A7BA8BE81C473630EB98B9752565D04FE3C3ABE1D90E38314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397768, "uuid": "439160cc-56aa-40ac-b71c-581cf35b8c48", "value": "49152:OcOkWfSqz2iKBlwmoTMbJs0VLXNO+wxdJE9ZgNc5EZ:lWKqz2iKBlt60kPJEPhEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397768, "uuid": "4bf15c9e-7bdc-4ad4-9612-55329f7291a9", "value": 5963938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397768, "uuid": "e6aa05da-5c8d-41a5-8f05-45f4f1a6e256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397768, "uuid": "238fb028-24a1-4625-abd7-1be6fbffebfe", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c71b034-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355085, "uuid": "7ec02b52-93b8-4d8e-9481-065208360101", "comment": "Malware payload", "value": "efc9ca3cea4acaf6c686ea6b0208991a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355085, "uuid": "cc7db298-1bed-4547-abcd-c169bd94b6b8", "comment": "Malware payload", "value": "ba3da1931e17a0c31a94c62e2933233c6742993011f9af8279811ecd20aaa1c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355085, "uuid": "0115f776-076b-425b-8d75-08a29a2dc29c", "comment": "Malware payload", "value": "55b02532ae0ec41210953409d604a99e4350bc2c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355085, "uuid": "6246d5e1-86f8-47e0-ae37-79f70693e57f", "comment": "Malware payload", "value": "905cc47f88858a31e095bb97a38fb8de8f54d32cdb4dc0403c02d150ae6412c456caf89555181cd7690c39df75edefd6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355085, "uuid": "3e6bcf2e-75c9-4050-9362-6a3ef3c6a755", "value": "T1633723A6750E4C2D4BB902115C6F2D5AEED2CE06C856B0B7D668F8DACC0F70255EB3D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355085, "uuid": "618053fc-9909-4a92-ba17-2f423cbc2046", "value": "49152:HyYiyYCyYzyYxyYwyYKyYKyYKyYNyYwyYEyYvuuyYZyY/yYGyYSyYluryYvyYxyt:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355085, "uuid": "ab806e20-8e17-407d-9ca6-f33163102ca9", "value": 23164078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355085, "uuid": "4c1e70b6-a9e0-4dca-b53e-559d1210d1b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355085, "uuid": "28e5141d-66af-4910-98ba-a21e91316bd8", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fca99a-42e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777369116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369116, "uuid": "d30ada25-142b-4ed8-a555-e3d106163cdf", "comment": "Malware payload", "value": "a27ff9af761982647ef383a5782652e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369116, "uuid": "5ac13577-b64d-4954-86cd-2dd932247e59", "comment": "Malware payload", "value": "ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369116, "uuid": "e89b4235-a054-4f20-8835-27c545969b63", "comment": "Malware payload", "value": "33b07fa13472c02fdbe0ed27ad57041fcc00114c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369116, "uuid": "02d931e8-8273-4b48-bb94-a9bdb056914c", "comment": "Malware payload", "value": "1f733a6f7b06326530f1be3f7069839efd31db8cd96a669966b1ad9bdbdc51cb37048633a8f0964eab017402e45d31a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369116, "uuid": "08becf66-2576-40d4-85d4-ff1239423203", "value": "T11D52DA19F70245F6C432A3F28047C93BB6709A88C1325D59BF7A592CFA3A551A83931D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369116, "uuid": "62017ee7-6b55-47fc-8da2-cfbeff94d488", "value": "2337ead6fd78ad2aae587aa37663d13c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369116, "uuid": "44296901-a272-4877-a66a-9d6d69c1a4f9", "value": "192:uA93DCq5XqqH3DSHscGJPYB7AP67HnY5y82w:tD9cc3DSM1Jm17HnGJ2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777369116, "uuid": "78a85cff-44b0-4804-9b5f-21cea136f88b", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777369116, "uuid": "34c2136c-b819-4ecd-8bf3-1b92f0d35ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369116, "uuid": "d9df7470-28ba-4877-a3f5-8628f5b5f099", "value": "victim.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fb6b63-4330-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777401278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401278, "uuid": "a3ba554b-78e4-49db-be98-3464610b842a", "comment": "Malware payload (ConnectWise)", "value": "5298d985f759f79f6632f694fa7f575a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401278, "uuid": "32c56493-0667-4220-9b7f-01d34b0640fd", "comment": "Malware payload (ConnectWise)", "value": "ba76a414a8c32b0579a41110731c6d5bb109a02450849d8bd8484ee6e855239c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401278, "uuid": "3ed84f74-6f68-4325-9991-14443f558ac3", "comment": "Malware payload (ConnectWise)", "value": "a2880b1afd65506fb6104c8739e9067a851e19d4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401278, "uuid": "7893fe3f-1c6b-45e1-9935-dd2e703ae259", "comment": "Malware payload (ConnectWise)", "value": "946566db79dd605ea8ad8d906301afa6bae98651652efd4147a03aad42ba732c6fba466947f07c8b42dfac01de61a7ca", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401278, "uuid": "14b01c85-155d-4485-ab99-3ba7ff20eb6c", "value": "T17AD6232523FD445AF8F75B78EE3682A45D32BE68DF21C11E9228790D2A74D4086733B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401278, "uuid": "ceca81b4-01a1-4b34-ad66-e1380a33c702", "value": "196608:8Wh0cGwrWh0cGdWh0cGhWh0cGyWh0cGoWh0cGhWh0cG:8WactWacAWacGWacZWac9WacyWac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777401278, "uuid": "c70e1094-cc17-4dd9-8a10-83da66c059e4", "value": 13467648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777401278, "uuid": "827e1459-0740-4bb6-87b4-76021dc16727", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401278, "uuid": "9d416419-9686-4f81-b2c5-942222b48910", "value": "tempertt.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21acdc6b-42d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777363576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777363576, "uuid": "eb99790e-f1dd-4338-8fa6-bde9233f5bf0", "comment": "Malware payload (Mirai)", "value": "504d99f59eb81dbcba97e6d257be4aa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777363576, "uuid": "7fdc4775-0551-4c16-9383-47a61fc25624", "comment": "Malware payload (Mirai)", "value": "ba8cd37289880dac0947ebba0a0fa6e168390131e9abfc0dad4fe24c2dcd8e94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777363576, "uuid": "edb96bec-0200-4623-93e8-e69d88c8f682", "comment": "Malware payload (Mirai)", "value": "eea69c536c1ff5b199dd4437aba0daa7c5adf423", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777363576, "uuid": "a7a3f729-4e3d-4f59-91c9-05d338388689", "comment": "Malware payload (Mirai)", "value": "4ca7c1e107b3c0dec1aed9a9850f1878c582cb047bdd981fec63bce4e7928e054da771da75bfd86eab5e156884ecbfbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777363576, "uuid": "8b688c9d-70a8-401a-a1dc-f9008e94008d", "value": "T16D532995FD414B12C6C165BBFF5E428C772B036CE2FA3203AA295F203B8B55A0E3B155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777363576, "uuid": "71380bea-3c6a-488f-bab2-b47294822120", "value": "1536:ntmH9dtPC0OhdCX6bKp3boJsTXKAvvcaTb:ntmH1PA7KJ6WD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777363576, "uuid": "705119be-abd0-4dd8-bff1-660624729bcd", "value": 64068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777363576, "uuid": "c349f657-c4eb-4103-9c1d-aaebfe69fdda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777363576, "uuid": "80da82e0-b4ca-429d-848e-0b74c8231479", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb692a04-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777397764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397764, "uuid": "b904d98d-0ad3-4d09-995a-5282fc393e26", "comment": "Malware payload (Mirai)", "value": "ea9b5bc3df62074c5fe0c1676b28b120", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397764, "uuid": "8b90ace9-19d2-4762-8a29-c66d11300151", "comment": "Malware payload (Mirai)", "value": "bb60057040e8f569e60a4655fc8dc59810d9bd5449bbbb45bb929cc447acbddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397764, "uuid": "43730cb4-dfc7-431c-a22b-2317759d887f", "comment": "Malware payload (Mirai)", "value": "8ff70bf6301f73990c63d62ca228cb760882e16e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397764, "uuid": "77cb01f9-6168-4275-a43c-97bf0946bde4", "comment": "Malware payload (Mirai)", "value": "7ee4626da4d908bdf2227c5df0618b2895e7bfec44966dbf79a6a6849dd8e7b597f797390267bf1c0b420a9f3779d9db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397764, "uuid": "c00a4a81-ae5c-4ebe-8877-ffc52180f912", "value": "T109561897B9D25942C4E43A77A8BE80C433630EBA9BD756565D04FE383EBE1D90E38314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397764, "uuid": "ff5dd18d-c975-42e2-b392-7959b3d06dde", "value": "49152:KAcZwQjUBf7yYX3g3SPdzOwzEJfKizkhO/uWsq5Ef:BQoBfDX4SPdJzv+khUtEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397764, "uuid": "d885d008-d93d-43f9-945a-2f9f4b2287de", "value": 6029474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397764, "uuid": "b042c122-3396-4ffa-aeaf-728d8390845b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397764, "uuid": "c979f048-d933-4cbd-98cf-803888711c24", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9fbe7b-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355437, "uuid": "5adefc1c-626b-44a6-bda6-5f08c1b51b34", "comment": "Malware payload", "value": "a36bc73e3cd92b71ff3cef6b443b367c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355437, "uuid": "b0142e97-8c28-4f20-8be6-dca427941f2a", "comment": "Malware payload", "value": "bbde505786363a7dc5ed2004c5b8f3446403749c675dc9406f1780786fc1807b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355437, "uuid": "46818fc4-0398-48c5-acf3-f06bafa4eb80", "comment": "Malware payload", "value": "0418fbeed27a782c3bcc576529d4e0f815912446", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355437, "uuid": "c480716e-be6b-49cc-af50-a9c9df0e2c65", "comment": "Malware payload", "value": "3b0cdee0656f472978394ecca3202113960dca3e2d1541ae188a36d1fce2138d00bac47cd5bb2c1172786180085a7278", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355437, "uuid": "ef81a468-139d-4289-8133-1686b54339f5", "value": "T16637234A48FE8E5A0F6811BD04FF0F9B23211E9EC49EB4D3D9D57995A3A972C207B05C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355437, "uuid": "faecce87-ee41-4d69-91b8-8b9f863f579d", "value": "49152:0QyWeuQyWeNQyWeHQyWemQyWe2QyWewQyWeJQyWeBQyWe5QyWeDQyWejQyWegYit:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355437, "uuid": "33cb85d3-80c9-4fe0-8ff8-3b3be7e89e44", "value": 24204594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355437, "uuid": "44eb048d-5606-45af-bac4-be7143f21765", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355437, "uuid": "3fd1e5c8-8a9f-4aa1-b126-2aa9ea4255f4", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a85552-42df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777366462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366462, "uuid": "ce498155-0ea3-4e8b-bc48-f14989de9631", "comment": "Malware payload", "value": "11a47bd05bdb1ea90185cc9375c5fe27", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366462, "uuid": "362d531b-429d-44b9-8181-47525ef6ef30", "comment": "Malware payload", "value": "bcab02bd83c49edfee7249004d810a9743b2d904a4d87d451e72225ba8bed34c", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366462, "uuid": "0eb6e2db-500d-403b-b6ba-654ca4cf09ed", "comment": "Malware payload", "value": "199adb7e55f934bc5837ba3fd0ac7eece48a5f31", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366462, "uuid": "6b56119d-4723-4681-99fd-c2e0d9cbd3b7", "comment": "Malware payload", "value": "38f3f2cd9b61b511a89d065a3401079da0c9e07bb7f879054dd13e9275a891e636f8a2b902c83800215a654296b229b5", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366462, "uuid": "ef38b92e-4290-4d94-a243-65a14c68c008", "value": "T15CA53341A16ED4976336D30452F2E67306A47A1ABABDD3EF8057D829934A0FE83DFC50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366462, "uuid": "d8edb0b2-c6f0-4e52-bc2b-565106d44348", "value": "49152:65x/231wB1XbT5yMS7xhd7BmH1coipwkP6wFcccMGnCUr:85i1aLT4MYb78VygwOjnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777366462, "uuid": "ed1b728f-5e99-49be-9bd3-f49ad8ed7cef", "value": 2108893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777366462, "uuid": "e02bb352-b1bc-48eb-b5bd-cbc8e7d39fd4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366462, "uuid": "616712aa-a16f-49bd-aa89-e403acfee157", "value": "dc48e9536d9744c1330679d9f02c93df245875387d5352327af3f5e1ded0eb9a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359466e9-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1777400546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400546, "uuid": "c01fb02f-258c-40f5-b1ec-d5b083af1bed", "comment": "Malware payload (DattoRMM)", "value": "3fba451e9603cb436a90213ee8dc63e1", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400546, "uuid": "92eaa09f-e080-4c38-8004-bf40a0c005a2", "comment": "Malware payload (DattoRMM)", "value": "bdc788432e272325d71022c3827929b5816c1674617327e49e11f0558d4daf92", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400546, "uuid": "42db5617-6d40-43e3-ade2-dfa552ce618b", "comment": "Malware payload (DattoRMM)", "value": "a5f56eb066465b069a63fbb1ee8e4d8f10cbb07b", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400546, "uuid": "bf89aafb-f835-443b-9722-eeb8cd8598d0", "comment": "Malware payload (DattoRMM)", "value": "a11398b842d36d80f5d9730f107167f5801da1d9a04384a951798f07b56941163234533f6f1053583e751c699d9e0d75", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400546, "uuid": "09644c24-98af-483d-8671-9419022e7474", "value": "T159B63347DE3BCEF4CB63463C89831A57124F598E8C47E4C9E0081A3589E799ADE38F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400546, "uuid": "84476bcc-e1a6-45fd-88ee-b77ea6d44a77", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400546, "uuid": "5fcb7ce4-ee5e-4606-ba87-ffff2dcd5bec", "value": "196608:2aZk+wMbLGmnYZJukGkxGB8rM2VPFOsti7A95vM9sFp29XaIT030HyyG+zzDa:kn2nkGkx08rtE7AnMGp29qIT0Wz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400546, "uuid": "68159b7c-4ce4-44a5-a8c7-92589cee9848", "value": 11055536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400546, "uuid": "fffaea2b-2864-466b-a85e-ba7d311bb032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400546, "uuid": "3e80d411-ac4d-4ce9-bec1-9f54084d0608", "value": "Vip_Party_Entry_Access_Pass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e6c982-4340-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777408081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408081, "uuid": "af67bb6f-d1bc-4d9f-884a-288c0fa4f7dc", "comment": "Malware payload (Mirai)", "value": "0024b10c17ee655d4a3bff52a35d8be8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408081, "uuid": "8bfaa183-d55d-4d53-a57d-6f0837f854eb", "comment": "Malware payload (Mirai)", "value": "be29498560c7df27cc643e4c5eca3098afa2e3c7ceee0a34e00e130ebbcda824", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408081, "uuid": "4631b4fc-e80c-4920-b61c-fcdf1ed18365", "comment": "Malware payload (Mirai)", "value": "6d148783678292c98dbb70b68f0aa0a0b56c9129", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777408081, "uuid": "c030f8a2-848b-4085-b022-c17671088d9e", "comment": "Malware payload (Mirai)", "value": "b0b25e89ff3aa467769ed0d95a0e508a9c8786df5b859119f1a252b2d90d523db6dc251303c905f36cf9eb2d8903d0b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408081, "uuid": "405c0780-3545-47ed-aecf-f5ce4ea76093", "value": "T1B5535C1BA58180FCC19DC2B80B66763FE97372FD0239F2BA97D4EA365D45D204E6E508", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408081, "uuid": "309fdd35-7a88-4c85-973b-ac19ca1988c2", "value": "1536:Jovs7uPHD1KdSIYTeOrBq8aUEwN1a6z5xFR:+vs7uL1KlYTZBbMwNFz5DR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777408081, "uuid": "f817fd75-1e99-499f-b5de-82421b4b5aaf", "value": 65296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777408081, "uuid": "07268b7a-eb34-459d-a189-093bbe6b76e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777408081, "uuid": "0289ee03-c6c2-4e53-9dfd-e1e590cdaa5d", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0a3ece-42e7-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777369549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369549, "uuid": "37af3a09-392d-48c2-87eb-fe575e3da32a", "comment": "Malware payload (a310Logger)", "value": "9deec771d20e17b83a61edfa4f63a540", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369549, "uuid": "92ed882b-64f7-4967-8e13-2130c4eb3573", "comment": "Malware payload (a310Logger)", "value": "be58ab597d111ad841b62d98a0ce2baf5f10000138fdc14b3a8209cf9065e3a1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369549, "uuid": "fd29b528-eb87-42e8-b2e9-2f0e56e66f15", "comment": "Malware payload (a310Logger)", "value": "de767cb61b80c61766b161fcd8b8f9f16942ab5f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369549, "uuid": "0cd377c0-2ac8-4f8e-90c9-1c5f62f16138", "comment": "Malware payload (a310Logger)", "value": "0359c3ecbfac6ef1e91a724aa192c70af3da7e0873fb57d2bba7d0c2b5ee8d87d1e8268d6cef82b6d2f696ef31ab178b", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369549, "uuid": "95cf0f14-27ad-4152-a895-31ff030670ef", "value": "T12A3522A1B958E556E8931BF50A32E2B902F50F4DA421C397DEEDFCF7F81827245442D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369549, "uuid": "299df73e-e116-4882-809f-93c06289b967", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369549, "uuid": "51f30423-f1a2-49f3-8f55-f74e4d1a924d", "value": "24576:OtXVsGYwYzsrtpRZHM8MEjOdkaKGr2n/c0EgndLepfh4ZAbO:0X/YO5RMEqWaKE2ggndLe1h4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777369549, "uuid": "eed77260-5880-4b00-a12c-3f8dfc577438", "value": 1156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777369549, "uuid": "3d64000f-eacd-491b-8bea-931a2aea0171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369549, "uuid": "eeceac08-2147-48e0-891b-e7b166c06537", "value": "T. HALK BANKASI A.S,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adb5f98-42e6-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777369363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369363, "uuid": "4defa7f0-fba4-4c4a-a9d5-2336b12799a8", "comment": "Malware payload (WeedHack)", "value": "a756def808145225eb82edcca466187e", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369363, "uuid": "7bc34d3d-0239-47f8-8b9c-f3185f97a005", "comment": "Malware payload (WeedHack)", "value": "be898896bd5e0e8fe99885e255cc5484ded97265669485f9ef0498ca829d1cec", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369363, "uuid": "45d696fd-cdc7-485c-b9c7-c9b08e2efd54", "comment": "Malware payload (WeedHack)", "value": "d47dfba604995b43395a60d2cd3335198b0143da", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777369363, "uuid": "5b89e1a9-ea90-4616-9d26-76966132b2e8", "comment": "Malware payload (WeedHack)", "value": "b79c3913fbe1790f410e1dcffb9244fc82c0a7f5f535f1f7466d8c4a257d3be26a94d279a95db09b5e93fdc8dc589d06", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369363, "uuid": "44eab8ad-fac5-4bb6-8bf4-55177f94b4bf", "value": "T1FF34CEA604F9357DBFDD4934B73A40E852EC8806AD744F5A9C01F881662B73D26FB18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369363, "uuid": "120c40cb-410b-4833-90b3-4971ca63c06d", "value": "6144:bHxktl5lNXlEMsBkUK1pownvPo1zXZAHXVmCl4I3d:Nktl/NXlQBkUK1DvgdXZA3VmE4It", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777369363, "uuid": "181a6a98-4c74-4f78-b49d-4110af509d04", "value": 245111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777369363, "uuid": "a9d75b66-7643-4816-a0cc-d6e46c2402f8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777369363, "uuid": "a55b9b72-2105-42f2-b114-0e8fb4a80174", "value": "New_Contract_Agreement.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ee57b8-4349-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1777411712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411712, "uuid": "c6dfaf9b-f6c9-4356-8fda-61c71cd8624a", "comment": "Malware payload (Gh0stRAT)", "value": "cd4295cfe1bea19874947f5bb2921165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411712, "uuid": "e9b45a22-4099-4ff7-a78e-0c64964f6cea", "comment": "Malware payload (Gh0stRAT)", "value": "bf3328f7f04d8c1bb4ba499e4e9d867d35115dfd1908258817dc604e751ad870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411712, "uuid": "f8d99212-ab6f-4247-b150-8f6f7a856651", "comment": "Malware payload (Gh0stRAT)", "value": "a9ee4fe7b45ea705e5716111e83c58954a5e928d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411712, "uuid": "6d062294-02ad-48ff-9a5a-3e1701d61138", "comment": "Malware payload (Gh0stRAT)", "value": "582620b16bbb2c2673e4d3a4eda02a21412e89914888ee36fda4ffdbcf171f7668c90b15737796edfd85e49d5c40e271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411712, "uuid": "1f7b740e-0863-4c1e-b3f6-921977e07bae", "value": "T158973323B1C7A03FF27A4A318E72E127563BBB5598038C2296F45DACCE295D52D3F605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411712, "uuid": "5274875d-e797-49a7-9b03-009afcca3cd6", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411712, "uuid": "e59020fc-aeb4-4aa2-bfb6-fc3d77a3b27b", "value": "786432:BF+UgkKJ0SoyphnC3N+/6HY4sqPeW5Ldr8qNbM1G4YGu6cOoDyQRO:BFgeSoyphnC3A644sqGULR8qNbME4Phf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777411712, "uuid": "c192ef9c-143d-45be-bb86-e38e45fdc851", "value": 40439577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777411712, "uuid": "0b2101b4-c0a2-47bf-9446-cecbee83c01c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411712, "uuid": "8eb98248-c70a-4704-840b-ca4f6f6cda93", "value": "Clash.Verge_2.4.4_x64-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47104be-4302-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777381405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777381405, "uuid": "a6206068-7cd4-4015-a0f3-b9cff092f5e1", "comment": "Malware payload", "value": "1619766281a43dd0714dcd15c9301ba1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777381405, "uuid": "03184b05-fec9-44c5-8eb7-89468c97672e", "comment": "Malware payload", "value": "c0055200e9d12fe761f2a00ec1abd04a30ca56ead58af82825474c1490df649e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777381405, "uuid": "5477cb7c-4b19-4891-a43a-f5014f8c9af5", "comment": "Malware payload", "value": "743d3a0142a48dd3b1b7803b6763f5523109252f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777381405, "uuid": "a31a6182-131a-427c-8fc0-9de41b877141", "comment": "Malware payload", "value": "d49d21544e0309b21de7b58cd7ac1d7659a87007fb7b25e0bc1f17c5e951c5b3e48df86c9429d18f326be29fb52050c0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777381405, "uuid": "f43c1333-8ba8-41d7-a1ea-d0b048dd96db", "value": "T11222B6F58A35B52F233481E67F8D449C6585F082A11CAE61FE4C7768835BAB181B374F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777381405, "uuid": "86f12e09-bd15-49c8-b91c-1ee31c3c2025", "value": "96:OiZU0UAyFtxpC5SrlsNwDrLVx0u/2uZUJ94GVjPvPwaE06QWAlsg0LGNGi88ePI2:06fJiGmgy8eP5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777381405, "uuid": "120d90bb-a101-4838-9cd8-c996e07f58c9", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777381405, "uuid": "cea4b7d8-ef77-4d71-98b7-9cccc1262132", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777381405, "uuid": "2e82de03-d0b9-4bd7-b2d8-75d817295f5a", "value": "0bc3281d-cae9-4222-b6f1-ec48b412.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4401b008-4297-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777335287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335287, "uuid": "163eac2b-4b21-4339-a390-d82c7418270d", "comment": "Malware payload (Mirai)", "value": "74f412a57ae3c999b869a0848974aab9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335287, "uuid": "3a84fb77-9dc3-460b-8648-95da2db256f6", "comment": "Malware payload (Mirai)", "value": "c034532d23f1ab8a87cd0b60c1f416d3098d2f1d98ec845833a1b67729c488c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335287, "uuid": "b0ef7c62-d16b-4204-aecc-03110b1eb6d2", "comment": "Malware payload (Mirai)", "value": "78092d72be2659c79bdf7ae158dc85945436976c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335287, "uuid": "5ef483c2-8e61-4b14-8078-b4f00882c70a", "comment": "Malware payload (Mirai)", "value": "aeb3d1b805d431f2bbe280883a0b9ea405f447c83ddc55b6abbac910011875e12e71be18ad67a3bda03f41559d31ba32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335287, "uuid": "9f0e3822-51de-4733-aa0a-dd726456f9f3", "value": "T133142A46EB408B13C0D72B79FBDB42453323AB54A3E773059928AFB43F867A94F26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335287, "uuid": "ab7ce348-7cef-4120-888e-e7f197e50839", "value": "3072:RvWSEHSgmi04ZK2qhDasVMoG+cy7e5P/3ZfovM/R/18V8Q9o4f:tdEHS34ZVcDasVMoT45P/JAvM/RqV8QZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777335287, "uuid": "540a517b-ce2c-45fd-80ff-6ecd5ac4b90c", "value": 196122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777335287, "uuid": "be8c0bcf-b832-478d-98d7-5c2a6abab1df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335287, "uuid": "5444af97-ada4-46ad-8c0e-24d55deb2d4f", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b163730-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777377712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377712, "uuid": "6246a04c-ff02-4720-90d4-55243d446e88", "comment": "Malware payload (MassLogger)", "value": "56a83e00ae83b634b311666912e28841", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377712, "uuid": "94c439fe-8ed5-425b-a6ea-4d3fa9f7b1ba", "comment": "Malware payload (MassLogger)", "value": "c034fa4ac7eaf0c73ba93467c438f3020c757314053bc5cb86f1dc27d9601743", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377712, "uuid": "1b7e6d56-c7a3-404a-aeaf-46b44fe0b51c", "comment": "Malware payload (MassLogger)", "value": "0065ba88dc33ba8d15f0846cbc5225376579df54", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377712, "uuid": "97bb9154-2d1f-4728-a793-972a50d5ec99", "comment": "Malware payload (MassLogger)", "value": "7672c7c92362c80ad86b5a182e0f97dfb45d8d21f1efc64d3e5351e27b9b068564163660baf4fb5dadb8d47dd93ab255", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377712, "uuid": "7d49e891-2bb1-4ee6-8197-3c3de3f806c7", "value": "T1C23533715F56BE90404D63BEE02F9E5D4144BD9BE80482ABFE4421EBD38F74ADB23809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377712, "uuid": "0210c56a-bd4c-4768-8a92-e8273d3da925", "value": "24576:TmLz6gWegJ+zMHsesA1VPyCAap3eJptxea8/yVmylYE:KnWLx18CFWk/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377712, "uuid": "3f7e533e-5b9a-475c-81a0-e26bc08c9302", "value": 1114636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377712, "uuid": "d912afc7-0bff-44c2-966c-a93fb202a551", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377712, "uuid": "64ceb05f-31e5-4a13-bd50-05c7821c4170", "value": "ps_dx5iUYdJE1ZC_1777360141717.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b759cb46-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355237, "uuid": "af15ffe3-67ad-43a8-b257-898ab7ddc63d", "comment": "Malware payload", "value": "a3e30c61dc0c60faa18372845a9ada72", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355237, "uuid": "e07c8692-1cab-45b4-a098-a80c1ee0d864", "comment": "Malware payload", "value": "c0903de5c207748928f59c806325a40f9ae838935981e4d26d87b23ee5a50d8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355237, "uuid": "f1ae4018-b6bc-43e7-9b67-51061884a0bb", "comment": "Malware payload", "value": "1c50af03204dcc979244e862632c7bc57034b686", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355237, "uuid": "99b93b37-3214-425d-98a4-d8e1bca2c410", "comment": "Malware payload", "value": "baf346f8abfaf6b87cb55f180077bfa54e345e694f7dfe55ef186c68609b29f32c63d2627d673f08d82d2e16e54ebdd1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355237, "uuid": "8840c1bf-99a2-4d41-bebe-c1b150c04572", "value": "T1CB3723C14E7E98FE45FFA01064BA130E73D54C90510DAF73C29E66E9AD52838A1EB877", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355237, "uuid": "dac1c78a-9bfd-4b89-a2d7-7262170df70c", "value": "49152:cNGgnJuNGgnJ/NGgnJXNGgnJRNGgnJ8NGgnJCNGgnJLNGgnJuNGgnJJNGgnJVNG5:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355237, "uuid": "6af6ee45-b2f8-470b-a02b-36c042266bfb", "value": 23684322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355237, "uuid": "ab81ba7e-8012-4295-b46b-9bb96576da85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355237, "uuid": "44f0a247-b712-482b-8d9b-5d2f4a9814c2", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482a8ca0-430b-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777385115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385115, "uuid": "b7653e78-07c2-425a-bbc6-df0c6e0fb29b", "comment": "Malware payload (njrat)", "value": "c93b17c3aa34cd3a7ac01a5ff575429f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385115, "uuid": "10e82368-a9f5-430b-839c-9068595a8cee", "comment": "Malware payload (njrat)", "value": "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385115, "uuid": "7ffdfc6e-1c1a-4d66-a3fc-f366465585d2", "comment": "Malware payload (njrat)", "value": "7dd0bec3f6522b0bea745b1ead5ba7df208d1a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385115, "uuid": "8a71c19f-6c1d-41d0-9474-fc4e1e4ff317", "comment": "Malware payload (njrat)", "value": "c88ff2eb42b54ca03aec03bbb333af8d94ed6352c13b46f2bcae46703a7b9d514c2d059074e8c0217de5501ce7c57060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385115, "uuid": "28b2873b-a4bd-4a1e-b9ca-d63f32166f45", "value": "T19B93E84977E56564E0BF56F79471F2004E34B48B1602E39D48F219AB1A33AC48F89FEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385115, "uuid": "b2d1cd7e-54a0-43d8-8195-fea90e13464f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385115, "uuid": "73f78684-0a76-429d-a10d-2d701bdc346f", "value": "1536:7U4FQWqkqqoLc2m+iIjEwzGi1dDzDWgS:7U4mkqqoA2xi5i1dj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777385115, "uuid": "28ad2145-e258-4d25-b9b1-9f9b3478b4ff", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777385115, "uuid": "ad230a87-1367-4173-a8c2-c80b2cccdb97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385115, "uuid": "d24f0e5e-e544-419f-9f4c-a64d99d8d803", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef044403-4331-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777401716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401716, "uuid": "18826a6e-f6da-41ca-8660-eb6ee7f90f59", "comment": "Malware payload", "value": "949a23ce078c8e8b4f1b0f146cbdad26", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401716, "uuid": "4670e72f-ccf1-4805-a032-35f2d1ea258d", "comment": "Malware payload", "value": "c11fd7a0552e102bda71ae2e4e8c172f9565d67b8b097492ee3220ab6a7006eb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401716, "uuid": "88dcd72c-fa1b-44a2-b7ec-107a642e7e84", "comment": "Malware payload", "value": "03485f1515f975bcb3209c80f0e7cbc66df63eb3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777401716, "uuid": "b2a5d0c5-fed2-4a68-a540-a949c94463a0", "comment": "Malware payload", "value": "1bc9deacf57c3581f37a7a56c6cab2072140cfeda6257cd1bf98c29f525330ce8c179ffb71b4102858ee992eb4024326", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401716, "uuid": "4c2e83b1-d25c-48c6-8eab-21a19a3af1b5", "value": "T1ECF60267D748A12EE0280D76FD31E5BC503FA66F791A480AB0F51D6CCB2B5627D2E243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401716, "uuid": "1ba8b48b-08ec-4715-80d4-14ffed3c36d4", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401716, "uuid": "24614f55-e188-4b88-9889-da85a8662ea5", "value": "98304:EL8Ncwa6AEouGQGLDyR94UhsqwScBY4JSE2L6zBVc:vL8EQlnycUhYSZ4T2L6zBVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777401716, "uuid": "be5ffaf0-dc92-4c0d-9765-817255725347", "value": 15290987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777401716, "uuid": "5b6602fc-7b78-49c0-88ee-7783822483b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777401716, "uuid": "843d1d30-c3e8-4c1f-8644-cac9a067e358", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594c4db9-42db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364528, "uuid": "7372107c-ca11-42a8-aa36-94c5681971c7", "comment": "Malware payload (Mirai)", "value": "9d1a1cc9f54ae31b72f9d1a9752c9e56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364528, "uuid": "3ca1422a-6ffa-4fba-8319-a2f9edd01c0e", "comment": "Malware payload (Mirai)", "value": "c16cb63fd128e507f7ddb58f33cc288942d60746a136d42f8e6b0759c32d36f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364528, "uuid": "522fa196-12d1-42f2-83e2-dd806f9576f8", "comment": "Malware payload (Mirai)", "value": "e98f729949e8e07f2fb6c5eed669cd2b0d01c982", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364528, "uuid": "5f15860a-0f2e-4a4e-8a45-6ab071b9ca93", "comment": "Malware payload (Mirai)", "value": "a8f38e7f9b2eb7af06a0a946a2f0fd5d7d1e45b8bf5308299fef4a780f9257fb1cfae322b9d7cfd83a0cb8e1d8f010eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364528, "uuid": "36222eb3-05dd-4b8b-8e91-6751b004ccb8", "value": "T1B0931C46B9528E12C5C212BEFAAF415D33136F78D3EE7212DD20AFA063865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364528, "uuid": "81f9b313-1703-4f52-905c-c6b9e51ab6b1", "value": "1536:Hkn5RjhCMsR8l3EV2pOFnLRfGqtCMu/5ByHXyYo0GvVahCncMaaQTiroBfH5VzMx:utCJ8qV2pOFnlfGqtCV54HCWGvVahAoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364528, "uuid": "9275af8f-4ec5-4959-8c93-9a0465d6625e", "value": 96848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364528, "uuid": "025fb655-eb34-4cb8-8b89-26a0434cd986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364528, "uuid": "70edfc61-26c1-4993-b6ec-c5b6785b3c20", "value": "SecuriteInfo.com.Linux.Mirai.9838.235.15369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f27dad-42c7-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777355859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355859, "uuid": "027404b0-bd92-41da-8400-a48ae8e40c86", "comment": "Malware payload (AgentTesla)", "value": "45c19f0d674753dab4e16ef2a800613f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355859, "uuid": "0caebba8-542c-4a7f-9eda-0867596c5c1b", "comment": "Malware payload (AgentTesla)", "value": "c1809985bc96ceb090d1627981130698f934d033f8c45b49d8f07326ff11ab73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355859, "uuid": "199fe7ff-6919-42be-af70-b6955dbf9009", "comment": "Malware payload (AgentTesla)", "value": "f57af3a30776ee693429ee4efc0558e0d4e45ae5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355859, "uuid": "4d089287-9a32-4849-abbc-e7782cdd1c14", "comment": "Malware payload (AgentTesla)", "value": "7c53c40b13841cf330076f2aa05dda80bdaac0435224a2077c7d0914b2d4c4896273c5d8227569d00b0ccb1e2ad36525", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355859, "uuid": "f6c28a81-bb71-4359-8b53-65aab847c58d", "value": "T195F412F25A58E663D48227744F71D3B503E94E2DE450D36BD6DEFCEBB40529068283E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355859, "uuid": "8d65e60a-b936-43f6-8c41-b749a652ecf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355859, "uuid": "83bc7825-c698-4aa0-8bb5-9a12d2146596", "value": "12288:TZ5nRd/fwodnjtj0ywcd2zHFxJgpxXYtuspQPhLx9eiSi9SlMP:TRdg8n1gcd2rF4DyuVPz9eDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355859, "uuid": "db099894-d43b-4010-9c8a-a1fcc758b2e8", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355859, "uuid": "28fc77f1-f443-453f-aaf1-c058cb513b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355859, "uuid": "c6c1cb66-ef8e-405a-a5fa-ee7c6285f900", "value": "PO NO. POD00000917 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ccab99-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355231, "uuid": "802fbb88-9907-404f-9f0c-8a7610a885b6", "comment": "Malware payload", "value": "1653375418c408db239a2e27a6d7e6d2", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355231, "uuid": "243416cc-1872-48b8-948b-f5d6f269ef00", "comment": "Malware payload", "value": "c1bd146f5fd32d0d47d867cedd93132e9ed890982eac2e484b883e8d35c81952", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355231, "uuid": "ec78f091-3f91-4c40-8342-1062b7a5e05d", "comment": "Malware payload", "value": "313e63bf599ff5393ecf70628c0a07db0ff7a6f1", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355231, "uuid": "3b12e41f-6f3d-402e-901e-32804a902afc", "comment": "Malware payload", "value": "ae8091338bb598db289fb93ff1a64e42a45077d758a7f3b2fc02cc559a2c8da7bff26c807420331674852b5445fa9bfe", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355231, "uuid": "d4005d78-3083-4f5b-8073-f272772ce881", "value": "T1102523167109DF62EA538DB894FBC1F1A714FE294E0156ABA740BB5EE97CBF000D219C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355231, "uuid": "7e1cf449-b85c-4e80-ab2a-48001ebaaec3", "value": "24576:sPA5tM4//A28SQ+bwYT1pefVcZua/FKrv9Ajh4xSqoFerI:86McX8WwYT1bZ3kr2jEGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355231, "uuid": "94b24d4f-3ae6-4320-980c-366860c36fc1", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355231, "uuid": "357cc006-4f8b-4a83-b9de-7e3197683473", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355231, "uuid": "bad75f89-93c1-40e7-a5af-95dfe503ef1a", "value": "FORM.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650b4289-42db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364548, "uuid": "ef06bf34-94a6-444f-b8b5-bcaa4b404548", "comment": "Malware payload (Mirai)", "value": "8c4d3139c9e069ed4a8734fb489f8e26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364548, "uuid": "10f15fc0-9f54-4e45-8c91-896838687f17", "comment": "Malware payload (Mirai)", "value": "c1c4af6bbef4c3851231dfc513a58d13a06f031e84d03935b557199c77ac73b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364548, "uuid": "f704f9eb-e4d6-4ab8-b96f-1bd45f7abd5c", "comment": "Malware payload (Mirai)", "value": "17e7b7d16f803fd7d15da329940655fe43fe9818", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364548, "uuid": "3400e59a-4184-468d-b738-81459456b2d0", "comment": "Malware payload (Mirai)", "value": "6261a35cac2d0a0eeb57253bfb784ca74b9736dd25c6b1ad7fafda992d87a23be92c4c48ca2ea5f564c3628701d7ab11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364548, "uuid": "15cd1a0f-3594-4e83-a9c0-f4b3b23493d7", "value": "T18593E842BD429F13C1C621FBF7AF059D3B166B79D6EB3202D921BF9023868DB0D66251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364548, "uuid": "cb771895-37a1-42b7-8656-54a019d5e9fd", "value": "1536:4V4F+8wMvh/zTjmCon3rqMGbUCiqeivkQmnr0DgI8YdxMUpIOxa:4VSUujmCon3rql4dgk7nr0nM6xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364548, "uuid": "2ce1b3dc-472b-483e-9ed6-2366bc17a5d6", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364548, "uuid": "462bdee6-faf1-429b-a652-96b0ffb343c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364548, "uuid": "cfde6756-99aa-4b8e-a16f-9a49765d964d", "value": "SecuriteInfo.com.Linux.Mirai.9838.12738.31637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb1f025-42fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777379808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379808, "uuid": "7f430df5-ebfd-44c9-8c24-e58735edcfd1", "comment": "Malware payload", "value": "e980b6adeb859aa22074cf5ccb3a8bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379808, "uuid": "de9ccd1d-cee2-46ef-9d1a-d7dd86508079", "comment": "Malware payload", "value": "c1ee88d58991234ec08a1ebc182fa3dcc6c67f2965ad1a875a2e2a0860681b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379808, "uuid": "373aab3e-3d8a-469f-8d2a-63f519f48232", "comment": "Malware payload", "value": "d53fe8baf20a78df54a00844d9163306e7259142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379808, "uuid": "c0a3af26-006a-477d-a688-53e2920d2156", "comment": "Malware payload", "value": "dc3207478c42a25c1b85ed54d6f41786956d94bdd2e90d8f1f45b9ae2314decc65f9555fe5db59643a41b427f8ff91a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379808, "uuid": "fb59362b-1183-44d9-9429-b9821bc4579c", "value": "T158C44016E951A02FF4A389B069799547BC292E361790EC57F7801FA93074AABF0F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379808, "uuid": "65a3443c-1fc4-4a47-8c2e-15c294580dd1", "value": "f8f30656c8f1aba43206b72d673c75f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379808, "uuid": "4a7bed09-2d3c-4e20-b5e1-f53fa9bc6060", "value": "12288:e8bu1C6RGni4VihyYaE8vex2ES9dXEKYC3+RoNNLh:jocn5V0m9PNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777379808, "uuid": "15a4d9c0-ce21-4ee2-a61c-385ee917a1e0", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777379808, "uuid": "9c0065c3-52eb-484b-a994-b12d6c7a7f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379808, "uuid": "c8f1f178-5d6b-4929-8193-8c11a70633a3", "value": "Nuevo pedido modificado 3456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6877e1-433f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777407700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407700, "uuid": "992b57ef-8464-4165-b18a-424f87247025", "comment": "Malware payload", "value": "67f058662d541ddd352fee656749ef8a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407700, "uuid": "457cc4be-44c8-41ae-a716-a91db8b2c048", "comment": "Malware payload", "value": "c44ed6fb3fd9fd892acbb0ed7a92bc56c8b09d04e470f0496ecd9770a2064b57", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407700, "uuid": "fe6ce137-70b0-48a3-9298-15ae6b2bfe21", "comment": "Malware payload", "value": "fe14427001c2c097368f7533baa2d4551edd1706", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407700, "uuid": "85fd395b-5268-4fc6-aca1-03975e984625", "comment": "Malware payload", "value": "2c9220db6fbad6b42e5cfb15c6d1f7b08f859649d541ce605c00c3578dc169221b4f6ca4ff05c624b04030ab89ff39ec", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407700, "uuid": "4f6872bd-fcf5-4c9e-9382-2af873e14fac", "value": "T154F3F116D5C55F249FB95A04907C264E73F4878A8437A1DEA6576C02BF6F608823F3CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407700, "uuid": "39255154-dfb5-43b3-86fa-b89456f6fde0", "value": "3072:mPXxR2PP3748LmZc3P+QzDv8sLePGOVz4mX/baxrE8NWzPEoItF:mPiPPBLisLeZVzpXTmE8Qzcoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777407700, "uuid": "6fa92e5f-c77f-462a-8717-abd7f87e7df4", "value": 170956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777407700, "uuid": "53e454d1-f7c0-418e-84e2-7f6800949fe0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407700, "uuid": "497be2f7-d441-4c48-8782-2cbc14625f82", "value": "THUS.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d0d5d4-4314-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389272, "uuid": "42dee818-a567-4d13-bfd6-14e180e1dc9c", "comment": "Malware payload (AsyncRAT)", "value": "1da2d06dd57d42cf9f1e2234725bad5f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389272, "uuid": "92209e8d-22c7-459f-8695-652336c64e50", "comment": "Malware payload (AsyncRAT)", "value": "c4a11391f44853cf8783e17c14eeb379299d9137e3facf7f32a8cf5aea3b9767", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389272, "uuid": "ccb99c21-b76e-4f2a-81a1-7364fb87b709", "comment": "Malware payload (AsyncRAT)", "value": "b3543e082d4078767a56545aea7a6a575ea03a3b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389272, "uuid": "50341754-4260-47bf-ba7c-06c60a30cc0e", "comment": "Malware payload (AsyncRAT)", "value": "4d94f69f56e99ad9cfbda7174f8a07001f73f7f4e69825e2bb1b38a5f8358267fd2f89d1de4ad8e59ca3d02ebcb13f08", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389272, "uuid": "3c5f9ea5-c3af-475f-8bcc-38a369f1271b", "value": "T1F71339007BFC1629F2FE4FBCA87951454236F963A932C74E1CC4119E1AA27C4AA51FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389272, "uuid": "be944658-8932-447a-a84f-ff9f0bd60819", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389272, "uuid": "b42052be-e2a3-4a4d-85d6-a43472652317", "value": "768:bq7x+iNv0nZIRWVYgnV3wc5hSvSRCfXuRbheuoVNt3VLvWD+:Iv0CgV3H54qQPuRbguIN7LvWD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389272, "uuid": "15f62e8e-9b5e-4172-a6e0-52b94d33e891", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389272, "uuid": "4a457ae8-c0ba-4155-af21-03b34f1a17af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389272, "uuid": "fbe5e843-e0c4-47b8-ade9-5ee890cda43a", "value": "c4a11391f44853cf8783e17c14eeb379299d9137e3facf7f32a8cf5aea3b9767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71d2916-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777377624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377624, "uuid": "87a3644c-cec5-4097-94f3-9f6c94dfd517", "comment": "Malware payload", "value": "25a44d7c2dff5ca7fbe8ab92352f4631", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377624, "uuid": "de10ff3b-bd62-4656-88d3-a818528855fd", "comment": "Malware payload", "value": "c4f0427487b294ce6c51dba1db0f45791da3693677f1faca5331e6903983322b", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377624, "uuid": "ef421efe-43e5-475d-a3a0-21829e134428", "comment": "Malware payload", "value": "c0e0f4b3f8ec73f3957d8405440c0ab4d4710b9f", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377624, "uuid": "e47a6a22-e5e9-4f59-96be-3f04b2a81447", "comment": "Malware payload", "value": "8ee5575f15184cc9ce1349f8b51a95094de56fb2344553d04b5736a878363bd23947ec3f2972444b07d69f6249017606", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377624, "uuid": "30267750-b481-4f5c-84ef-01e8c7f5a2b6", "value": "T16AD3855D849F08C05A7B64A48ADB5D83DB9AC11B0B0CC9957B7DEBA13F03A59C0EF1E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377624, "uuid": "3704d7ed-a2b4-457d-a9c5-4e875087022a", "value": "1536:cnnj1TDjgL4krH0DSrw7HHggHFLUZwiZpfw5+AAYGPSfJhfoYW:c+LQrHHFrHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377624, "uuid": "813056de-52bd-4864-b135-abae0628ce0b", "value": 142701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377624, "uuid": "81a10a74-bbf1-4ca2-aa42-90bbc8a02a9b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377624, "uuid": "970305b7-c061-4e10-bcf2-3cf900007a65", "value": "Sydney_Journal_Release_401.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66e08db-42d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777363477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777363477, "uuid": "a87c434b-18c2-405c-94a6-eb44d9d1e087", "comment": "Malware payload (Mirai)", "value": "6083b713d07472266fb88e1a20e39e5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777363477, "uuid": "f40fd3e3-4177-4b91-9af9-1a353b13ec0a", "comment": "Malware payload (Mirai)", "value": "c5955388f67fea844f9ad6c056f00f29d33d6d006d6640e5722fe9cfcd990727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777363477, "uuid": "c2b172ed-0f62-46a6-adae-5e1ca7232f53", "comment": "Malware payload (Mirai)", "value": "82ea1d86c841b6dac64c82f5e8101564eaf0428e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777363477, "uuid": "3c5160e6-8029-4542-bf91-b978a0e1129c", "comment": "Malware payload (Mirai)", "value": "6c3dd3e7ca0465b864da3dd49aba8f8600a3ff4c228bf272d6a741019ce528e86a38c6d28fb8d63d644d475da9c47012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777363477, "uuid": "5c41d27c-b413-4d41-af3f-6b6c51ce0b74", "value": "T1F2E2F12926DCAF10C739053B4A74C643359B66FDCAF130132B400768A6A3E9DE7F9A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777363477, "uuid": "48b01518-6bdd-4375-b6c6-70d4c0b90ff5", "value": "768:xo1lvBOzGb8deCKhY/PEBiR8RFZqCxFzG9wgQQQ/s3Uozh:K1lvBbQdeGPQtRFFPzGKgnzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777363477, "uuid": "4365fe21-0fa9-4ec6-8119-6b99b365cb33", "value": 32964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777363477, "uuid": "b185ba8b-6735-45f5-989c-aaa9612b78c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777363477, "uuid": "ece7a9c9-3ffe-4121-9d3b-46fedc4d1f09", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e726e2-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355077, "uuid": "1cafae2f-692a-40a3-bcfc-1444832e8aed", "comment": "Malware payload", "value": "308b8d71af1c8c7f9c11b4a75e8b2b4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355077, "uuid": "8c696d62-937c-45c1-a9ac-582a4f0e52a4", "comment": "Malware payload", "value": "c5bb1119468e6fb688c741d2b8c621924bb4cc5af91e56104d03380dc11233aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355077, "uuid": "83f4faeb-3241-485f-80c0-a712d53e50a4", "comment": "Malware payload", "value": "46bf554bae25ab597c4f50d138ff658ea1858167", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355077, "uuid": "fa904a17-947d-4c44-bcc0-d380531a942f", "comment": "Malware payload", "value": "a8de20212f2849f559e5524e32acdbb231716edb91ad6a551c171b7bcad6e308fdeec6ee1cd4b39b739c31469d65fc04", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355077, "uuid": "467130cd-6de8-4696-8ba0-c7b124460bf0", "value": "T17A37230F5F65836F03AC90B524B62A611B804A7C8D03F1C9BBE2FD5FA91DBA4BC556D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355077, "uuid": "b36b4c98-8ebc-42e8-bde2-b4983a80cee7", "value": "49152:MNLiLNLi/NLi8NLiHNLiNNLi/NLiiNLiFNLimNLiMNLirNLiZIiDTNLibNLiUNLW:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355077, "uuid": "64e68ce1-3e90-4100-8bd6-8e897ea164be", "value": 23424201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355077, "uuid": "3b27993a-5631-477f-887d-07bcdebf560a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355077, "uuid": "550e0386-e1df-42b4-aee1-d99a550d6ab9", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa6dc6c-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355243, "uuid": "6a0e0892-2b78-4386-bbbd-35dc2f66d271", "comment": "Malware payload", "value": "f0242f4c09eb3034782c0200c09a532b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355243, "uuid": "5213821e-b6b6-40f1-ab79-e3a09f730373", "comment": "Malware payload", "value": "c67646c08fb23ee1f33f9fadb94e60c61e3f631adf92a6ae1ccf864d9c152ba9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355243, "uuid": "21cdf82d-a11d-4689-98e2-ecc0fc490faf", "comment": "Malware payload", "value": "d6e9ccfcb2cba09ee787214dd1da925b9086ace0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355243, "uuid": "42f2ae1b-3e1e-42d5-9a27-3dc1de4ec662", "comment": "Malware payload", "value": "e764114c6de9d4137ee7a1de174266ed6c9abc0e1d7e88d65600aa35e5fa8f07fe8e2af9132e1889c20ee4760da02b15", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355243, "uuid": "491a32e9-5db4-48e5-ab38-3a62a4b9584e", "value": "T1A13713221B58DF3E8968553854FE271E41D98C6860A3C5BABFADB4A35C4BF3831731C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355243, "uuid": "57405b30-3829-4534-8ea4-d59f39cc9f37", "value": "49152:OfPfuf2fafHfxfjfifAfhfwfZBnBfzfhfSf6fqBnif9fsfJfGfZfSfcfffEfrfFb:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355243, "uuid": "d610daae-4035-4f93-8cc4-dff813588193", "value": 22383690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355243, "uuid": "951c3083-8462-41a7-bd94-50cc71b26a71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355243, "uuid": "93cadf0f-7e84-44d0-88e0-406efb5b7570", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd2a72e-42cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777357875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777357875, "uuid": "e22051f3-f348-4f0e-85ed-af06bcb5f225", "comment": "Malware payload", "value": "22b6925d5d0a87904d2a31f7d01f4dd7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777357875, "uuid": "7ef1d565-7f52-4b91-a400-05aa4ad653fb", "comment": "Malware payload", "value": "c693ad71b1a20b1cf871b257af19e1ca150b2946a6c9c905692c31bf65c9e53b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777357875, "uuid": "995665e4-230a-4032-9d7c-910fad61546d", "comment": "Malware payload", "value": "3e0393a86ee71b188b3a62d156410e00959e810e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777357875, "uuid": "483c3d87-10c6-4a7a-8ce4-f3bfd2e888b6", "comment": "Malware payload", "value": "b35c60be5e3302b5d731a8e5df6579b7047cb888026bd82e3eb932acbfac3d516ca27f57be536e89c9c3485cb02a91b1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777357875, "uuid": "741df02f-be66-4345-adad-bc87af06208e", "value": "T1F262AE36AEA717BF33A0FD9150C689765C4AE73F1C1BB2E5904302E495A235D294F88F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777357875, "uuid": "c5e1b25e-66e5-4cc3-8b73-903ebd047ba1", "value": "192:U/ObvFUI0mTliFTtm3+4oFcs2BVr9Wl5zyL104S/OBxyfTiUoEkwby5ZwzLR8kR6:HWg+a/avBwx/V5YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777357875, "uuid": "c9955596-2a7b-4377-99ca-bb2409920e0f", "value": 15822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777357875, "uuid": "42ada245-e192-4f2d-a73e-6cf3c84a672c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777357875, "uuid": "8dbbb43c-304c-4f98-9000-aa23157e882d", "value": "RFQ_Purchase_Order092347567.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9defcca-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777377629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377629, "uuid": "8055fcb7-99cd-47cd-8a03-62a765588744", "comment": "Malware payload (Mirai)", "value": "e844750ab59a34c685fa23c5bf55cd71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377629, "uuid": "1f46e1ef-1e40-4584-b9ef-30446f5208ac", "comment": "Malware payload (Mirai)", "value": "c73cd240dc0aea5b5cd0b26c20bfec0b4861c23cfa4ac57bc345f8671b46b670", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377629, "uuid": "c916aae8-f56b-4c9f-b2e4-3536be36db76", "comment": "Malware payload (Mirai)", "value": "a08f063c8a02aa6ffcec2ed742f876f7bdc5eab0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377629, "uuid": "8602043a-ec57-433c-89ad-bc337a5eb4dc", "comment": "Malware payload (Mirai)", "value": "d44269f9eb8eb8ce9ae3deccd9fbcc4ef2b8336f6dfaddce243777505e58de1b3f269e085648c7fe3b30a77f0a51c507", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377629, "uuid": "0ac5f912-29d1-4d16-a03b-b75b1aff545d", "value": "T106F2F153F0FE042FC688473F003FCD54A9262580AAEB471CF6A18899536D1E5C6EDAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377629, "uuid": "9baba2ed-07ff-494f-8f4d-8b9c07abc51f", "value": "768:31gyYdqiHJTUU3GUibz8TaR5nDh6YO7K6dyJfWr/Zpc:FgyYdqaTU6GUcATimeJfW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377629, "uuid": "0caf7bf0-cb10-4072-9176-c8d4e7e2e15d", "value": 34688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377629, "uuid": "6123811a-1d01-4ad0-8caf-c86f164f4e4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377629, "uuid": "5db58da1-c684-413d-9d46-0e855bb57d16", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8a6a6c-433f-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777407381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407381, "uuid": "64e6ee2c-4555-42c2-8df4-a42aaba9afd1", "comment": "Malware payload (MassLogger)", "value": "e7094ed1b188752c7ca62dbd55717a81", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407381, "uuid": "457ec2b3-70f7-42a4-b477-1aa63c0cf4d3", "comment": "Malware payload (MassLogger)", "value": "c9712e2e976a5fc4ca7c0f7b590ae38589c6b50e94079b260ce390e56cb02a0f", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407381, "uuid": "8d96de50-27da-4f83-94aa-75031eaf011c", "comment": "Malware payload (MassLogger)", "value": "82d2a3b8258f0fd8596ce21770dbed467b6a4c01", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407381, "uuid": "c269c244-e77a-4b76-984d-02525dcce4b9", "comment": "Malware payload (MassLogger)", "value": "5de23f48f6c88e16d71bbe99c36f8821b856b39cdb6592dce6bbd1a73b518bbd7a7f4caa2b97a9bc2a30c495c12d0447", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407381, "uuid": "e1741cf6-898b-4891-96ef-0344dec00a63", "value": "T18D3533226E526DE5C76CE375DDBE9B3D839A56A6500960C398C102F3DB6334B4E8FC18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407381, "uuid": "50fe71df-918f-48ad-a3db-a95588db7b46", "value": "24576:penAGyZ7PDSlv8DaqshxNRQldkh2p6YPNQArBkR5RCBNlKb:ZPM8ORrN+kqXNLGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777407381, "uuid": "6b8af049-6297-4922-b159-94ca6df0b3ee", "value": 1114636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777407381, "uuid": "781810fe-6763-4170-8620-5c3d8f0929df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407381, "uuid": "4d07e2b0-33d7-4fb3-9d9e-35ac82cfb9d1", "value": "ps_mkdNhoKsjB9E_1777388669163.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6301398-431c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777392628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777392628, "uuid": "8849cfae-869a-46cb-92c3-ad26ae708c1c", "comment": "Malware payload (Phorpiex)", "value": "d9280474aaaa86c3c9c19c29e80292db", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777392628, "uuid": "376c139a-36c1-45fc-a18b-b061d3acd6b0", "comment": "Malware payload (Phorpiex)", "value": "c9984870e1caada45b1ea9dc1f9829bfd342f4adbbc586398e443d765e28371a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777392628, "uuid": "51e321af-340c-4ade-986f-9a1d349ba529", "comment": "Malware payload (Phorpiex)", "value": "560cb09f4cf538530fa267d378bde32984ea8356", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777392628, "uuid": "d701979e-703a-4d13-9061-576ac4d99ac7", "comment": "Malware payload (Phorpiex)", "value": "34f9f6b23534596249e1440ffeffa406955d1e5d59488474f62f1fc6363b9137e6cbbf02832fa36deed3c0fe27590f8b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777392628, "uuid": "9a187418-b192-4294-98b9-a9acb1152305", "value": "T133824B0FB9424216D0D200B49676867BD9B998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777392628, "uuid": "a331ffe2-a7ed-464a-93b9-f22dc737fbee", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777392628, "uuid": "e168636a-02ae-4b6c-b0f2-59302ca8ab8b", "value": "384:HI78VGQic1Kwzw077u9NHu/gBhav8U9c7:EAo0769Zha0U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777392628, "uuid": "060bda01-fe2f-4a4f-ae27-15449ad19a6e", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777392628, "uuid": "12c11a5a-a5d0-42bc-9861-95e61a67be37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777392628, "uuid": "f9fdbe98-71a5-4348-b991-36cc7f6b0c03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6357f126-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355096, "uuid": "5012fc2c-9fec-47b9-abed-6853a9f9020b", "comment": "Malware payload", "value": "cf1c8d1f2fa067c7ae7d7afcd4df76e5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355096, "uuid": "834c457f-1f98-4876-87ba-99eabe352a07", "comment": "Malware payload", "value": "c9deb9efcfb12142570df863e3b72c2fa3d57dbe669e5a8d514d70a200b8e2ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355096, "uuid": "f0ba74e6-9bfb-4651-8b10-d5d1db9e407a", "comment": "Malware payload", "value": "6d37902957508ca34fe9b73ff8f7d5112ceb42b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355096, "uuid": "bf0398c5-ad7e-48be-8910-53fa30d3b0e6", "comment": "Malware payload", "value": "0844f3a4fa241e1b8ee7984381ce7fe47b27f2597a129442685aada9bc89dbd3747c9608bcf6564adafa57affce79610", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355096, "uuid": "b6d40164-966e-41d8-b1fd-9b9acf007b36", "value": "T14B37231D2F2B67033AAC207D3DFB1E5B5FA28C105588E96D72895CEA663F2710117EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355096, "uuid": "51a81de3-7c1b-4998-9192-064e78c0a49b", "value": "49152:q2Fi2FM2FD2Fq2F22FM2FQ2FP2FN2Fu2FB2Fr3YNmFQ2Ft2F12FA2FU2Fz3YNmFM:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355096, "uuid": "0a245853-c4f0-42c0-89b7-fae977965d2c", "value": 23164080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355096, "uuid": "aee500d1-40c7-49dd-b2c7-8ded3c98f661", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355096, "uuid": "2d260a7c-bc5d-45bb-aa68-2dfbc32f6fea", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926a121c-434e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777414016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414016, "uuid": "3928a4dd-38a1-485f-b5f2-587666b39d3a", "comment": "Malware payload", "value": "56f36397bc34214fb553490f34791e90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414016, "uuid": "63709b0f-9d96-4b8e-a216-3a77f1e1ed4e", "comment": "Malware payload", "value": "ca4f6dc377e66a8d41f200ce836988d89de94d47dc20754ea3812547c9fe7f99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414016, "uuid": "9079e330-7415-4bba-a94b-6861a3ab63b7", "comment": "Malware payload", "value": "a18283e77f4dc9795a6aa3fa5cd2afb3e5cb7a06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777414016, "uuid": "51032e54-02ec-4ff6-a14e-ee7d7fa91146", "comment": "Malware payload", "value": "83936235e777830cef78acba310f1716fc10dbc5d6b6d80d2a28fce95ebbd959c4c9a275f49a3bdb59bd73a92a800348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414016, "uuid": "8a3991d5-4ef3-48d6-9128-fc1cd3cdb117", "value": "T1FA43F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414016, "uuid": "b0893b88-8d48-4cc0-a163-f931b2cb540c", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfza:5AG8nY5BZG2xxmLQLS/S7hHnQfza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777414016, "uuid": "a8934c8f-0eed-4c8b-9b30-15c0e95ae055", "value": 59699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777414016, "uuid": "38419e7a-4019-4456-9fae-d6bc6627bff0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777414016, "uuid": "7cba42be-eac9-4cba-9fb4-1c5676e11e8a", "value": "netprobe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05349d6-42f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777377103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377103, "uuid": "0c283dbd-45f8-4e9a-a1e1-8cd792ac451b", "comment": "Malware payload (Mirai)", "value": "80512ea4a8108935065f18d816ea946b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377103, "uuid": "c013129f-036a-48cc-aa8e-23338bbb70a3", "comment": "Malware payload (Mirai)", "value": "caa57a7819737f28a0fcfff1a76fd6e0e1ef161c066fcfe7cb7cbead9fc0cc05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377103, "uuid": "1902ab00-7ab3-43e6-a79e-204bcaa02d0a", "comment": "Malware payload (Mirai)", "value": "e532afa7bdfe17d782ccc76fbc41a76afd0c09f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377103, "uuid": "49283436-279d-4faa-a110-27663bf622e9", "comment": "Malware payload (Mirai)", "value": "fa4471aa88e15c1479a2daeb9252bf1934e462adf17ebfbbd8daed4358ec1119525e322056f56fd8d6d41d5f46947a98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377103, "uuid": "b1cd481a-b9cb-4cee-aa6a-f81ea8c2ccdb", "value": "T149537C13B68090FDC8DAC2B48B9AA225E5B3747F1235F31927C4EE252F2EE506E5D740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377103, "uuid": "78e7895d-81ac-4724-938e-63049d2495a9", "value": "768:Zl1yrzOStm5O+WmJlpMLha3I9eQGqp1G3NkOJFwjMxsGcGvBeRqqH+3YOdmE9pI1:H0/OsODpuGIYqpd7jMzcGMRG31MKpBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377103, "uuid": "61bc585c-1c2c-4789-9075-f4f4e3ce62dc", "value": 63400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377103, "uuid": "4001c3ea-c76f-4c77-a7b3-9f35c463c055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377103, "uuid": "e2724614-068a-40a1-8f00-9507444c6002", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93edc7b1-42d2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777360761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360761, "uuid": "d14c6e22-283c-4f31-82d2-bdae708525d2", "comment": "Malware payload (RemcosRAT)", "value": "7060e99b0a536076f63cd3fcf1f5ee4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360761, "uuid": "70a1a397-08bd-462c-800b-f9e6c5e23868", "comment": "Malware payload (RemcosRAT)", "value": "cbd15a8deafc21dedc62f380ba04e95a371a05e99e7f3c388eddb5b8572812ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360761, "uuid": "0005a2ed-f6a0-4af2-a28a-82fd3fe6ea77", "comment": "Malware payload (RemcosRAT)", "value": "05bea1db434b6debb0b1348221d07061e3dba3f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777360761, "uuid": "0a79b79c-be05-4375-99aa-c5b2e4c3aa3a", "comment": "Malware payload (RemcosRAT)", "value": "e9b04ad36f3ab27248b37a74c6395ce80627a089c9c1f57e7999f113be71939d6b3dd9ebe45aa0f381fdd1d2378ee94b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777360761, "uuid": "b330e6c8-242c-42fd-9a9b-ab6d67fb9da8", "value": "T1242512D8735BB295DEE8317439B54BBE898C7C2385A1664356403BBB7E3C0618B1F227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777360761, "uuid": "17023176-5a53-4f6e-8a51-7203399cd0b8", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777360761, "uuid": "d38bebed-8a65-43bd-a13a-bce4375655fb", "value": "24576:yTAUoCafKRx3H8nL2Nh5C5gf/pAKXN3mbbcz6sz:wIKRxcnq/5CufBtdWbbcWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777360761, "uuid": "84245f8b-2412-4197-ae01-da3d9cfd9391", "value": 1008710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777360761, "uuid": "fde60e44-f93b-4b91-b58d-b56d93128308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777360761, "uuid": "3b8a1546-b0db-4a18-a405-02887b15b1fc", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9927f9cc-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355187, "uuid": "906321bb-5835-4df8-99de-f3cee671de8e", "comment": "Malware payload", "value": "be58052addc32b272625352854907ce2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355187, "uuid": "4962cad1-5ba7-4c6e-9027-20dfc732896a", "comment": "Malware payload", "value": "cc07018c0f1020484aeabb0d5aa9395591537f15690d58cda8201ca234a24da2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355187, "uuid": "be1a70d6-a870-41f6-a49b-4e3ab0d6214e", "comment": "Malware payload", "value": "2b2d6d98bdb9250df29ca8dc964e075f4b807862", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355187, "uuid": "a985354e-d0f0-4b05-a6d8-873b913964f9", "comment": "Malware payload", "value": "2520336b99abb70c7a650cfe0761e227fa13d78c9dca2d8962749e1bef213b5c23b91488ddb29a20c515555e7af1ec0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355187, "uuid": "65b026d3-489d-4b5a-a918-83d69c8d24fd", "value": "T15D3723238A784D3FA5FC175C04FF854869BC8CAD696099EDC3D279C78206E2A117F3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355187, "uuid": "f6c9b8a0-e782-4e8a-839d-f297eb72274c", "value": "49152:uDFDgDbDJDiD4D5D9DVD7DDDWQc6pdDIDlDJDlDKQc6pyDkDyDWDhDpD9DaDXDYT:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355187, "uuid": "145bb6bd-d0ff-4547-975e-6d79d67c5ab6", "value": 24464731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355187, "uuid": "20767f81-5b4b-4f43-847e-6cb588f98bd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355187, "uuid": "4d336ddb-f7b0-4ed7-976e-ee9d9979a431", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc03472-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377773, "uuid": "71ab64c5-262d-47fe-84cc-286fbb9ec833", "comment": "Malware payload (a310Logger)", "value": "5393a69f2a2d804229b71b078ed9e67b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377773, "uuid": "adb92794-65f6-422b-8bbd-3f1b460789f5", "comment": "Malware payload (a310Logger)", "value": "cca0dbcde3f3015be7fed58c0c788ba766cbf252541e9b2e4450ca019b7b1f59", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377773, "uuid": "9c188f5b-e3fc-4b9f-b918-b78c5f42a9d3", "comment": "Malware payload (a310Logger)", "value": "f7b27bac0a4f9d54da3c7479ccc0682cec19602a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377773, "uuid": "c07d7df8-1b90-4a3f-832f-5a3943ea1ca1", "comment": "Malware payload (a310Logger)", "value": "a108f597dffbfd9feecf6b19fce8ea0b2e57e06c44b5a6f395cb7edb3606a081458a4e16e21972f025cd53d0bed35d77", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377773, "uuid": "aadac7c3-9cec-449e-b325-4d345a7893a2", "value": "T189A56CED11F9E0AADC0F8F59BCF69FC81BA81DD9004C6C78795BA40D1AD87B8145362B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377773, "uuid": "3c26584e-1bcd-4068-9b73-bf6dbaef0501", "value": "24576:EymFd3vAKvzelS8a4nd33xB7rm0/FKmVqZb2E4i8ST/HxiMikAcRJZivnhLXnI9b:EyYPaTBBoPQvE4gehLv9jVbBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377773, "uuid": "a7c3ef80-9fa1-4738-bcd9-b319cf862b8a", "value": 2106370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377773, "uuid": "770c795e-3cec-4b18-855a-bae67577c0e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377773, "uuid": "bce1c81f-65d0-4156-a7f0-e22de4d7764e", "value": "ps_FFB0usRjqGgt_1773330697914.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e06064d-4348-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777411459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411459, "uuid": "2e548b57-fdd5-4914-8334-242c6a26e615", "comment": "Malware payload", "value": "83198e35ced20c02961f232285f189c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411459, "uuid": "f8e2de11-947a-4846-bc81-2bb193241ee9", "comment": "Malware payload", "value": "cca3d4ec539f11d846a67d1afac21dacd59b271c469febb739ecc7df0816345c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411459, "uuid": "ec83df4b-11a6-48fa-9b4e-682f84c2976f", "comment": "Malware payload", "value": "a2af0c3b42f8e4b560d455191a5400373c51dd2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411459, "uuid": "5282b901-ced4-4662-a125-2caead257521", "comment": "Malware payload", "value": "7bcc41e4e07d4d236f13edefa58f94335af26542cdf71a183ac638f77deb8163a13e566905f60fb4cc02d9aff7fbc200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411459, "uuid": "dcbdad0b-2c4a-4027-9c26-5df9e4f92169", "value": "T1E543F7433AD289B5C4C1D770CACFD12AFA20BD51A531BA1E2A08473AAD16B645F1FF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411459, "uuid": "48886e6d-4b14-495e-9bff-78dacff57282", "value": "768:5AZkDA9BLkfC8WeYPM/BBr1RAA/xxeKIycQasFXM/GYxxSRJh9noXo5bJJQfz:5AG8nY5BZG2xxmLQLS/S7hHnQfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777411459, "uuid": "9dff998f-6257-4d9a-95a1-71d3604d934b", "value": 59488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777411459, "uuid": "b7ce691c-55e8-4d1d-b60e-ca01ce6cc1da", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411459, "uuid": "e814dc8c-2484-463c-b4c8-e6e49fddcf93", "value": "x64_v6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c76dbd-4295-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777334728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334728, "uuid": "93c98848-a6ee-4f66-a18a-696cfb3352b2", "comment": "Malware payload (CoinMiner)", "value": "c1878984cd3f70cb41ff4f2a7df6e548", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334728, "uuid": "395d794f-33a5-4903-a421-e246485cde0d", "comment": "Malware payload (CoinMiner)", "value": "cd043686efd299f7afb3fb9caab89795ed168d54988ac4a649a30c2493bd06d6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334728, "uuid": "8ce6c486-4be4-475e-b14e-a38fa73400e6", "comment": "Malware payload (CoinMiner)", "value": "bdc9d3578f7af05db675d56ebeadfb31ad4dd7e6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334728, "uuid": "e80e0e0d-3118-4917-a929-fc4a4afac69f", "comment": "Malware payload (CoinMiner)", "value": "582047d4d1f0a99a192b56105d82d64b51794fd1ba49f55e705b106e9836da93bcea1964ebbc50804c3bb674b2870128", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334728, "uuid": "9ee7d67e-528c-462e-91ca-59a7c99cf957", "value": "T18541E1E7E910C9713D49DE0ABEB9C304D9C614B79F1F5D2858C22C5BA50A25834F5FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334728, "uuid": "3a62ad9d-302f-42ca-aa37-159d05de8a7c", "value": "24:GonOtQK+Ok+KetybBj4C8Sqve7Y6eRUNZQBQMH4C8Sqve7QStQmIVSHb32rQw2id:yQqk1dj/mUPQtH/cStDqSH72EDPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777334728, "uuid": "395fdc34-8a33-4036-a5e0-bac16c3f1af9", "value": 2333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777334728, "uuid": "03cd3236-1ec3-4028-a2a5-28d36729f583", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334728, "uuid": "760b29db-b300-4164-96c2-00dfab2c8672", "value": "xg.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85eb91d3-4306-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777383072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777383072, "uuid": "d765bb53-835f-488f-be23-6d6b8cb408f5", "comment": "Malware payload (Vidar)", "value": "2c7c9e2da69a6254ecec416c7a1c7dba", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777383072, "uuid": "0de0e1bb-8bab-462c-b70d-bd747b76ff91", "comment": "Malware payload (Vidar)", "value": "cd263e14eb036a4a9990262700af8121e2b23d31d8efc89fbc4b6d65e8e8b7c3", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777383072, "uuid": "c7e462e8-d5dc-4522-bb9c-de2fa7734856", "comment": "Malware payload (Vidar)", "value": "9debb69128fd5e6391cb85dbb21b96c3a1d3de71", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777383072, "uuid": "b63b17cd-285c-42c9-b0e5-f0efd4c86c24", "comment": "Malware payload (Vidar)", "value": "a006e6385e71a1da0efaeb0561dc39272dae1158d800a5426c8272cd294f663ea977febd2d9fcb5fbcd3bee3407bd7a5", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777383072, "uuid": "a3db2232-b417-422d-aa7c-0ab65e8cb70c", "value": "T1D0365BE1AF5008E8D3B450B488AD7B45BFA7B8265B7213D317D068757E363D22CB8768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777383072, "uuid": "5a35abbe-dd07-4fd7-93f8-1fbece15ca2c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777383072, "uuid": "0daef632-b200-447f-a3b9-62fc20fc3853", "value": "49152:8lgMmqDaYD114KPgyB5K/YklQyD+3DSAgdRT3j:8likHF3mYkln1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777383072, "uuid": "4f3a0472-5358-4c0d-9a0f-9b90543b0851", "value": 5139072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777383072, "uuid": "a9af3722-0cb8-43a3-bfce-8cbbd68fa513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777383072, "uuid": "bc03d62d-7cfe-4203-8d3f-1d1118dadb0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27f3725-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403440, "uuid": "587aae6d-2e44-4c55-9799-abc90680dd29", "comment": "Malware payload (Mirai)", "value": "75566ec6dd6a5ae692bc650dbe7efce4", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403440, "uuid": "ca592ed7-cb78-4c8d-9190-d7fa1237546d", "comment": "Malware payload (Mirai)", "value": "cd2ef7c104ccbc9ae0efd0f3e05fef0064f5bfd5ed8a4a912ca4e1b02cda1550", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403440, "uuid": "3f4ca333-4814-4621-80b0-905138a9dfb7", "comment": "Malware payload (Mirai)", "value": "2c23dfa0eeb93c31a43a2987aacf5aa2f5a19bd8", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403440, "uuid": "c1aa8923-d99d-4acd-89a1-4deb0237b491", "comment": "Malware payload (Mirai)", "value": "aba326bfc72b33224ffd02024073bb66346a2c4a7e03f78f18ca38e16630273e62c49c433715f6cb08c4e370a692268c", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403440, "uuid": "5bf85935-d124-460a-9bd5-104ec8acff88", "value": "T1E42302FAD357F0BCC470A577064EA2DAA56A78029725270E43F231D9FE676681D023C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403440, "uuid": "e3f7fdff-ce19-49bd-b6df-0794a03caa48", "value": "768:RdGwNYm3GJyOvAZhON6YONKVLQi0jytVwLRZ+v84GZ2S0Jz1b87dep43:2wkgI6YONsLsjwVwimoLzxMdei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403440, "uuid": "d847a5c4-73b8-4bc7-84f4-790185ae80c7", "value": 47768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403440, "uuid": "c8119842-7255-4206-942b-d9cafc1756da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403440, "uuid": "f5703144-30dc-42b0-aba5-9387e8f7e935", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9477b66-4348-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777411612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411612, "uuid": "23feaacb-b49e-44ab-ac5a-1c1650d0fd39", "comment": "Malware payload", "value": "37b7f2eb2fdb538829621f136e217b06", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.cw", "colour": "#C0EAAA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411612, "uuid": "9d03a428-2640-4389-89da-562a678e2939", "comment": "Malware payload", "value": "cdad0c56640713326eb48e36085e972022009a0f535dab9d3b5259f486cca926", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.cw", "colour": "#C0EAAA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411612, "uuid": "dfea7c48-5c59-42e2-8443-db49ef0207cb", "comment": "Malware payload", "value": "7f495882a53cf86c26ef669df16b4da665b6b2e7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.cw", "colour": "#C0EAAA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411612, "uuid": "1cd4fc39-fd05-408d-9e3d-f9edf885acf6", "comment": "Malware payload", "value": "6bcf193cca50b9bd28cf374a69e82c18672611676623320e34ad16ddcca8565f7728682d540f25e04c64a6165830d9ca", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.cw", "colour": "#C0EAAA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411612, "uuid": "cfa54407-c908-4109-be03-96559e346cf4", "value": "T102A73331B68BC635D42C003ADD29FE1E0579AEA3073505E3E3E9BD6E85B48D29374B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411612, "uuid": "d13db384-f585-4573-9df3-503e66e6ba65", "value": "786432:2cvODZNKMPV23dILYhUx3fDGXvHsxQfu9w/VQ7Yux182pJGlC6LWyZfxK4JMj:2cvq2MPudIkMUvHHfu9w/K7YuskJuDLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777411612, "uuid": "26301365-7f4a-4ffd-98b2-13ac674ce3b6", "value": 47618048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777411612, "uuid": "98ce4796-a8c2-4d60-907d-ec9043980c75", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411612, "uuid": "c42bc750-1c61-43ee-b366-6a5ab3623e3c", "value": "Clash.Verge_2.4.2_x64-6715.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf21aac-4335-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777403323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403323, "uuid": "3e3bac35-c280-4481-a830-6b384ae993a1", "comment": "Malware payload", "value": "6f70fb1311b7d4a1112ed86796ebe60b", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403323, "uuid": "368a6733-4702-4986-b366-e53696bd0cbc", "comment": "Malware payload", "value": "ce385b95b848c5844200b7bc92110a1bb866580ccb05af20aeaef0e5b1722c5f", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403323, "uuid": "12756c97-06b2-4475-a9ff-b0ab97edea94", "comment": "Malware payload", "value": "fc47eed9b92ce16552cf2220f13973bac9a43c68", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403323, "uuid": "5308d583-2bce-46da-8565-310d5a22bd0b", "comment": "Malware payload", "value": "aac606fabe9c7e21e92f4e86f897927d70ef3b6c9abf02ad612a4ee5a81f30eb3f1fcf83cb051a303dbfe621e7fdc3b5", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403323, "uuid": "11409594-13b0-4a9e-8572-06f98b64098b", "value": "T141C26CA289345487DCABAC31A1D8ED277D7DB3C30B5086E70164E5A90F837C6E73962D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403323, "uuid": "a8ec14f2-c77b-4c01-bbb9-3ad8038a644d", "value": "47c3554d0dee53d4f925ed52484bea12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403323, "uuid": "56b46c84-e578-4177-b6b6-b24261b1e731", "value": "384:gN85rVXcLr7GBN1ah3ezvDyR9za/ioLjYGy8RbmL4nNyUS5:OcVXnBN236D+9zzoAG5ALf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403323, "uuid": "e405d0a7-2e55-4059-9daf-130d9ad99683", "value": 27536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403323, "uuid": "4665fe28-2a32-438d-90f1-198580a7da6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403323, "uuid": "439ebb5e-831f-4291-bc31-d2901caf2009", "value": "1.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437768ba-42af-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1777345594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345594, "uuid": "dd997a5c-f38b-47e2-893b-e83a939c7e21", "comment": "Malware payload (SnakeKeylogger)", "value": "e42495d24aa869e37593db0464c72cd3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345594, "uuid": "d8e09dcb-b110-4036-8569-3a9aca11e527", "comment": "Malware payload (SnakeKeylogger)", "value": "ce6fb377a643909b666592bbe920ea4ef9d7abc50fbe14f8ecbbc3cd059bebc4", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345594, "uuid": "d947aebf-920b-40a6-907a-a931a8c3b788", "comment": "Malware payload (SnakeKeylogger)", "value": "9491f23632f20de83aa9ef290ed13e4ccb38acb6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777345594, "uuid": "686ebb3b-1957-4091-883a-8593da3ca6ef", "comment": "Malware payload (SnakeKeylogger)", "value": "9b4ad958bafca321e74a552ff1e278109e5533d4ce69853002c9020214068ddf3d4343c65b9a0d9dee80d60e2c38a7ce", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345594, "uuid": "3daa5cd9-0ebb-4934-bb10-a32abeea5202", "value": "T1FEC42306FDE27FA8477D422076594D0FA946E68FC08CD9F6BF586CD22F6921900BBD05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345594, "uuid": "0d8c6bef-fac6-4d96-a85b-82f39a6a2a18", "value": "12288:UH90VhNURMXB2kT+hUz7R8qfvkpBPjgLbYwsy:i9PMXB2IVz7RB4ZjQY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777345594, "uuid": "f1240821-d0d8-44d7-9e96-fc4421669623", "value": 566793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777345594, "uuid": "5a0f1418-2932-4244-b926-5c42a1f21ce0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777345594, "uuid": "b88ad79d-d886-4b2f-ac3b-0f1e54a1e42f", "value": "KPUUGPIE.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e069c575-433f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777407705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407705, "uuid": "4683ced9-0dcc-46ba-bd7f-cc55da85060c", "comment": "Malware payload", "value": "a5edc61daf09a034d10bccce58170582", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407705, "uuid": "f5a1a544-135a-41f2-8bf6-f860792eb82a", "comment": "Malware payload", "value": "ceabf3e47d73bfece45a45e1165a7415f6da53bbff551684dc04779faf798bb9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407705, "uuid": "56de5278-672a-42aa-ae89-cd616bf66bec", "comment": "Malware payload", "value": "e0ae9684a2c8a5dd42f00d3854971fc5615f8f9d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777407705, "uuid": "8f625da1-ad63-422f-8f53-df7b271b29fb", "comment": "Malware payload", "value": "e02206f5a4cbdcfaffab48e6e81556fc0dc15c2cb2da87c4945ee8f5f8d3cb0744c57eccbecc80d8827935d7ef4f1aae", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407705, "uuid": "d8cc53a8-db47-47fc-9bda-28a6a8f7fcbd", "value": "T12CC3125216E5DDCC19A2C996A4DBE9B4D0C29802DC9B5E5ACFC4C1CC3B0712125FFFAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407705, "uuid": "48c0c90d-847c-4ce3-8429-58541698d823", "value": "3072:jhv2GLtYztcsUd8BxK285neN9wSbJeYU8F9llp+Wt8ucOc7H:R2Y6zaixKFgbJGWlDQPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777407705, "uuid": "e07bdebb-14dc-46ea-87b5-1d802b847bc7", "value": 122639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777407705, "uuid": "0cc9ec9a-c9a1-479c-86b4-46ff56abf8a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777407705, "uuid": "41b2e0f2-1811-4f44-bd24-863483ac085d", "value": "news.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37c5fe2-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403442, "uuid": "a3047f01-4364-4ba0-991b-771c104881b4", "comment": "Malware payload (Mirai)", "value": "1c82c9bd2405265de91322591aa17c64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403442, "uuid": "8e0a95fb-52ee-452f-9d44-8934e1fab3e5", "comment": "Malware payload (Mirai)", "value": "cee9dae5274514382f563fb7ed093bc0be55fa87d27b46b87766a3e318c1bee3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403442, "uuid": "611b9d6c-13b5-4db7-b3d9-a1de7ed7dfdb", "comment": "Malware payload (Mirai)", "value": "2919f0d1af788bfecb4333110c77c52b80bd6bbf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403442, "uuid": "e4ab98e8-1cd2-4132-be36-16834d9516bb", "comment": "Malware payload (Mirai)", "value": "0f0d3b138c669c4baef5d950bb58965abf25eabd397d61b6031fce793643c54a1c1d29f9d7aaefbadbbb90ca102df80f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403442, "uuid": "ac1a0d3f-d6c0-4530-9365-30bc2e2ed6ac", "value": "T157B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403442, "uuid": "91f278b8-173b-4891-9808-1419ed522389", "value": "1536:57jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxn:1zPqF41OUBljSIxecUtC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403442, "uuid": "de60e995-9187-4c92-9660-b25bff44a6f8", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403442, "uuid": "4c046ef9-0642-4edd-ad21-3531d6b7f7f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403442, "uuid": "56b02d92-0699-4f1c-ab1f-89ee859dce80", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1e12cd-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777365070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365070, "uuid": "1a51b566-5fc0-4e61-b2c1-e37729e1c930", "comment": "Malware payload (Mirai)", "value": "31ff1bb571125b34b28a00af34fcb833", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365070, "uuid": "1c11b770-4958-4313-8562-1121a9f45f9e", "comment": "Malware payload (Mirai)", "value": "d0d854e91f52b8cf8e852ac2accc50eae4d80a034c29152eac563f667f76a3fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365070, "uuid": "e947215f-9d50-40f8-bcec-ef1a466b052d", "comment": "Malware payload (Mirai)", "value": "ecc5a9bb1569c851db4452d8f20ab93b58982d85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365070, "uuid": "4d7a14a4-a9d8-4d22-ac40-1d2eedd45168", "comment": "Malware payload (Mirai)", "value": "7fc756e8edd278f96d6fc5cfaecc97c77f9da0f4a3034038e92f8624573024c3d8906b138c0eb251b1e97f361beabd1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365070, "uuid": "051b7ac8-c8e6-482e-8bbb-25ca426c43de", "value": "T174631A07BA428BAFC14FC1F407F7653A9922BD7E0A36E1E5E3E4FD861A05CD05A1D624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365070, "uuid": "a7e7ef4f-cf47-41d1-94a9-7fd2c4bd49af", "value": "1536:3a+HEHxxnBlPS2GzRRlTN5TmJwbE7FjBApucuL9Kr:q+HEHvBl1Gz5NtbbE7JyccuUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365070, "uuid": "6a02674e-069f-4cdf-99b0-7210117559d6", "value": 69592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365070, "uuid": "f5da39de-4bc7-4db3-97e8-a56e84d0292c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365070, "uuid": "e3cb42d2-dde5-44d5-8a2b-942666284b0e", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea02bb4-430b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777385126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385126, "uuid": "24ef97a1-22fb-4a07-9fd5-e1eb7e3192f9", "comment": "Malware payload (ValleyRAT)", "value": "b850b0782ffb02d8eb6616064b5dd1c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385126, "uuid": "ebfcd427-5bd8-428d-a65a-9a5556edc57f", "comment": "Malware payload (ValleyRAT)", "value": "d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385126, "uuid": "8fec9b99-e4cb-4c1f-bd67-d96e97491656", "comment": "Malware payload (ValleyRAT)", "value": "b97bc7ca5f62c5fc433e1845c879bec5d8574e0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385126, "uuid": "0a8699f1-b737-49b8-ba4d-4e8c3ccf526d", "comment": "Malware payload (ValleyRAT)", "value": "4ab8b48f5bdf5ceb98f682daefa002f527c32c25953df572a4cd5f3bfd0feb92d2fbce7de2107b9ddeaf150fb7a21b15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385126, "uuid": "2c5d453a-36c2-45dc-82cb-3d181a116086", "value": "T1B4663332BAF4F6B1D92519312A44977340786DF5FD2163AF2B9A396E4A300D05D32EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385126, "uuid": "f0d8927a-a7b8-4820-8377-b8a14d598daf", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385126, "uuid": "64b19a1b-1c1f-43d3-aed3-c52a20187bae", "value": "196608:0VP6DFjFbwZBMCbtSqUTq458eVS1GEihreGUoAoEQKXm:W6DBFbwDMUMnTqr11iIsEQAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777385126, "uuid": "fee7e161-3335-4764-899a-3a158153f444", "value": 6516254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777385126, "uuid": "513a1b8c-d8b8-408c-bd42-67563a5223bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385126, "uuid": "0ff7bf1c-8873-414c-961e-c5298633bdba", "value": "d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c47f26-4295-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777334733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334733, "uuid": "56b98c31-3860-4f55-ac43-c87eae7daeec", "comment": "Malware payload (CoinMiner)", "value": "ea1d8763dee3307e3f7ce7b6a5a42f4b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334733, "uuid": "021f44ab-a57b-405b-b50c-278b22e15833", "comment": "Malware payload (CoinMiner)", "value": "d110dc2257e2844995b765bfa8f926e30a09f419f123b752639a943a8671244b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334733, "uuid": "8163bbf7-edfa-4481-a6de-1e4d45e484db", "comment": "Malware payload (CoinMiner)", "value": "d7a26101ebb59cf9d18281100814f5b1e1a5cced", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777334733, "uuid": "f8063d1d-88dd-497b-a38b-aea3a09ade3f", "comment": "Malware payload (CoinMiner)", "value": "e9b1d4fe92b4b0f67d4822cfcff9fa381643c2fef43faa1aec5c671c0750012a899fd6530bfec72d206f490a650df96c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334733, "uuid": "bc2d6861-888f-46b8-80b5-0f3b34347160", "value": "T111C533D8C1F2A8A3210D283EAB097B336E9C4ED2ADF31C92DD549995053B9739B4D173", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334733, "uuid": "a7098e5a-ed1f-42a8-a6d0-b2b5a273877f", "value": "49152:eufwaDuXBuGpnIuXf1a/bFoEQyv41Kd/oOG+quwduVh2uneI8dFv:rYaDuXBuGpndsDFXpaKNoOG+XwtEl8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777334733, "uuid": "15b8b8ae-b434-4460-bdae-ab96da297632", "value": 2653648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777334733, "uuid": "98a026a0-ed39-441d-b7f9-85764d87c63f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777334733, "uuid": "43578331-5f90-4557-9d3e-f07bb4e9c5c1", "value": "sys_provider", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c6cdbf-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355322, "uuid": "201b3d58-9096-4c07-8fb7-5dbb131fee53", "comment": "Malware payload", "value": "a4f9cd5b5ae38c731dd7637aef45c645", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355322, "uuid": "821dc15e-fcbd-4398-8db5-7bf00e2e46f6", "comment": "Malware payload", "value": "d11e1979f883aaa5d01dc11493f6ef951857fd78f24aab263c5a89d1b9b57864", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355322, "uuid": "4e08294a-00fc-4fc5-968a-b81b908cedb2", "comment": "Malware payload", "value": "d89aafa78a4e52b846100edfcf62bcd69815011e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355322, "uuid": "ea66b4cc-3186-4062-9955-5d2bcfeaac5e", "comment": "Malware payload", "value": "68176e5c73727650d1b19dc2c6aaf7c7479d08a31155e3a31ab9ebcd1946f083a73e996cb268e26738cbd8870dee138d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355322, "uuid": "900da6ea-6eff-4ac8-be94-2ef727e69831", "value": "T17A642B203AFA5019B2B3AF55AFF474E69E6FBB633A06A45D1051034E4B23D40DDD273A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355322, "uuid": "43fb2d88-f241-4104-88ef-1c4187a6962f", "value": "6144:ep30MRQtMAZp295Jgh5cuYWdfEZAoUscEw//yh1AE6X7odKOJh0bs6eg3:bMRQtvZuJgh5cuYWdfEmoUscEIKh1AEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355322, "uuid": "ffdeecd0-6a16-4668-9b52-47bd94fbd9bf", "value": 325466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355322, "uuid": "2150f15a-a7a8-417b-8da6-3790f4b21e27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355322, "uuid": "0210b5aa-a0e0-44df-96da-7fc6e89e6699", "value": "Overdue Balance Invoice for JAN-FEB-MARCH 84030229996067_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b0110c-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355481, "uuid": "a58ec1bc-23b3-4673-a15f-611fc0bd37b4", "comment": "Malware payload", "value": "ac5c36866e0d44f6e1bcad2ddf55288b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355481, "uuid": "57cb6caf-428c-4550-8665-45888032cac5", "comment": "Malware payload", "value": "d1f290d3ee119c7fe1b079d39b7456b3d8539edefbddd8df5bb195934c44e61d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355481, "uuid": "788bfa4c-e830-428f-9e39-fc0918da8b21", "comment": "Malware payload", "value": "ebb1a88242e222aaaf9312403dacfd5a3f92cc35", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355481, "uuid": "2d31e7ae-a626-4078-a5b3-e4386842da4d", "comment": "Malware payload", "value": "8d6782a2e1d1d0337932e173d3580955e910555e7bf8f38024d469034ebf64e17cccc4fed9c1b8c8748b480f2e9c8225", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355481, "uuid": "ab85285b-f439-4204-b413-0cc3a1fbbfab", "value": "T1823712444E9A678D8368136E487EED8D9E9C8C88429D3CFE07733C752E4C764257A36E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355481, "uuid": "38c8f3e6-91a9-4bc1-a741-cd30a222fcb3", "value": "49152:awdMaGwdMaOwdMa+wdMaXwdMa3wdMaFwdMaEwdMaZwdMaEwdMaywdMaXwdMaR+cV:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355481, "uuid": "b6d3aa58-9023-45a9-b99d-695ebc8c0721", "value": 23424216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355481, "uuid": "d68e902d-8489-4d32-9b58-f03d68327e4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355481, "uuid": "61484880-b8d5-4350-b8f0-940248c985c4", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8b0e92-430b-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777385123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385123, "uuid": "b6d339d4-21cb-4c7b-b71e-4fa754f2fad9", "comment": "Malware payload (DCRat)", "value": "06fdb48d415ce4d6bb0905b9a01e47c2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385123, "uuid": "79a3d171-9121-487f-850c-3475e837bb05", "comment": "Malware payload (DCRat)", "value": "d215719dfe941d851cd23344f229bf64c7a50994b334c891ce15b127ef433510", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385123, "uuid": "69d5bb97-536c-40a0-a250-c73ebdad0798", "comment": "Malware payload (DCRat)", "value": "fd9523a183079bcfa39aa709a68639182b893a74", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777385123, "uuid": "56ce41a2-9ade-45c6-be0d-6092a53ecab7", "comment": "Malware payload (DCRat)", "value": "c02fff574a5bbde52e600853cb083dd90becfd4708accc7c857a85b784432af0cbe13f2e3a0be406dd7a4acf97419183", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385123, "uuid": "3d939630-0eac-4e2d-af71-c6e1b6202b45", "value": "T1AFF44C5333EDA3E5D0FFB37090A64A5A5330ECA3A6A5E71F049952600ED33488977B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385123, "uuid": "6e03e7df-a73f-46a6-95e8-a9c5407147fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385123, "uuid": "ef85ea08-f517-40ef-a681-dbe8850c4965", "value": "6144:7qqDLOObBf5tUgvk+HyxcQFcUdMOMJa1DHjzCytSi2OFbJKnblNGaN+SZxh8D5mS:2qnOO9BtqxcwdhrjzzcOlWkSZ3y5UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777385123, "uuid": "c712e82f-96ca-48f2-a424-2b9b41228842", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777385123, "uuid": "dd7c54ca-4687-4216-80fe-8d8739976e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777385123, "uuid": "1f5f72e5-d3d7-451b-bf13-e01180e7bc0e", "value": "06fdb48d415ce4d6bb0905b9a01e47c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04720158-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355367, "uuid": "5780a0f5-190a-4780-9109-3a51551157be", "comment": "Malware payload", "value": "2f263c14cf120b753a3c4b1f5857eb7d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355367, "uuid": "c2aac428-dfc1-45e4-8c4d-c5c9625dc925", "comment": "Malware payload", "value": "d28ed90f51da1d10b2fe8bd45129a40f6fc94425c731faa02f1d67e519bf90c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355367, "uuid": "ba7343b3-4365-4498-a7bd-8ea3bae3ab01", "comment": "Malware payload", "value": "4e3607be0d4d9643c40ada86d06af38c8af363bb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355367, "uuid": "fb025c40-cae3-4557-a8c7-62d2d12d554d", "comment": "Malware payload", "value": "6d18d561ec7932135062a3f0986c64d0e4baa0330f56408fd05f0da3d0f3b0d4b1ee7574fff62518312c1b63dd716aa5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355367, "uuid": "bb1be607-fbf9-4056-87ba-2248e6e03c25", "value": "T19B37220D1FA9DC2F0A772DB9142B1E1F1EF58D581659B0F6D7E0A0FBA498A04127F278", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355367, "uuid": "013ca3b1-e713-440d-bfde-86f00a3a387c", "value": "49152:SFsDeBFsDeEFsDeYFsDe6FsDe7FsDedFsDeOFsDe3FsDeuFsDeEFsDeFFsDeX6aZ:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355367, "uuid": "2aedbe97-0841-4350-be03-5ca7a1498843", "value": 23164066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355367, "uuid": "cc6b8fc4-63b5-4344-a76c-2d53cdb2f3d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355367, "uuid": "bc84e8e4-5e28-438f-b378-071d360afc65", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8dad32-42ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777372023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372023, "uuid": "4732d62a-e70c-42c5-87e1-d4f5456e1f9c", "comment": "Malware payload", "value": "7a0edeb5bebc51de8ce455f38d9a7670", "object_relation": "md5", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372023, "uuid": "fea99e23-64d8-42a3-a0f9-e3b14ac3fb00", "comment": "Malware payload", "value": "d2e1ab10d5a0c16a724aeda8acb46b38f551ade58137969c3bc3c9cdc0a12425", "object_relation": "sha256", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372023, "uuid": "a21a7f0a-d91c-4e71-a680-3f0cce9ca0c1", "comment": "Malware payload", "value": "c6c299162eae50a1d76ee9f6d42f60cef464fa04", "object_relation": "sha1", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777372023, "uuid": "bbe8d6bd-d7ff-40b6-a682-73b32d1b1031", "comment": "Malware payload", "value": "4f7974032272138e5adf79d2566f0a9d61480f8b0be365c8698725c25f41015b884b80483856e3c4427e9592813abf22", "object_relation": "sha3-384", "Tag": [ { "name": "70-34-205-43", "colour": "#180596", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372023, "uuid": "b446787c-d320-4530-9473-3eee0700bb9f", "value": "T179A5293BDAB284ACC1ABC170AB83D2B1A976FC190534B55F0AC5D7213F4ED705B9E690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372023, "uuid": "b92fe18c-759b-43cd-81ff-573764490f69", "value": "73c4d9a4fab7c8eaadd4946a411a7485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372023, "uuid": "709b5ab3-2b35-471e-9e55-241e4cf0127f", "value": "24576:J3aOWrKyPojLAqbJWcpBFLlYEL3QfiDkXYw6kNObPoAiGCf1rAT:paOsPojLAq1WcpzLlYELAfiDs3r5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777372023, "uuid": "d55720f7-3b4a-4455-99c5-679439ce80fe", "value": 2231296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777372023, "uuid": "86ec44cd-bcea-4182-8063-4f6aabe69f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777372023, "uuid": "f9e747d9-af31-4964-ac3f-759bad3ebd38", "value": "updater.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93621650-42b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777349164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777349164, "uuid": "3653cce8-bc97-4d9b-89bc-628f7b817b70", "comment": "Malware payload", "value": "e2e174d03e3e98e3c27cdb28c3e7854a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777349164, "uuid": "db172b5e-6e7d-4466-b6f7-6a65b364b2f2", "comment": "Malware payload", "value": "d3be2f32d31d5797b6ed5f69b8ad71550592de0b945a11ff4ecd84f6d4abcc99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777349164, "uuid": "d095a9b1-7a65-414f-90e1-9a9740fb2514", "comment": "Malware payload", "value": "b14f519f40d9658eed69f364df1ed1df8bb375fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777349164, "uuid": "0060fe69-b479-4eff-8034-daf818875a25", "comment": "Malware payload", "value": "872c57fb6d1861eba5d536dcfde039f83dc1ee93b6f95c20bfcd0a99e9fa83c4bc526d580b6366b8dd863646ad37876a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777349164, "uuid": "5f2c5e20-b185-43ad-aefa-bf64746b153a", "value": "T19B17BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777349164, "uuid": "9195b76c-6a0e-46a3-9cc5-be6d15132e58", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQb:cqYUQuVDt0TZE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777349164, "uuid": "bf151fd6-50ab-45db-b785-428e0cc11cf1", "value": 19726336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777349164, "uuid": "20be39cd-d139-4dbf-a02a-55326aa0e956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777349164, "uuid": "165cb01c-244b-4371-b681-9fb2ee0680ae", "value": "d3be2f32d31d5797b6ed5f69b8ad71550592de0b945a11ff4ecd84f6d4abcc99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc5c364-42c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777356748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356748, "uuid": "1928c80a-c337-47e5-bdee-52ab8e3e8e1e", "comment": "Malware payload (Mirai)", "value": "c49d50f590098bf96e4c96b62b71c0e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356748, "uuid": "02a3739d-f420-4b54-be2a-dd6244c9e7bd", "comment": "Malware payload (Mirai)", "value": "d3ff060dabbfa251af5943a1389c7b8ffeb3e7e61e773d06d4ed3da1ca41f800", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356748, "uuid": "e3990a52-d1f0-481c-8b00-7d56bb53c545", "comment": "Malware payload (Mirai)", "value": "034d3bf19131bf082348cb64793444e7697c11a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777356748, "uuid": "b62c5b62-ef99-4d2b-9d6f-fd3433cb1881", "comment": "Malware payload (Mirai)", "value": "658eca808cc8c3d822835dba68b3a199952ff6e111c11d6058779a4efc524b29ea4908803b5f3f65ff8d5aae44dcc7f6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777356748, "uuid": "c60f314d-873b-4b96-a46b-4ddd43c8f02d", "value": "T17A51378651E24474ADF6DD12A2E6C4047580E05A3BC0FF8AD6F53CFAA98DF043C49B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777356748, "uuid": "a414cf93-f8a8-4f26-931d-fb5cc87096fc", "value": "48:vqRFRtRHReLRBoRTRERRRZRH9R+R7aRjRNRAc:v8nPxAAF+7DHf4gVvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777356748, "uuid": "9064c1b0-282c-4b1b-8e97-79f830f29f64", "value": 3007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777356748, "uuid": "82f38497-e1f7-4bda-963f-81a7adb5e67e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777356748, "uuid": "3996575c-6e62-406e-bf5e-b52973a68530", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a9bbe2-4338-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777404541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404541, "uuid": "dc68d660-11dc-4371-9414-445447b5f5ff", "comment": "Malware payload", "value": "c9d2ec6151a96392e896a8228656ddfd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404541, "uuid": "41418d98-6752-4172-b989-8d3b1c767905", "comment": "Malware payload", "value": "d4e2f8f5a247bf538e55edb73cbd7ef14cd86a47d9380ba5eb9a3f8f710bf366", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404541, "uuid": "0cb79fd6-ac97-4945-8995-35c0f08b9e33", "comment": "Malware payload", "value": "14ca06a91e16eb8adfac9e5aeeadeb47888ef4b3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777404541, "uuid": "1fbf9ada-546a-485f-905d-627f5fc6bc84", "comment": "Malware payload", "value": "e053683834ec4e3cb17a2899e72468d6fe4e454c3ec000aabbbab2dacb92fa4b424729ef36903b58e0524890c2b5bdf5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777404541, "uuid": "4dc2ad23-3496-455e-a695-64a4422d796c", "value": "T1EE1108ABB61BEC484A4FF8D0465F05236D76A893925601C2A075C530ADFB265D3263CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777404541, "uuid": "14597714-5e32-4adf-a387-c1b1122f09ab", "value": "24:w3b18JkI7HlcWHlcSLiIlcLFY7JlcVcIlcL23t/DXBPQHs77lcIn:Iaq1/tLYJqVsL2RRPQOuIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777404541, "uuid": "9cac20e7-9966-4093-a409-2780c323e7a8", "value": 921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777404541, "uuid": "e13b18d8-358d-40fa-a279-b1989664caa1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777404541, "uuid": "e1527ccd-87ab-4c2b-a287-1450237ae91d", "value": "sys_cache_1964371898.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f021d441-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377666, "uuid": "6009ee2e-ec58-4e14-b141-e424937817ac", "comment": "Malware payload (a310Logger)", "value": "d82686cb929e2198b59c894f7a8292cb", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377666, "uuid": "6e06ba88-8262-4bda-b8ab-25f2bfebbff5", "comment": "Malware payload (a310Logger)", "value": "d701893539cf3143eec40af25c5b7f62a112d33996f077531eff69c5733f4111", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377666, "uuid": "00a3a6ec-382a-4a28-b911-94c6ae0a48ed", "comment": "Malware payload (a310Logger)", "value": "fbda3179af759268a6a41fd7e5099c098fe80d51", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377666, "uuid": "875259d4-eb6b-4603-bcbe-d80181d2e5fd", "comment": "Malware payload (a310Logger)", "value": "e55e2dc857047586ccad4c593d885064e3f7ea6fadc67605277dde0aab678a081e140bff7e33a605549f1c38e05378c1", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377666, "uuid": "a1a004f3-26ee-4521-acc7-1668687e6499", "value": "T1CB957DE39F73C4B4F7671E1810B37D900E208DC74B392270FDA91AAA81B29567A9C5F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377666, "uuid": "87832065-2ce6-4a8d-889f-aa361809aaab", "value": "49152:ZIgk+5I/sF5q0rSi0hZ7+ju80kOXnvPVI:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377666, "uuid": "68bd2528-2f4b-4a55-aa7e-a93ca1e938d7", "value": 2004955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377666, "uuid": "23d5d54f-26dc-4f41-95f5-54ce940d4517", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377666, "uuid": "e0c0d7ba-180f-48bd-a3f5-bbcf770211e3", "value": "ps_afExBnYzNSrQ_1774259732904.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdb19c9-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355359, "uuid": "77686811-7d91-496b-a65b-2c356ea20d1c", "comment": "Malware payload", "value": "9d7ec2fa9a2d2df98d61f21d92b6f0eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355359, "uuid": "79fe23f3-5300-40ea-bea1-ff7243597c0e", "comment": "Malware payload", "value": "d9658261b61fe6038f939fabad0dc449c413d3aa16969b2c6fc72cb8527d2670", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355359, "uuid": "962ba4fe-6454-4ab4-b146-0777289ba49b", "comment": "Malware payload", "value": "4b2d46ece331cf7a758ff76780347af4da20eb30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355359, "uuid": "d0726ad1-61fa-46ae-9f2f-c23d86a20ba1", "comment": "Malware payload", "value": "df3d441f76058687f6c1b2ce0c9fd2f9e36faad5e72feed22fd0331372bb738c89052e8d0bb7f466148a7c509d16556b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355359, "uuid": "246988f5-dc36-4371-af46-ad8601a7ee4d", "value": "T1BF272269DB286C9F073F94CD02AF9E0F3BFE636197E5C5AA5775802D264FB820047249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355359, "uuid": "6ee6938e-dad6-4034-9ada-413f924cc2e1", "value": "49152:apeMhfzpeMhffpeMhfOpeMhfhpeMhfBpeMhf3peMhfLpeMhfRpeMhf8peMhflpee:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355359, "uuid": "7f7f3554-0d04-41a2-b882-865ce700eeeb", "value": 22123544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355359, "uuid": "6f65f4d6-6d0b-4b40-bfef-9554379e75bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355359, "uuid": "6778989b-5c30-4c92-b97f-351c0f0c650c", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d115b0-4339-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777405029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405029, "uuid": "32fb76f2-31fc-4e8d-8ddf-133e7292d24b", "comment": "Malware payload", "value": "19f0da7931e9366808236d913541576e", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405029, "uuid": "b4799cf8-48d2-433e-a18f-466a62e37922", "comment": "Malware payload", "value": "d97c951e84b98dcf0636fc8a7066676943e5a2f0cf4cff66b7da4e9ee2aa0ba3", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405029, "uuid": "ecf96b28-6568-42d5-8ddc-1a1893fb8e70", "comment": "Malware payload", "value": "f581ae67affb597f5d914218f2b62d4a217c6b0e", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777405029, "uuid": "77ae7a9b-195e-48cf-a1f9-d0164cbb64d9", "comment": "Malware payload", "value": "02aacec9717b4dffc29a72b3b3ae688b49dec3a835d59f9935b86499da3c9e911626dba8eb4c2dc0813dcb2b94dc4685", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405029, "uuid": "a281723b-f4c7-48ea-837b-2eb535820c73", "value": "T1DFC73B43A86440E8C4EDD534C9628662BF3D7C895F3427C72F64B7682BB6BD0A67B350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405029, "uuid": "14be6ec0-5f29-4485-b1ea-f0df1b9c5e33", "value": "c2b036f4256143e2d07a4478ca0940ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405029, "uuid": "cf3792ca-1050-48a4-9a08-ca3ff7c11d27", "value": "393216:mHpMcwyvAKgwHpjA1p/QfAjhS8A76/20iWG:ypMcwyviZIaS8Ch0jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777405029, "uuid": "6bec764a-5468-48c4-80b9-263fc908950e", "value": 54944256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777405029, "uuid": "8032cf41-a710-466d-b474-73a7e5d3eabf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777405029, "uuid": "33407e60-ac4d-45e4-8c5f-d4c3ab4791c6", "value": "libGSELv2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b875f8ec-42cf-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1777359534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359534, "uuid": "6b5300bf-4be0-4aaf-8c53-ceb2145f9a76", "comment": "Malware payload (DarkCloud)", "value": "5ffc56b77ccc6e22b7fd5e9f58986c4f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359534, "uuid": "60bb1e81-135f-42af-8e7a-fcf2d2a9d56f", "comment": "Malware payload (DarkCloud)", "value": "da0ac729490ce0ce22aae6c4c8ecb110fca1335ee1b7bbcb4215f646ea299fdf", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359534, "uuid": "fed13d17-66a2-4347-b4d8-9994026fb147", "comment": "Malware payload (DarkCloud)", "value": "ce1b2cb6484f44dcd643b6649a412606590a071b", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359534, "uuid": "a6af5084-fd19-435f-a31d-e43e7e086377", "comment": "Malware payload (DarkCloud)", "value": "8fc681474e7ba2860053a9cb12bea5c6d7dd56904a87ac362e3a71b83bbcdb11aec704ae956d6fe5912c6b6c8e8b93f3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359534, "uuid": "147dea7c-3c60-4fd9-83af-a7ccb4155508", "value": "T14DC43016EA20A42FF4938AB0797895467C293D325790AC57F7805F9934B0AABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359534, "uuid": "3045aeef-f522-4d04-9e7f-0e9a4b0a8b35", "value": "8c5a41e90fbb3bedeb2009d4b945279e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359534, "uuid": "98504d75-dd60-438d-a8d8-bb3c2bbfd250", "value": "6144:cazBUhfCF5wp0zmGbnkGSH6XTuapWHxyO+OSR87UQXtGJQ/YY+b4RRXVE789oih8:cazBS0jl18h9XroiqkzQ1RkT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359534, "uuid": "21ce4794-fa70-4140-88b4-5e9685c89e71", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359534, "uuid": "fce78f39-3b70-46ee-8cbe-e41c1bc85d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359534, "uuid": "414bd3be-12fe-41bb-bf76-46e3d8c62e10", "value": "N\u00famero de pedido SYF20069.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d54bac5-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389312, "uuid": "694e1d7f-17ce-4a86-afe9-631a84a4adf6", "comment": "Malware payload (AsyncRAT)", "value": "713346fa72449965894341356af4ed68", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389312, "uuid": "0bb3b5be-99f6-48e9-be35-a1c942c63bd9", "comment": "Malware payload (AsyncRAT)", "value": "da6546f251345864e2e70ae5a3f4c20ca7b095bd153e73880ddc06c156e628da", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389312, "uuid": "088e2d20-4f71-4dad-b0bf-0079f3411da0", "comment": "Malware payload (AsyncRAT)", "value": "5b6cd25310dda1f9844f30fc9fc069400c1f0d94", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389312, "uuid": "f66314b2-75ca-4985-b7c2-ee27d21bb67b", "comment": "Malware payload (AsyncRAT)", "value": "46d030b553d71e47b637ed9dfe036a42fa96070e1265c85826bd669f68540894f2ff06b7e6514800a51c8caf984d561e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389312, "uuid": "14e5d11e-3dbf-4916-ad8a-efb739c8c96e", "value": "T1941339007BFC1625F2FE4FBCA87951444276F963A932C78E1CC4519E1AA27C1AA51FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389312, "uuid": "8b5bc84e-b5f9-459d-8d45-7306a52fb444", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389312, "uuid": "9147b034-f3ed-4b5a-b42c-34cdc16bffb8", "value": "768:pq7x+2TtNwCnbIRs0ZJnZY2nzX+OBvSvSRCf/uRbheuoVNtJaLvRD+:SCCn2zXbBqqQHuRbguIN6LvRD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389312, "uuid": "51e269a1-05f0-44b9-ad74-7366e8557289", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389312, "uuid": "e5af30fe-fa89-4a84-a8af-2f5d90bb8205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389312, "uuid": "c52769c7-54ab-4bab-9f38-d06a76d3a44e", "value": "da6546f251345864e2e70ae5a3f4c20ca7b095bd153e73880ddc06c156e628da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f6ee0e-42cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777359642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359642, "uuid": "b206e514-abf6-4515-b112-a8e7cdcbab82", "comment": "Malware payload (Mirai)", "value": "2741784a71e94a6e45c6240b2183bdc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359642, "uuid": "3bbc17c1-fd0b-4cde-8a0a-5e290afca794", "comment": "Malware payload (Mirai)", "value": "dc26f325e840b5ddfee9b66bb88c321372420781d5f448c484e8fe7d8e8a7660", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359642, "uuid": "64f51aa4-8755-4ddc-a98f-6f75b089c34d", "comment": "Malware payload (Mirai)", "value": "78c03e93dd6e53928f72057f81ee3cd127fe1601", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777359642, "uuid": "603cd941-94af-4119-8d0b-3fa5d0e67358", "comment": "Malware payload (Mirai)", "value": "836a92f2c1502131dba380f0cfb9524a425fabdb441d49ce73c0c2a076253a771691842af50193642e6a544052d36331", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359642, "uuid": "6d0e143a-62ff-4f86-921a-ce4dfb6eb163", "value": "T1F15339C0A983DCF6DD1146B83177FF328636F436212AE9E7D7D9A923AC81E41910729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359642, "uuid": "37405e12-9344-4780-9706-c896a7854db2", "value": "1536:VMzVhePhrkmetvEuckIzN/hkfgiu5Bs88oUqpY8+3UoBiAGpTLE:VMzVhePlkmetvBcxJhyu5B1QqpE1oAGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777359642, "uuid": "45fbc002-fede-4f59-8506-6c6badd938a3", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777359642, "uuid": "a87540a5-28db-467b-990e-e53a3183a52e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777359642, "uuid": "dd425b98-7786-4b91-bb69-ba6baee67da1", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebecd601-42dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777365633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365633, "uuid": "f5101be5-8d46-4d63-9703-dc0f7d1e98e6", "comment": "Malware payload", "value": "f4de93085831cd9ed37a48be0d30e207", "object_relation": "md5", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365633, "uuid": "97fa5d78-4e60-4510-bb26-b8ae5ad2e660", "comment": "Malware payload", "value": "dd4ed604ecfad33688601400dc66b9b7d890142a77f595a8cb9bb98797d3dc72", "object_relation": "sha256", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365633, "uuid": "90b9b6ef-584d-4296-bd67-c1d7fce794ac", "comment": "Malware payload", "value": "f24aaf52bcacdc0d2baf1a2268bd7a768edc5460", "object_relation": "sha1", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365633, "uuid": "92585708-256f-4ba4-81a1-1918cdd648e9", "comment": "Malware payload", "value": "770b45ca14fd9ed80ba534a37b7c2c79426c292aeaab1aeab076d88f506ef4db4e72822abb9cbddaa038577fe1f6b3e1", "object_relation": "sha3-384", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365633, "uuid": "890a0794-ee9b-463f-80c5-19b1bbbc8059", "value": "T1601833F3E6D4F166D2E15AF09A8B63138A762C850EF4205452A6BF3CD6B527CCE70781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365633, "uuid": "abc73faf-16a5-46f3-bb54-1c3487f02267", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365633, "uuid": "57e41b56-d38c-4bbe-b120-84b3c889cba2", "value": "1572864:NCL3JtfoVhojpE1IuhlU8wuaNBsviQ9hDjNNJXqofX/A2YAYZwQ3:NCL3Xgoim8lHwuc4RWofvNYZGQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365633, "uuid": "754af090-add8-4112-b133-3bc001ce690f", "value": 87172376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365633, "uuid": "91293590-69d4-4b29-9521-e32f775c73dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365633, "uuid": "2c9d20d7-3371-4bb3-8ad8-f88619bdc87d", "value": "dd4ed604ecfad33688601400dc66b9b7d890142a77f595a8cb9bb98797d3dc72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc24d843-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1777377633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377633, "uuid": "660b1be4-002d-4092-a06a-7ccbfc8a2dd2", "comment": "Malware payload (DarkCloud)", "value": "17ac1dc6e91e04d2f12c201ff24b70d6", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377633, "uuid": "80de660f-5bda-40b3-9ac9-25234af17a43", "comment": "Malware payload (DarkCloud)", "value": "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377633, "uuid": "f24c7640-af6a-4cf8-9481-0eee40c241c8", "comment": "Malware payload (DarkCloud)", "value": "8a7faf3a5ceda07c0e9a15e67a368c05ad5f8ed2", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377633, "uuid": "24d37cfd-fde1-4f6c-a8f2-54abffe6ec43", "comment": "Malware payload (DarkCloud)", "value": "37abe2131707c01216bb61bca4edfa068dfb05c73f4b15e3cfe4c7c92445f92d1db3f59963e0438ef3deb25a81e9a0c1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377633, "uuid": "1f778f0c-1122-43e0-af63-57b6911812b4", "value": "T122957E8A105F4EF3080C5AF9B6B7838E3D0771165F3454EA68A29AD8674DAD1CC7C98F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377633, "uuid": "672eabfd-f206-4b12-8781-2f5ac158aab8", "value": "24576:8KdvXuir6PdqKEpqwaF06gSFBb/YVz4Wu3RsLmKbknVsUvWAH:8Kd/BPfM7SYyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377633, "uuid": "5f5d0f80-1e0d-47d6-ae17-1b19fb5cae4b", "value": 2054357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377633, "uuid": "c56f2608-8f57-4212-8a15-f03661a2a860", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377633, "uuid": "da225e0a-977a-4484-bb06-103e3789e48b", "value": "ps_6Mo36YxjEqj3_1774343192286.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71e39df-42cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777358780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358780, "uuid": "c523ae50-9509-41a1-a971-a3b150d4fcd9", "comment": "Malware payload (Mirai)", "value": "6006a111eb6baa783b1e7bf8776749ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358780, "uuid": "bfdc6f57-8aff-4eec-a5a6-7630c44b4aec", "comment": "Malware payload (Mirai)", "value": "df9ef49e14e8811abd2da85c212d3470b4894f6f588513cbc07d74d47e2e166d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358780, "uuid": "75184e14-d9b0-4bf0-a07d-8651c106345a", "comment": "Malware payload (Mirai)", "value": "963bd1f0d3ba22d18033fde07db21b14a9a4995a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777358780, "uuid": "6a6dfb4c-e4a4-46e8-820d-f25e7fbd7f73", "comment": "Malware payload (Mirai)", "value": "1bc1f3b83c3f9f38a1c1ff90e68b5d49e205378ccca7f5bd665585268050807ea668a5af179613d0c41d029f1a504d99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777358780, "uuid": "004de7ba-1e5f-438f-b5ab-44364778f4f9", "value": "T14E63079678C19A12C6E423BBF96E01CD332563A8D2DF321B9D212F5477CA82F0D67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777358780, "uuid": "06c41af3-75ee-4f07-9ecf-3c2e84463608", "value": "1536:U69Uvb15Wu1S7+hIVt5f6pxCCpRTYDdOcahWMUOH4g5b9/e35uEfh:U6ex9RgdOvhTqgm3nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777358780, "uuid": "69bc7998-711f-4eaa-b041-22b8f1349303", "value": 72188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777358780, "uuid": "aaf822de-8f5a-4641-b0ca-683d3a03794e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777358780, "uuid": "32e53bcb-af1b-4f23-ab97-375bd85d6baf", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9204f47c-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355175, "uuid": "4221660f-38b9-4faf-a07b-dae081cd6dd4", "comment": "Malware payload", "value": "8844e1e916df5bab38968a54c6a6f096", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355175, "uuid": "e7461bb1-7be9-44b4-87bf-e2b30701fac6", "comment": "Malware payload", "value": "e0091e666cbbf3943b11ee8aa0a0b7edaf409770c691b338435efd9d72d4f4dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355175, "uuid": "5ce24420-42a6-40ec-8c71-9a95b55b7d88", "comment": "Malware payload", "value": "0124d8282a152f947ab4e64ca6881514081f1c0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355175, "uuid": "d9d5d511-0d5b-43d5-9dbe-141dc2a3248b", "comment": "Malware payload", "value": "4195f87ceaf70926088eb2f7f889aa1d61e1465b4f7d6bf4beaba13b95a9c1d61fd60281e474d21897e86ca2906016e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355175, "uuid": "ff928859-3907-4ce6-824a-6972fefd5e3c", "value": "T1303723438FADBEBDAB3C264431792E1F20354EFD010916DF7247FD85866AA14E5923AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355175, "uuid": "d6a45abf-d92c-47d3-979f-204bf8793eaf", "value": "49152:DWCuo2AWCuo2JWCuo2gWCuo28WCuo2LWCuo21WCuo2sWCuo2BWCuo22WCuo2aWC5:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355175, "uuid": "73efa782-296e-4258-b85e-89e00345da69", "value": 23164065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355175, "uuid": "75489407-ebb4-47ce-a5a0-4af3cb69fb76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355175, "uuid": "3315ef80-fdff-4385-a50a-5e56854fac60", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7ce079-42a2-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1777339974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339974, "uuid": "ce62f0ae-727a-4c63-b6ee-454c67b6a670", "comment": "Malware payload (EternalRocks)", "value": "ae42ecb97a5173db2af8f2e00810ffe0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339974, "uuid": "02925f7f-9603-4597-b370-e9974decf0d4", "comment": "Malware payload (EternalRocks)", "value": "e009c2e19e83965c1df175c7355133b77dd1936265306a5bbe15e2083576a494", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339974, "uuid": "184a4b36-b6ea-4582-92f5-bde3c2334238", "comment": "Malware payload (EternalRocks)", "value": "7b154ef97ea5dc76c9f56320d8cf0729cb4d0707", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339974, "uuid": "8915b8da-fcde-41fe-be0e-3592a9ae73a4", "comment": "Malware payload (EternalRocks)", "value": "f740327718e94c1425117debc448ee5837e0a4159e26f071cd1b316c07dab27b7561e9f5c929e92d07b75b5d65efe372", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339974, "uuid": "f167b44a-3ded-468e-abb9-65d00a65d531", "value": "T1D0B52350BBAE0D328B68F2274C6F4E28114C8915A81DA4A553E7ED884DDFF04785FEF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339974, "uuid": "4cdad7ab-d0d4-4a61-843b-c21c6961913d", "value": "24576:gjPjjpJEHkjeaA3jze9RxbkTq7c4UEMKe9vR3H3Ia+J03/Pfji/8OTa0VWPhCpYM:0mTqRO1n91CyvG/8ga0g8YNjIx7e9wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777339974, "uuid": "c03fbd96-a713-4d64-8322-f3301933d277", "value": 2449259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777339974, "uuid": "1f4750c0-78d5-4fcc-b29c-8fd71cd15d19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339974, "uuid": "c0f7edd1-fcde-43d2-bf8d-466fd175b5e3", "value": "dllhost_5a7d.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412e45f4-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364917, "uuid": "67bec870-ccc9-4568-86e0-9e5b6dd9d408", "comment": "Malware payload (Mirai)", "value": "5adc612ec45de627bdd44e2df88ce0f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364917, "uuid": "3399fd62-b3be-4799-9d76-a0256c43fdc7", "comment": "Malware payload (Mirai)", "value": "e01002aeeae438094c6b20532e8ad1614e0fa73abf556bb3a1b0e7e4f1bc38f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364917, "uuid": "96a4dc01-a084-487f-b9ff-f5ee2c6889ae", "comment": "Malware payload (Mirai)", "value": "18de6cd22ebdb6d971f6cf56b34ebdafa84b7c4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364917, "uuid": "9d2c5a0a-2722-40f9-9977-7c2e175d2900", "comment": "Malware payload (Mirai)", "value": "f988e8f72c8e1ebf2b9235d0edc50d13fe1faad2d8d519d7987c9771cb4d5de681dd987794ca3c4274c0101df62168b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364917, "uuid": "34e2f624-8cc2-4638-994b-be227884312f", "value": "T12903F12C89167BF5811359B1FD7092C0B8AA6CF8C29B36B27F44C3A069934551FBDADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364917, "uuid": "25384f7c-9682-48b6-8143-686250a97213", "value": "768:hLAOudD1irDRML2ik/UhYHymHyGIVKh/LOEhnJzBbCMn9q3UELR:hGirDRGkOAyayPAL94XLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364917, "uuid": "23f25eb8-cc6a-4e65-85dc-fe41bbc301fd", "value": 37800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364917, "uuid": "d713ac86-ce17-41d5-8c07-9c8e15d58e5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364917, "uuid": "4c75a4b6-c576-4c8a-8ae1-7645eca84732", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf43978-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364964, "uuid": "4f179a76-1317-485b-8e9e-aeb003db9ce8", "comment": "Malware payload (Mirai)", "value": "73c64b04d3449127b255ff3e5f81f9f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364964, "uuid": "7b495cea-a487-4f25-b29f-6a01df4dede8", "comment": "Malware payload (Mirai)", "value": "e0852bc5d8d782329116cd660f60792797861c2f6f07c0d20e55ec953916ac10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364964, "uuid": "5e71c0b3-015c-498f-a189-c60661767989", "comment": "Malware payload (Mirai)", "value": "c85761c7e4dddf9848191d854f0831402bdb4af7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364964, "uuid": "8df87dc5-b7ca-4e58-8d03-da0f46fb327c", "comment": "Malware payload (Mirai)", "value": "c8347fa946ac31ed918245ca45ebd93c4e12b7827782d844423f993e0eb299131b70f36002ee124b17c196a722591489", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364964, "uuid": "ad42170b-3f21-4937-850d-67a75cf2dc59", "value": "T1D4E2F174E01518A6EFB8DEE2EA90DFC533754D8D76C48780548F5243990782FB68EEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364964, "uuid": "26032986-280a-464c-adcb-bc16300c2b9f", "value": "768:BVJnKkHqjBLBLaXEtqEA6CTwlELCFISFMiXX4uVcqgw09z:BnK4CVWEDngwl6q94u+qgw09z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364964, "uuid": "bc3c01f8-98cc-4334-9ba1-1432b86967fd", "value": 32428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364964, "uuid": "d5095523-12d8-4b1e-828a-3b42a09cff61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364964, "uuid": "73a266a6-6546-4814-b8dc-0d7302c3411f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfd3e74-42d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777361906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361906, "uuid": "bc3256af-5e5c-48ec-833c-e5f2340f3874", "comment": "Malware payload", "value": "f538f730d7662b1b61f546b8eba9a328", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361906, "uuid": "da3921fa-2ccd-4e0f-ae86-cc8b428012b9", "comment": "Malware payload", "value": "e10e51e38beba320dcf279b34750be870791b0ff3b8b560ff9bff0361de9a10d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361906, "uuid": "0791cbde-7206-4264-ab6b-be75ac666aec", "comment": "Malware payload", "value": "f17db459f747c1dcf784267eb8e17e521f1ad5d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777361906, "uuid": "80e67142-d271-4af5-a6fe-9e3b57ec1277", "comment": "Malware payload", "value": "c26f84a1ad7cba33881f3ddffb7e573a4e138e907075d88e3b39796320879b5756961d7c29fdccc22861a88c42d14a15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361906, "uuid": "49842931-188b-4db1-8ccf-45627127ead4", "value": "T1DCA3825E7A218F7DF6B8C73497FB1B34A77922CA2A91C580D1ACD5012E2434D981FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361906, "uuid": "bbeac7a1-4f6e-48e5-8dd6-7c1c04b02376", "value": "1536:fmdurU07J8MtqHxqGPkncW/RVi/wJz8H6xVRFOr4kpmMhId:fma7JLqHxcncWZViTH6xVRFORmMhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777361906, "uuid": "4510ebed-cdea-49f5-8476-40decde24d05", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777361906, "uuid": "edd36d5d-2656-4e9c-a094-0b568f242bbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777361906, "uuid": "0f0b9da5-59d2-4cc6-996e-ebb3f0470e2d", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e6fac6-42e9-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777370566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777370566, "uuid": "63489b9e-1d8e-4e10-9c41-5c4442a5972d", "comment": "Malware payload (ValleyRAT)", "value": "8a439d79b71266e40b932055916c0ce6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777370566, "uuid": "2ad1a51f-f587-4b43-a325-ba8e302c943c", "comment": "Malware payload (ValleyRAT)", "value": "e17d12a3cb758a7cd55d9e0305bc1471d30a7125cb14f3574d47f1bb91216fc4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777370566, "uuid": "7faba346-0de6-4977-937a-48d65e716db6", "comment": "Malware payload (ValleyRAT)", "value": "d88690194f2f9d6c0f85b675f758b7c9f507c8ef", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777370566, "uuid": "0e224f34-d8aa-411b-a930-bc6d9432d64d", "comment": "Malware payload (ValleyRAT)", "value": "346411ad96493168bd770a7a156ab3b1e3778920c4a007e167521ced1aef72836a5266639d171ad3f1f0362800488d82", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777370566, "uuid": "e638bb10-8642-4163-bfcc-97c6ed87111d", "value": "T1A7273320B28AC032D62E0177F5A8FE1E4A3DBE73476041D773E8B97E48B55C29639617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777370566, "uuid": "cdc40709-78cb-4995-a909-91d20178e4f5", "value": "393216:Ai78bPAgKSR5X6jOhDDcpdZR1Do6AvuC0Fs5GjC75/4y3GlRZC4gfbPQe3HqsU:AGq3H5KlDXC0m/fWlRZQfjnHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777370566, "uuid": "b8cd072d-c220-4926-adff-af616cdcb360", "value": 21753344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777370566, "uuid": "a7fd9ceb-37cf-4147-ba0b-5a068fff7c55", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777370566, "uuid": "3750008b-5500-48dc-bce5-60d5943664e2", "value": "letsvpn_v3.5.6_x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4eae15-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403435, "uuid": "a02d1337-b178-4db4-8b62-fe211bc9711b", "comment": "Malware payload (Mirai)", "value": "7f3ac60d24dc73f118d01ee9d29e3f4a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403435, "uuid": "f6833171-b340-4cae-984b-2a590b73b059", "comment": "Malware payload (Mirai)", "value": "e1a8e93dcbf6946e433e8700ff0229968f6db06c0795c548d07f5f06d94296f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403435, "uuid": "1ab77ed3-d834-4e2e-9f63-7caaa9986101", "comment": "Malware payload (Mirai)", "value": "2cd96128f8d53e9aa3286ce6aa434e6c78eda486", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403435, "uuid": "f5f43c10-da46-4609-859a-028c2162e81a", "comment": "Malware payload (Mirai)", "value": "d2cf2044079e1cbbbaad7d5f19aeb18ed60f9f3b73e5eba179eb4a025f2ccd0b38808d1c01fc1afdf8d32389c75d153a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403435, "uuid": "874cc436-9867-4356-9e53-f34f24a30fd4", "value": "T15AC30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403435, "uuid": "0352488d-24f0-4c1a-bf6b-8783390c7442", "value": "3072:fWD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1Y:fWD76aX9aKTcRQVnoiYq1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403435, "uuid": "4c75cf70-e6c1-40c6-bb9e-15a90ef1ebfa", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403435, "uuid": "4be3e6a9-98af-43eb-96d4-13e2bfff7fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403435, "uuid": "8d5f29be-d428-46b4-8266-9b0b9934e22f", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f248760b-42ac-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777344599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344599, "uuid": "188a4fdc-fb68-4f3d-8ec7-f24150e14670", "comment": "Malware payload (AsyncRAT)", "value": "dd243e2630d41a767647be65128ea473", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344599, "uuid": "c1febfd0-e40a-437b-9f71-3feeca4573f6", "comment": "Malware payload (AsyncRAT)", "value": "e2c0b2a29fb336e68031e00817a7d0808cc21d440bba3cb5b4b0bd835cda31a3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344599, "uuid": "da34540e-cbb1-44f9-9895-9a837f0220ce", "comment": "Malware payload (AsyncRAT)", "value": "50788d68813eeba5428c63a63bccbc214c1d39ab", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344599, "uuid": "0c136a36-ec0f-4a5d-b1c9-f11b2419456e", "comment": "Malware payload (AsyncRAT)", "value": "772bd19485f6945d54679a28f5e78296f5df2c88b34b1b5399cb53bdf76f2c14f40d6b606259152f1273fe185e0ab1b1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344599, "uuid": "c9b6c5e3-54e8-4c41-9e90-322852f36c3e", "value": "T13F348EFE75724470A9A1F1801E19D049071E1369962B85747D2FB2CE3BBF91FABC60B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344599, "uuid": "3a9fd5d2-2bea-4341-a242-8bc05e14f049", "value": "6144:4bl1cY9CIiOGIIa//Uj1MnMuQ3KKQY6aTWst:4bl6Y9CIiIBSf3KKQY6aqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777344599, "uuid": "bca06994-e631-496a-ac79-159808cd721b", "value": 252512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777344599, "uuid": "4f082f8d-0567-4777-9d7c-dfbff2fa93b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344599, "uuid": "c5aad0f2-f6ca-4ac7-b341-e578470f555a", "value": "ps_TniJRf2teSIa_1773827072661.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e6235e-4328-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777397596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397596, "uuid": "cf1d5884-f98c-402a-99d9-0a6f920ef465", "comment": "Malware payload", "value": "fc9361e543d00933673ee7e70ca1665e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397596, "uuid": "07e48599-c1b7-43b1-8fdb-36483a887348", "comment": "Malware payload", "value": "e32e45c3fd9c21be9054bfce2f451b4c95c4687e57931f6f3697982c7443a0b4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397596, "uuid": "5e38a964-81bd-4337-b2da-52aba18688f1", "comment": "Malware payload", "value": "6d295428e857841bc7a96f33eb85d91f98166d78", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397596, "uuid": "603d7cc5-4e0a-486f-847b-548fa8008a7a", "comment": "Malware payload", "value": "eda8f25902681568fe62b82ddf84446f61090123698814801f60ba435c6da254925962f4bcb1f0bfac2bf14a650eeca7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397596, "uuid": "5c65da74-302b-4b7e-b9da-3eb0d2beae9c", "value": "T1425733D3D0710757DC3B88368A78FA9901AABD55D902482FB65CF3A984BF6E270FE015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397596, "uuid": "a30231bb-4a19-412f-879f-2bac9340de67", "value": "786432:MawzXorEkqe3d/QzEBRapgEjyTegu8EN4h:MaZrEk131QzETEjyqg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397596, "uuid": "c15754c3-466a-4c6e-8b60-45583b212380", "value": 28663808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397596, "uuid": "a907f3ff-e60b-47ac-9c90-eddcafc9ebe1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397596, "uuid": "b2a3599b-ef74-44da-8e67-31df57dd94cc", "value": "Deconstruction of Emily.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac59911-4343-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777409279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409279, "uuid": "5475b624-e30a-460a-935f-c0c97d4bab67", "comment": "Malware payload", "value": "b8e7288656eca9750a5490aa96d3594b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409279, "uuid": "9d9ff997-2ba6-4e23-b758-1bdddec278ad", "comment": "Malware payload", "value": "e41c635e4c3514e266d143d544ad1abde5db3dcfe6cccdf9bb7a218003f8ab6a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409279, "uuid": "aeeaba9a-ab17-42d4-a6b6-4dc9d51d8262", "comment": "Malware payload", "value": "c2dd8051d89c4efa71bd67d2df7d9b4bc3e67810", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409279, "uuid": "7552ac39-af82-40cc-9737-b1bc0abde78f", "comment": "Malware payload", "value": "2bfff486ba48316a195bd5909f01e0d668155f9cbd20f84288105aea1bba04d4c4f44ac1d724f6beda8610cea043aa1b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777409279, "uuid": "b6dd7dbe-4a16-4c92-b47f-88860168b1ca", "value": "T140F186B67530D6703959D02CA347826095E7377BBC147888B0EEB968AFDF9486174F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777409279, "uuid": "adbc3541-5a0b-44ee-874e-4f31f3601ced", "value": "192:OPFbBHTK+gLZKa3+I2kesQGtMD4uVX2yR:OtbRbgLZKauIqGmD4QX2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777409279, "uuid": "461cc47d-d2e9-44f3-8870-ff4322bb4129", "value": 8167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777409279, "uuid": "76847a21-b6a5-4ebe-844f-c464ce77aa8a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777409279, "uuid": "0e206844-f18c-4ed8-b280-507b393fa177", "value": "bootstrap.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6f0cf5-42f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777377096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377096, "uuid": "67e3eaca-8eeb-4270-93f7-f6c65a924892", "comment": "Malware payload (Mirai)", "value": "0e9162c79ad4c67b2e6135ce8ea107c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377096, "uuid": "a05813df-63e5-4822-80bb-0aa5f4c09014", "comment": "Malware payload (Mirai)", "value": "e490177c34835ee0b3df65b8c189b7d17d2cde256ab2547993dafe5c27b5e1a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377096, "uuid": "39d6665e-97eb-4876-8285-4c7e3b5de6da", "comment": "Malware payload (Mirai)", "value": "88c8052630299ab410bed6a7210013f6cfaf9aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377096, "uuid": "02d6cce9-f2b3-4e9c-a13e-3233bec31ccb", "comment": "Malware payload (Mirai)", "value": "1df7fb1900a424aa9d11a01d535c5b399b930ddbd284f7414b13a1f6888a878ce92977addaca38e0a0a7267668328040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377096, "uuid": "e97ac9c1-b68b-45df-8d35-51758557a316", "value": "T169336B02FB83C0F6EC5305B5453BB36F9632D91A9031C69AEB599E31DC17901A76B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377096, "uuid": "20e9a501-4869-4df2-b9a6-f797c9619ff5", "value": "1536:9tX5P/IWHcgYfxbye18HKlHaPOCbWUsrncaWdg:9x5V8hxbl18Ho+lb3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377096, "uuid": "c133ed35-34fa-4fd1-a3aa-5aa42a21b0e8", "value": 54376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377096, "uuid": "35f144bb-9210-469a-bcf3-5b4a9cd51aa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377096, "uuid": "a424648e-fbc6-4465-a4fa-88a369b83c44", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275bcf64-42a2-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1777339963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339963, "uuid": "1c9219bf-9f2b-41bf-92d0-ff7ca3745612", "comment": "Malware payload (EternalRocks)", "value": "5579c9b152719a496203130827484ec9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339963, "uuid": "77cf0eef-5a07-49af-8d81-add1aafd1634", "comment": "Malware payload (EternalRocks)", "value": "e4dc0ccbc6bc6e2cf2a4ad0d6b949c121c8fcb4ba6e939909d11ba1b6b294cf5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339963, "uuid": "8cbc1b45-f63b-418f-b9fc-1be5fb6e321e", "comment": "Malware payload (EternalRocks)", "value": "5cf1850b8189127fe3d2011840011d5d243d5961", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777339963, "uuid": "46d2ff96-5121-40fd-a948-2074acd9e8a8", "comment": "Malware payload (EternalRocks)", "value": "70bcd6a86459275a5202a8d3ed947cf0e191a2d0d5806ff169e6ec61289b42e8214c639e48255ba99a8485aece621343", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339963, "uuid": "27b645f8-1897-47d2-a6ac-ae2f4ffc46fd", "value": "T1EB952385B9772E5C079C711FECBFAF1846DA4B5480587094AAC2BCD553AFF2C502A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339963, "uuid": "a202ce73-8e64-44c2-80c7-4fb65eef87f8", "value": "24576:BQQzNT+zI+FXVWMn+BSTJ3sn/3yUgTLgHv4zuY8ZDSJObBav03vcwJxtAf9XZSCR:BvzyFj6vY8gJi4v09Of5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777339963, "uuid": "71c9691d-6f03-4484-b812-e1d9ce1c8a85", "value": 1909500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777339963, "uuid": "2b1eb194-6c03-4ba6-944f-e40aa7c44613", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777339963, "uuid": "76dba1ba-1a95-4aa3-8eb3-75997c210683", "value": "dllhost_11a4.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae8eb50-4348-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777411507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411507, "uuid": "2e5cd250-ca56-473a-bbcd-a63f6265e912", "comment": "Malware payload", "value": "263ebaf24aec7b8201dd6c5603395266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411507, "uuid": "00e5012a-92f5-4cf0-a617-f9659ecb523a", "comment": "Malware payload", "value": "e4ec88f2661cc810fe7bed74adfa0e944b963a6b0e2afa2b332dbdd08302ad2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411507, "uuid": "9d5f81f2-16cb-420d-bc03-cdd6e3dc0512", "comment": "Malware payload", "value": "e25311201552613e1a33554a3df5b61519082bcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777411507, "uuid": "31576f0c-8362-45e5-b260-6994f1222cf2", "comment": "Malware payload", "value": "9fd7bfefe89ff45f9fd994d6c12da385046447814e2428be9119a6f87e607c75091c7b795b0f609bafbbc339337e8141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411507, "uuid": "963c0ada-7abd-4f85-836a-097f1ae94cd1", "value": "T120451261FF09C591C04D0AF6CFFAE17442B24DE66501C223A6E9FDAF7DB8B8164385A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411507, "uuid": "b838c247-7b68-43ea-8b85-eb1d450b4ebd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411507, "uuid": "3d55143f-1f97-4d75-9d28-a6411d4afbdc", "value": "24576:QpTZ/iC9rct46en6pJKv4cjq/tZ3i6t1:An6gmZ3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777411507, "uuid": "08fe4e5a-4c0f-4c8f-81b3-a83acba8317a", "value": 1232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777411507, "uuid": "a4fa5469-1b5e-4480-90f4-1b0f5acd33f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777411507, "uuid": "c8f49ce4-4a6c-4937-8c81-a06805cd7fde", "value": "Quote 240145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193c4343-4297-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777335215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335215, "uuid": "53c3ddc3-ceb1-405e-b8ab-b2ae3d52d21c", "comment": "Malware payload (Mirai)", "value": "d20e79aea543714caad91eabd8191925", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335215, "uuid": "f4b52044-cbe3-44d7-b801-1c8caaa4f80f", "comment": "Malware payload (Mirai)", "value": "e53104b916468affd30dbf2379440828a72779e49a0deb55c61d62ee8185cd82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335215, "uuid": "a8a7dedb-d1b5-4b2b-8606-899314b6255c", "comment": "Malware payload (Mirai)", "value": "ca43f9f35a27fe21528204945b6962a6ad882f28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777335215, "uuid": "6fdd34ae-566f-4593-b0ac-4fb732e9f632", "comment": "Malware payload (Mirai)", "value": "66c07a636c4f6e1db578df1f3718ebcc113d609e715c049c07f832b39aac9a51cbe7f16a091a12c5905bf30296f326ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335215, "uuid": "90b242aa-a9b8-483d-98a5-1f83d7ff3f9b", "value": "T101730239E52A1C51AE3BBCBB5E1F4919F716A7F8868E7CB3D9100D49B0EB40B45248C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335215, "uuid": "c26725cd-c177-425d-ac80-0d23ca79f87d", "value": "1536:/Z4j5jluS3nCQMlX192OCX6k/P3l1L2RZmpIhqA1fLpDXJeqFBdDaDrH+T:/qj3IkO+6a3i8UZdLZZHFBdD2T+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777335215, "uuid": "b98ae4b0-9dec-4369-ab3f-ee156c08555e", "value": 73544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777335215, "uuid": "b6fd7306-ce9c-43d8-8ef9-f4d357d0a4b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777335215, "uuid": "27c4af2f-a482-45cf-9ac0-e6a57948cdff", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8ff593-42a2-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777340106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340106, "uuid": "9f74a28e-b4c2-45ca-98db-4c96d58920f7", "comment": "Malware payload (MassLogger)", "value": "d321c4f7ea03e49af6e52348502ac20c", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340106, "uuid": "d906323f-7b64-4699-ae0d-acfd3bd320d1", "comment": "Malware payload (MassLogger)", "value": "e65ca8cd1fd6d9d2883e800cf2a2c1c9cd7f70d82e02de4780f2ce38d0c18d60", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340106, "uuid": "d388651d-a5d7-455f-87bf-2ed8aaa9032e", "comment": "Malware payload (MassLogger)", "value": "e4476ee5d3df92707ed6be1e3f6f9311ce6b1893", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777340106, "uuid": "d33ce886-62e3-4342-99f8-f40f472f9fcd", "comment": "Malware payload (MassLogger)", "value": "32d2e771b2b7eb3f9d1460a8a3e07556882c628cb0216af8c82d5f271de86a7596fccc5edf4641a81925f183fe1f7ca5", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340106, "uuid": "ce1e9efe-ee64-434b-a282-3660f77b6d59", "value": "T153352370538C1E36079CA12BB07F0DAA17719F32A6D4A1A7D2D445C70F6B79A8C2BC6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340106, "uuid": "9e582903-f048-4cd2-9e0a-2db17ce322ad", "value": "24576:iOrU3tUBysZfNg0U9PNLaIM2LeZ+4Ex9X5WDbS9lpCog:iOrIkTG17M26P6AGoog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777340106, "uuid": "0c3922a8-5f69-4e33-abbf-3501e68d0f6d", "value": 1114961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777340106, "uuid": "6db53fa8-d335-4e7e-928f-7171606d6d21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777340106, "uuid": "33838816-9e6b-41dd-8a25-78e17dd1d116", "value": "2TEI43Q1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad07fff-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403266, "uuid": "87282560-ccaa-4283-a60e-a4997ce5ddfb", "comment": "Malware payload (Mirai)", "value": "3cec3097597da45ad75c5e8497c39254", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403266, "uuid": "4af8dcca-21b5-40e5-afe7-9f0bf053b4f1", "comment": "Malware payload (Mirai)", "value": "e7b27f4213052b87b7be6780edd5eb6fed923520426bd8b16d2475e7fb5c7ca5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403266, "uuid": "1fc9688e-d2b7-4caa-a73c-543ff06d9c2d", "comment": "Malware payload (Mirai)", "value": "422de63d1be3ba87a1613e74cba3083b41d94757", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403266, "uuid": "cadfd228-8d95-47a2-b959-6c2b1a437315", "comment": "Malware payload (Mirai)", "value": "ab5fd859218bdcbeb0af0d495ea0a4ff88083e98d115fb979d1859ef71df95b91756862835646e5d7f8ee134b12a9840", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403266, "uuid": "f298d2a5-a72c-4a72-a77b-aea7e5dd165f", "value": "T119E3F946F8819B15D5D155BAFE0E128E37231B7CE2DE73029D246F307B8B8AB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403266, "uuid": "c5350658-c0bb-4dc0-a303-e8f92a049f59", "value": "3072:SJka/4INA/jkXXNJfvYaP0rZ30B6a/mr5sGbfAM7:SJkahigXzfAaPyZ3k/cPfAM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403266, "uuid": "d57e9306-135d-47c2-a126-ecf9beafcb40", "value": 154160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403266, "uuid": "9b2a805d-7517-4d29-85b5-c5ffcb33bd3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403266, "uuid": "d8c87c53-c1ba-4e7a-b249-1c887da0785a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad42912-42fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777379429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379429, "uuid": "6dfba712-1abe-40de-89ee-9ac65355c7c1", "comment": "Malware payload", "value": "171c7ebc0feaede321440ff043f744c2", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379429, "uuid": "ddd5f70b-c7fa-4802-a48b-1760b05863bd", "comment": "Malware payload", "value": "e7fd7393fe93ff7529e49f1f340e201eb772c022c4e2227f1ee23b7e57e6afc4", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379429, "uuid": "7a0e85b3-7a72-4689-aad9-4bde04402437", "comment": "Malware payload", "value": "e13aeaa74ebd7145cc2e71c08a846b238a20a710", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379429, "uuid": "af8ad7ca-dca9-4eb3-8115-7a650bff6823", "comment": "Malware payload", "value": "b13883e8dfb2754999217ef77b51478fd42d1e4f0c8c818946dd663693315791b1e27b8aa754a27dd1645708ec98ea27", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379429, "uuid": "92940871-df03-4ea8-9b27-bffacef6f29b", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379429, "uuid": "c6e550b3-3342-47cc-8c84-5a22237e45ce", "value": "3:VSJJFIqF1F65IFihA:s8qF1FEhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777379429, "uuid": "24ea3f0b-0cdf-4400-9045-a7e817f464af", "value": 44, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777379429, "uuid": "ceb59f94-66e7-4a04-806a-55dd94e14026", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379429, "uuid": "ba5d885e-85a8-4c7c-8396-3747081523fd", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5416ff66-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364949, "uuid": "e2d64721-e88f-4913-a2c1-9d95cd8ad965", "comment": "Malware payload (Mirai)", "value": "926f87225269ab2d5d4f0030d302bad9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364949, "uuid": "af2db121-d615-45cb-bd61-e40f4b12272e", "comment": "Malware payload (Mirai)", "value": "e8d2e5f04ea161a44be933d81609a2e6e05d31f7b28281562fc76969cab7e207", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364949, "uuid": "03b4f37e-0c9e-4179-99b4-d5c6cc450955", "comment": "Malware payload (Mirai)", "value": "7e411b2f66b8429d6574406e034197eebf4fb4c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364949, "uuid": "8776073b-71ed-4255-9344-4d15a41c9a99", "comment": "Malware payload (Mirai)", "value": "5e370f8d26d9f0de04480e2d8957a7ec0006e473ef2454e5267a4b577cb5fb61392b73ab0720295e995f00898b7be3e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364949, "uuid": "675b7976-543c-4cb8-93f8-150417ff4ca6", "value": "T18A5302F2414ADCAFEEA14479AC3A4245355B52E834EAD74315AF14D87C00E889EFCE8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364949, "uuid": "4a0ff3bf-d048-4f91-a227-e4ec0ac1d389", "value": "1536:w2fLIlWnwkNvpuWHpPA/TmSnGSLddLo58abD:w2DIl5kNRVHpPA/T9nGSDLo58YD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364949, "uuid": "e3fa5a38-d5ec-4e09-85cf-a247ea21df4f", "value": 60748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364949, "uuid": "8e65998d-d014-4850-a048-0de7ea264d33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364949, "uuid": "09d8921e-4177-4f02-a04d-0a0fad59e3d8", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015553e5-4315-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777389292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389292, "uuid": "8bad43df-1a1c-4cbe-826b-f9bcb0fdceee", "comment": "Malware payload (AsyncRAT)", "value": "0fa298434a39325dcc5fbb5ae4681176", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389292, "uuid": "be25fa5a-0a17-4291-a36c-804f029498fc", "comment": "Malware payload (AsyncRAT)", "value": "e909025a5a6a3a8b41bbbb8097178e30e2b79e74709fc1711cdcbbbb997ff342", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389292, "uuid": "1aa84d3b-964e-4eff-97cb-25e467c72528", "comment": "Malware payload (AsyncRAT)", "value": "5dc170b38c183cb5d721ffc7a6df8c8cbe9086a6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777389292, "uuid": "9cc80bed-bcaa-4176-bd59-b955bb1a05f3", "comment": "Malware payload (AsyncRAT)", "value": "7f080f7f6c7a759dc88097ab7ebc96f9b8d295d7ae96340d45bb6a2ba6f5bcbeeae3a45d07097afc1be3e6664119cf0a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389292, "uuid": "ec917218-bcc8-4e22-8cba-e8a7bd6980af", "value": "T1921339047BFC1625F2FE4FBCA87951444276F927A932C74E1CC4508E1AE27C5AA91BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389292, "uuid": "8d78a666-0ecd-4b14-91a5-ef068c9d9a12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389292, "uuid": "a4e166b7-744d-4409-8086-86f1687a7f01", "value": "768:Aq7x+L9gmniIRzkYannQQd6MOSvSRCfHuRbheuoVNtQPLv6D+:6gmjanQanrqQ/uRbguINQLv6D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777389292, "uuid": "a1fbe90a-c0ea-4ae6-9af9-22f2629b594f", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777389292, "uuid": "022f72f2-405e-456c-8e76-5c2186222645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777389292, "uuid": "7f5c067d-784e-42b5-9f62-d9a6af888ef5", "value": "e909025a5a6a3a8b41bbbb8097178e30e2b79e74709fc1711cdcbbbb997ff342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fde63d-42a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777341733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341733, "uuid": "3054c0d8-4b4b-4f1b-9a79-9ee9b912d0af", "comment": "Malware payload", "value": "dbfc1ec2e1903eb5b1cf17ab04e983a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341733, "uuid": "c64a00df-f637-4863-bf76-dd3aff676823", "comment": "Malware payload", "value": "e90cf4e769a0e61d6aa7099090604ba79ab399823991fa6d718b492609030f37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341733, "uuid": "8cceac44-4a0b-459f-bf4c-a6d6dd7da373", "comment": "Malware payload", "value": "f5bf584b8ffa1c093a722f41ea46610090329d73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341733, "uuid": "b048ddaa-91a0-49f5-ab0a-9f59577a3b39", "comment": "Malware payload", "value": "ffe23078286904cff5ab037c5a4631ad4ea2efa4684c8c7b591972afa39ea26987489e19ec81d1681745d8e1b2a8c83a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341733, "uuid": "99bb2418-3889-48f0-9ccf-6ab06447aa2d", "value": "T19134BFA36038BE9FCDE91F379C8E891753A52FD5C880107E1D94750EFE672082E3A566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341733, "uuid": "b8efccf2-4b48-45da-af60-19be369751d8", "value": "4776e99a40d8b72668e173a43de71810", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341733, "uuid": "ea8a20d6-c3f3-40b6-baa3-9a43b579ccdb", "value": "6144:jftXfOMEuiqMwSBxWj/Fh36jsrQqarDXmdeyYKNi:jfB6wSM4gEodfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777341733, "uuid": "6722e8ee-76a7-4854-8e90-c51a68d97c45", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777341733, "uuid": "c6037c75-d588-4726-a7ba-58a686376a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341733, "uuid": "733a1cce-6b8c-4618-840f-3adcaceb3c85", "value": "e90cf4e769a0e61d6aa7099090604ba79ab399823991fa6d718b492609030f37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8dcfa0-435a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777419269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419269, "uuid": "2d2e0238-1527-41ae-8590-edf229207efd", "comment": "Malware payload (RustyStealer)", "value": "32b7eb68d36541cb2b2b267748ae5f7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419269, "uuid": "613ac292-23b7-4ff0-8e76-1ec76fa7b7c5", "comment": "Malware payload (RustyStealer)", "value": "e92364fc20d6a899099a38fb4dd0ff5ae14be2d95366e1d09cf223211b402507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419269, "uuid": "7f8872bc-29e5-444e-859d-e9958b8c5c62", "comment": "Malware payload (RustyStealer)", "value": "3e012ac63bd0a576a32a0d85366253d326603f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777419269, "uuid": "4e0ab2bd-f887-4e35-af5b-48681a58d736", "comment": "Malware payload (RustyStealer)", "value": "0f14efa670ba68d8c6efb6065a062257e4facf44fe46431bd0ef95a1eb68aef469fa132c80c57885b39b2f9ddec241ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419269, "uuid": "a8b3a9c7-cd6c-4536-9c39-cc91e464eec6", "value": "T153C45C03B65515ECE0F9C13AA346A933BD73B85103287AFF06D44A632F54AE26B7E750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419269, "uuid": "92d715f1-bb69-4b44-a8e7-6d2a534ce4f4", "value": "187d06fcb051f46053b6d25c72db12ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419269, "uuid": "c5e6b677-3b9e-4cef-91fb-3af0ab8b9b05", "value": "12288:TdIBmCMpQbZ35wQqqC2M9hFBs59NuGkzl:5IBmTpQ9mlPnsZuGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777419269, "uuid": "00e91ee5-d02c-4dba-b780-52ed1ce9fd1a", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777419269, "uuid": "722c0805-708c-4da9-85cc-bc5845ed4255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777419269, "uuid": "1aeb0b0d-11ee-4eb1-ac66-22499ffa510d", "value": "2026.04.28\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5dd40f9-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777397755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397755, "uuid": "55843739-1369-49b0-83c6-e8e20f1adce5", "comment": "Malware payload (Mirai)", "value": "dea6e43385d510affd83665e81f941b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397755, "uuid": "d5f9c33c-c31c-4783-98f9-3a4840b5d362", "comment": "Malware payload (Mirai)", "value": "e95bd106b1a5cca1e4beb92e25ae688a3ecb2a1955dc06f0a82ea5f68f0ff652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397755, "uuid": "0e6a6a5c-4498-482a-ada5-8a9c06f0474d", "comment": "Malware payload (Mirai)", "value": "a427761b9c89df8b7ccff57c87bea2b29688f0e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397755, "uuid": "9bbdd1ce-a9ed-43bf-a42f-8c82ab3a6b8a", "comment": "Malware payload (Mirai)", "value": "dc85c64d1548add983cf9948b5fd37d2e39b2387fc1b7e9b230de9e1cbbfb07010c57701e6fec69c82553b839f43cbe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397755, "uuid": "bdae6373-71b5-4811-ae5f-382296d797dd", "value": "T181662A13AA2CDB0EE114323448F2DA986B291C8541DAE927F791F718E9F306C5D6EDF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397755, "uuid": "7e2bdafd-971c-47ef-a69b-6e5d0d4173ac", "value": "49152:k/l7fpOWdgReKWWGlY9sSm4+xyoidf7p9Z39RJ/lPacF4K2TLxcB9GmNg+1/M7HA:KwoMPZ0Isn4jEf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397755, "uuid": "fe85eb94-b3a8-411a-ac7e-11752dea09fc", "value": 6750401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397755, "uuid": "9ff19451-760a-4d01-be87-430574b8715d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397755, "uuid": "eef291cb-e0c5-4bc7-bc35-9f3381717b43", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f032244d-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1777378096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378096, "uuid": "fbeca886-caf9-41aa-9037-e62d99c09a9b", "comment": "Malware payload (KongTuke)", "value": "947d92ebcf017fc6b2e17b0b38840c9c", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378096, "uuid": "29c90cb9-812e-4947-a9dc-870735c442f0", "comment": "Malware payload (KongTuke)", "value": "e967728dfb8e5b4aec800f9bb2c30cd6f1350f7da48c06051e6ec59a7433f943", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378096, "uuid": "0afd2f09-f294-49df-8eec-b6317383b316", "comment": "Malware payload (KongTuke)", "value": "d20eaa32150c662aa85334b752bb5853a5b5b822", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777378096, "uuid": "1c87bda0-85c4-44ed-8957-34e60ac64cf9", "comment": "Malware payload (KongTuke)", "value": "3c880340a725a56ff254d647d549cee34b38c587a6054f2fad3d4644b96963c64c912726b097748668afd639b10a2e06", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777378096, "uuid": "cf04eec6-761d-4810-8d85-100187388b9b", "value": "T18845230584CA9333D5EEC0B2FA8FA877563D38072EB4441B93A15C676D6BAB08577B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777378096, "uuid": "3db3768b-adc7-4109-9e07-84d7828bcb81", "value": "24576:sl1HekYP8m5Ns35X6cChYjfdXy4jWIeLsEJLq+:slx6tY3V6cCMCKIJLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777378096, "uuid": "e2b0253e-0b0c-4ce1-9c62-e6ac7ef814ab", "value": 1266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777378096, "uuid": "0f7c49b2-42d7-4915-9c20-ded31a09eb20", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777378096, "uuid": "ba135b13-df25-4b29-be69-9482c4fd5f96", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6066e6-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355090, "uuid": "0fc1afbd-a970-4f49-bf10-a22ef995a060", "comment": "Malware payload", "value": "9c5185f82fa892637c2919d3eb052263", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355090, "uuid": "4a6a6862-7118-4c1a-96f6-3dc582f92955", "comment": "Malware payload", "value": "e9b84bbde8658c27dcad67e3cbd0b44f97b36236576c1c57f595f1d5c460517e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355090, "uuid": "ddb44819-754f-471f-9d5e-bec8d2f66a62", "comment": "Malware payload", "value": "81b44c9d0caf9b04912612ba6104ccaa6ca8a97e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355090, "uuid": "fd4019f7-b41f-454b-9fa0-5948c5265f9b", "comment": "Malware payload", "value": "3a1112400a41abe666c50501ae2a9db0bcf99b2abdb0141ba446b7071f5117b0f9df1f424e8bfb0068041d740b2fd66d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355090, "uuid": "d1af3af1-f638-478c-bca9-4a5d3100d507", "value": "T1283723173FA87A9F9628531E20FF0F0A0C81DECDD92459FD0A66A42E1E9575068C3D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355090, "uuid": "99068e3a-0fcb-41fc-bbce-a1f1b1a2a104", "value": "49152:aWv4EdjFFKjXDD5KKn3CDeGZEb0vdDEWWmBIDtD+7uPDNY3lxSqjfX7vYpSES0xr:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355090, "uuid": "4d5ce480-b4f6-4955-bbf7-9c33e33190ea", "value": 23684327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355090, "uuid": "6699e6cb-23f2-42c8-bd77-c3599e8e1e3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355090, "uuid": "cb35408b-4b35-4d8e-9d44-e51b53d04dd9", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6101ce16-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377856, "uuid": "8038811e-0435-411c-81ae-0ed38116da1e", "comment": "Malware payload (a310Logger)", "value": "ecd40458af9568ca0173889e4cf65625", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377856, "uuid": "086ba106-11df-4da6-a888-6cd30bae5c3b", "comment": "Malware payload (a310Logger)", "value": "ea9b0efa7673005b43f337279f28e2dce682e1932951ce00188965e5df068a54", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377856, "uuid": "b00dc375-ff29-4afc-b13a-b0b0f142bcb0", "comment": "Malware payload (a310Logger)", "value": "7902f8b3a037fb028cff434f31b461dfa9a6f2ab", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377856, "uuid": "22a7bbd7-fa93-4101-9e96-3d1aa50b30b2", "comment": "Malware payload (a310Logger)", "value": "465f903418e975d5ed7a73e54bdcd07d1c28bda645f6af4bb6e1cd3c37f57f7f5515f6b090e0c136c14331c62f222cd8", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377856, "uuid": "dfa3c98b-8e81-482d-a5fc-901eb53d8baa", "value": "T103959FA99DD81488588F85558BE8F72E1B25B482357C2C3907721B436FE8F71FC7A90E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377856, "uuid": "8508cfe9-b10a-4bce-90ff-62bc17611831", "value": "24576:4uG6bMbxdqCEKyg3L0hDtrD8jgF/CtYjxImPGJtYg3bJkJ6q4dmZTmJ:4F6bgN70hR3L/FAjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377856, "uuid": "6014b1ca-6e32-42b0-a5ed-d83468c2b465", "value": 2055592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377856, "uuid": "87c23177-8387-49cf-89f1-b2ae320b5012", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377856, "uuid": "e43e006b-2185-4a6b-abbe-4c630665990a", "value": "ps_ZM50CA8yQ1ay_1774513387987.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694fc199-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364985, "uuid": "62470344-db65-4bed-94b9-3d93d2b12e43", "comment": "Malware payload (Mirai)", "value": "79c2bed086dbacbe43ffbeb5913bf509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364985, "uuid": "360e9a45-8821-4666-98d1-50e5ad3330b3", "comment": "Malware payload (Mirai)", "value": "ebf52bab6189b716479624b0bac008ce47c2982fdefade9d6a6905e8f587a0e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364985, "uuid": "5ce04d93-27aa-4791-81c8-6a652e65bee2", "comment": "Malware payload (Mirai)", "value": "6f74d402eedd5eddf39f7e5ead58e79699279a27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364985, "uuid": "17d00f2e-8fe0-45bf-955d-8e26017a1461", "comment": "Malware payload (Mirai)", "value": "269f67a0a62169226474e08462b12f7adf9303958b57d506a38931b93e385aabe323d04f203c397a3ff86a5901a70605", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364985, "uuid": "ad87dd4b-7d7b-4524-a1ca-4972aa47ffed", "value": "T158730A82AB43DEF3E95711F502B7DB364A32FD3A083AC5C6E364FCA16A515C0A51636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364985, "uuid": "e846cde5-a237-4d31-9473-89b7ca674cd4", "value": "1536:xcq8MffSUZRL+r9RS3Tl3f+4kSBOz/Gd4W3OZIsJzL5aA14162kkq8Wg:xcnCfSUZMuTl3G4knm4W3tsJzL4K4HFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364985, "uuid": "b52ffda7-cbaa-4986-80dd-aef2dd0afce7", "value": 75528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364985, "uuid": "c33afaa8-b75c-44ae-8c28-c4de02f3cd99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364985, "uuid": "88f35b1f-6f71-4633-a649-7865a99351d8", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4888030a-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777400578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400578, "uuid": "4d84f2b4-1e73-4739-bbb9-25b4cf4cbd5a", "comment": "Malware payload (ConnectWise)", "value": "0036e9f2815c1a4bec0f0e117e139e63", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400578, "uuid": "707135cb-d6d4-49e4-a4aa-f6572f24cff2", "comment": "Malware payload (ConnectWise)", "value": "ec6eea36867e234a9fc03f5fe9748b876292994e2fd25a7444b7215a6248403b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400578, "uuid": "5ac6493c-8981-46f0-a2f2-fe296009a9e9", "comment": "Malware payload (ConnectWise)", "value": "05f882f35815ff35933427701ca3ae49029557cf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400578, "uuid": "298bf93d-7b05-485f-8f09-5d6ccb8e04a6", "comment": "Malware payload (ConnectWise)", "value": "29d996caf0dc8de739d23dd17b2a1d72a23e3be2c0bec7aef055e711ab45b962c995950920889d3e9caa77994b6bb11c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400578, "uuid": "66a66217-23ad-4661-ac66-249a39bb09e2", "value": "T1C1A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400578, "uuid": "3e17e0fb-1b6d-4f2d-b3f3-bd8acd837278", "value": "196608:bnCtVYqI5MvbWEpKkqUIJqKjnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqWnCtO:jCXvI5MvHxIJhCXvI5MvHx6CXvI5MvHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400578, "uuid": "b3084a7b-f1a4-4707-872f-df0f596bb58c", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400578, "uuid": "30cf42aa-0da7-461f-bf8c-bc59d767331b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400578, "uuid": "09e5640c-f1d1-4f24-a981-6c9b7a861e64", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc7f6c8-42ac-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777344591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344591, "uuid": "0d8678a4-7be6-44e5-b19b-141502ac0a60", "comment": "Malware payload (AsyncRAT)", "value": "58c415086bc2d65a1f8d2eeb1db30859", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344591, "uuid": "7dc1786c-8f85-4a59-82eb-412018a2bfcc", "comment": "Malware payload (AsyncRAT)", "value": "edf67f3e68edcb4e87852cdc10cdeb650a6bf4ab803b7e1fcb9b7f4bfee9fcab", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344591, "uuid": "5e1436ad-0c11-41e4-b429-8e0052d5a3a2", "comment": "Malware payload (AsyncRAT)", "value": "c4bcaaa78218b43903a50020644493c840e9a633", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777344591, "uuid": "64b48344-d127-4fb1-97f4-89624b22340f", "comment": "Malware payload (AsyncRAT)", "value": "096865968665a350a50b22b9abd70da1342d3090953fffbef7b860278e8b1e63b2ed6f25d9aa710eac8954ceea68495e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344591, "uuid": "fa860efd-f7e9-494c-89fe-fc21f4e08cfb", "value": "T13554B0E95F067FAAA5ECE31E3E722110D9F35972249030253DFC32E6A764051ABCDAC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344591, "uuid": "e2dd2b00-c3fb-4e63-83f8-29be86fdb2f1", "value": "6144:lwYgrHaSTDxlxkfX/k2U6gSD3wCkoyYihYFCEqFjL9p659bkw:pEHLTnxk//HU67bsYF1cjL9cXbkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777344591, "uuid": "9b6a6c44-6242-47bf-baa0-5985b4d44b3a", "value": 279975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777344591, "uuid": "5a876113-e293-4f45-bc5d-c95873ff4bfc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777344591, "uuid": "d62c564c-e677-474e-81fc-041c7796fd9c", "value": "ps_OwyrjeqfTM0j_1774573524438.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70036ea-42f9-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377624, "uuid": "109e10da-d797-424b-8341-b27a53415f7c", "comment": "Malware payload (a310Logger)", "value": "deba19082b99c2b398722fbe71e62a01", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377624, "uuid": "9710b8ea-ecc3-4203-8608-611f8c01c404", "comment": "Malware payload (a310Logger)", "value": "ee211e0cba0c38cf6262e922e36a3609fb66e49d1e5b51a6999ef747e13e3672", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377624, "uuid": "92e6927a-362e-4570-9ec2-41b4fab206d4", "comment": "Malware payload (a310Logger)", "value": "3ee7a1f24edadc159487f2ae42328deb9ea1724b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377624, "uuid": "f87c5a9b-88c4-4a0a-b3f8-59cbf5b403d1", "comment": "Malware payload (a310Logger)", "value": "14a1a83912a43986f1f8bc158cfcc4caad2e1f950888472b8fd177d855833a5fee05dac3ac63b2b14ed901071788a2b1", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377624, "uuid": "b6f74d1e-a071-460c-b38b-eb4dd25057fd", "value": "T1BC958F1DC598DD82CE04408750C22CC75A033669A41F19B4679B9AABADF3F6F3DBD85C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377624, "uuid": "0f2e9565-7e09-46cc-bbef-178ade6b74c3", "value": "24576:tENGji8mBH9Dfaz7bu5XDDbQsei6HnUNDhsPGorjYXa9tJX15W+pLv6Rox4xpw3Z:tEKgphbqUNSP5xHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377624, "uuid": "9d0c3bf9-38f7-4a41-836d-9a88ed510052", "value": 2003631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377624, "uuid": "eb4460dc-ade8-4b63-8a16-c9589337adb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377624, "uuid": "29ea2dbb-c4e7-4a3f-9626-59013906c59a", "value": "ps_49Lpikp85IDA_1774250182170.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8735ec49-42fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777379638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379638, "uuid": "3000519d-c126-4e6b-95c0-858bb11c7f01", "comment": "Malware payload", "value": "f898231ab92720d536d7d7d404904369", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379638, "uuid": "7b9e6a58-5ff9-40a7-b4a7-2aa926eba26a", "comment": "Malware payload", "value": "eebb4401b15e31aaf1fce5a2dcb8206042de0042e25d19b16f9395fabe35dbde", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379638, "uuid": "5bc56c55-78ec-4461-af37-192af4d3cfd6", "comment": "Malware payload", "value": "22d7003f46c98849a5b15965045f051727a60a2a", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777379638, "uuid": "201cdc4e-5a27-4009-99ca-efa9098f2c77", "comment": "Malware payload", "value": "89dd9d87194a8f9a160298f5367f847cc889f259d34227d61d1a0925c98dd8b2fee0c6cf410f24c7d75fe7d6a818edc5", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "yc-scm-com", "colour": "#CC418F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379638, "uuid": "b7dee9d1-638d-4304-813c-aec9b200ab3e", "value": "T1F8A4E82294F9113DB027C56263E3AA1A6729C413E41316FDBF9D67548FC3C9267BB20E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379638, "uuid": "779510f4-4945-4da3-b80b-30a59f693427", "value": "3072:qLOCiL4jWgAG/UlTwMh8Pn23iMWzTRwn4JIUBqXQNGjcs6YdWC9S/JdB:YOCjWgAGtMWzTRwn4JIUBqXQNGjcpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777379638, "uuid": "ac5db965-01e5-427e-b5d7-c3a47a26b6f0", "value": 491343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777379638, "uuid": "92f11aa9-57be-49c3-a83c-7eb555861838", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777379638, "uuid": "523db12b-00cb-4e34-90c4-070dd302f3d1", "value": "index.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be61311b-431c-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1777392615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777392615, "uuid": "ba44bec1-ba19-49d0-854a-b23cc3decc42", "comment": "Malware payload (KongTuke)", "value": "8c373c920e12d50ad3a5dff640579498", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777392615, "uuid": "4a454efb-3cd6-4b68-a65a-edf55d523406", "comment": "Malware payload (KongTuke)", "value": "eebc648bb20b752b74fc2d6e2577a1e7b6c940e6a410a880934f9773a1331fe9", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777392615, "uuid": "775bc7ed-936c-49d4-9fcb-9a71d485b18d", "comment": "Malware payload (KongTuke)", "value": "2350f52e19680c23d5bb2db568d919a6ed6cfb85", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777392615, "uuid": "1b32ec82-8e97-454e-a3f9-3299f5021c8c", "comment": "Malware payload (KongTuke)", "value": "c77d011a917abc7ba9df10976db54f0bd0acf1f283bd725359c20e266445b861e5f376748e65066ae26df5b17b085b52", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777392615, "uuid": "17bc733d-523d-4b0a-b663-6c1fe122b5d6", "value": "T12F45331698611ACBC7A36578C0BB5E7C75757AAB4738823B1FB13C800DBD1A5CE3B225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777392615, "uuid": "d9a5c5c8-7297-4361-b1e3-c87379bdff68", "value": "24576:YlfiZgvnT3lw/9z7UfbGQN/zy+3htag1Dy0NO0sgAY44rU:Ylfi+nTsXUf6Q1++3fag1D9PA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777392615, "uuid": "e7b41e97-251c-4966-b88a-ba5897cdd0d5", "value": 1264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777392615, "uuid": "a19c8cbc-44c9-4b77-824d-dcb7ef2f94c2", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777392615, "uuid": "b76a7bfa-de10-4ab7-a86c-64a3735445b1", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6758e5bc-4344-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777409649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409649, "uuid": "85be6947-1352-40e8-a408-98fac70404ad", "comment": "Malware payload", "value": "69c589dd7651b698bb8e925c7f4c7c2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409649, "uuid": "be5556a5-7627-45d4-a179-e9ba8dc593d5", "comment": "Malware payload", "value": "f09d61b53f6c256a8b015a85a673d3fa5bdd05d3f220ab2e3b2a7b2883ba8ab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409649, "uuid": "0f9ed9ed-29a6-4ab3-b579-bddc4fcb52dc", "comment": "Malware payload", "value": "8e79d9b97d7a002e23051d1adfcde618bfafd179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777409649, "uuid": "93f61382-b8d9-4209-91d6-36baa862032c", "comment": "Malware payload", "value": "6471edaaef48106d046f5aa90d2b12e13bd1674392ab6829d2cdab28b92f73797e932d3bb323b1bf6c4e988d750299d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777409649, "uuid": "0a33e629-6074-48d1-b00a-495cbc6319e5", "value": "T16C035D3C10197F46BF6522C28726B77B3F97E92173C50D84BC7666DAE2D64A09F2C0A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777409649, "uuid": "920767d8-ddc5-4a91-8d8e-4c7f72a5cc4a", "value": "192:qHDH6+J0Sq7NMk+T7DYr58uSzESo1PdH/PO3ayzHuk/Ol9GA6e/56EhcfGuyNCgL:eDh9jf+NVuBuOCpLC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777409649, "uuid": "c589d222-a028-4972-9e9b-fb505ba3a3ea", "value": 39471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777409649, "uuid": "08f46852-48db-42ef-8919-eca5b4ca7d4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777409649, "uuid": "a3a14b6e-4a0c-47dc-a26f-e46b109beff8", "value": "PO.Scanned document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef029bb-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403434, "uuid": "040e9205-fa5b-458a-9053-45cad92bbec7", "comment": "Malware payload (Mirai)", "value": "7f1a126390c880a1927bfc6a5c90829f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403434, "uuid": "f509a47f-4218-49cb-89aa-f57dac51d2cc", "comment": "Malware payload (Mirai)", "value": "f149c3d9eedc4b795eb42851c410b7ed1d54efb2cc9171d6b22b803192cdda69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403434, "uuid": "53b33221-73e1-416f-9265-cefc757705be", "comment": "Malware payload (Mirai)", "value": "56b0ed93b0f173c1a9c96641f24d4f1a05c52233", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403434, "uuid": "a3a45fa1-1461-42bf-9ebd-87ee877d483a", "comment": "Malware payload (Mirai)", "value": "6107a63f2e0ca0639cebab3feeb7b7969d7c92e0c9a3ccee5d8ae68aa4916dc7f484cc651ca373989d27692eea7739ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403434, "uuid": "cf09842c-7061-4843-afcd-ed8dfe09419b", "value": "T1D7C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403434, "uuid": "48121cb1-8319-4720-92aa-78dec9349436", "value": "3072:gf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4oqe:gf0tJBR4NSALD7rnCrheiHqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403434, "uuid": "e9b5d92b-4caa-4bea-a568-12a64410ee06", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403434, "uuid": "34b1af12-4b97-4a7a-b71c-89bd12a84d1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403434, "uuid": "9e10b23e-7322-480f-b0c2-04c18c584eeb", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff6bc4c-42d7-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777362848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362848, "uuid": "f712f4e3-6868-4cb8-afc1-a520865e0c03", "comment": "Malware payload (WeedHack)", "value": "7ca4e25253108548b3d95e945270baf0", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362848, "uuid": "c0dc2ad4-1277-4fac-8e5e-acf060c3dd0c", "comment": "Malware payload (WeedHack)", "value": "f35d016102ac96ba96f46467fce17167676f64bd783d46431cfad901e5661a7a", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362848, "uuid": "f00ddf9c-a6d1-4078-8c21-c5b8296d098b", "comment": "Malware payload (WeedHack)", "value": "63df84fddac8fdfd8e09d719ece7836da7ae5670", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777362848, "uuid": "9574bcc8-61b0-47bb-b0b5-74d70fe806a9", "comment": "Malware payload (WeedHack)", "value": "0528b6cf4aa98dd310bab8f4488a5261843b6eaf06007ac3431fd1fe907a6257dc893175e77071a65fd5723b1369ec95", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362848, "uuid": "26d0090a-06fb-4bf5-92f5-f5993ba8b2a4", "value": "T17E14AC9311E8652EBED90934B63E40D892FDC8067DB45B1E5D01B885B23B63D36FB18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362848, "uuid": "c6f5076b-390c-40e5-a424-561503286e16", "value": "6144:4Hxktl5lNXlEMsBkUK1pownvPo1zDyB4A9:Oktl/NXlQBkUK1DvgdmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777362848, "uuid": "a63c43ac-1c4b-4959-8048-3eb8d092ff19", "value": 201627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777362848, "uuid": "a85775d4-0690-4c38-8352-bf2f6472477c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777362848, "uuid": "67bcbc97-90b2-4e83-bcf6-01c4c0fe01dc", "value": "PO012AAA.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcec663-430f-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1777387061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777387061, "uuid": "4e83d795-439d-4a9c-9299-bea8c9f0922c", "comment": "Malware payload (Prometei)", "value": "f2427f6aa7e13c89118832f38d04fb7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777387061, "uuid": "160d97dd-d560-415e-adda-cf532f923358", "comment": "Malware payload (Prometei)", "value": "f55b79eab128f39d712ede6cde14395f6bedb2c79905e390392219012a9ffa8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777387061, "uuid": "38e2cfcc-ec97-4d1c-b352-5f29d3a4996e", "comment": "Malware payload (Prometei)", "value": "814721fa716e3a6792c7da239d6cf907c23cd9fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777387061, "uuid": "3b594b26-6b10-4b63-98bb-47580bc05d2e", "comment": "Malware payload (Prometei)", "value": "6e97fca96033aa1680bd3904efad0e1c1ff4147628ef527f01a215ae7bd5508449dc5a3b4460c2ee30d02d30320eb2de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777387061, "uuid": "c833de44-a579-4db8-81f5-20babc1c722a", "value": "T165A423B4F9219E8F6DD769B91B24831DE182D172589D4C2313AE94E34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777387061, "uuid": "20353151-1780-47a0-9d83-8d824dd01b81", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd6:Fs6pyCC/Ya2hpi6T6N4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777387061, "uuid": "f6c9ca7a-d480-46e7-b685-c840722d75ba", "value": 449052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777387061, "uuid": "64e091de-e5da-4fdb-8a51-33d024dae069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777387061, "uuid": "8a770d1a-14f1-4b2e-8707-3e08fc45c772", "value": "f55b79eab128f39d712ede6cde14395f6bedb2c79905e390392219012a9ffa8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1388d50d-4336-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777403496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403496, "uuid": "d2261ac1-6004-403b-b1e8-742abaa67bdf", "comment": "Malware payload", "value": "9ee265f2bcd21266f9a94daab9578c42", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403496, "uuid": "8eb749cc-b1ff-4b3e-89d0-da88ed75dd2c", "comment": "Malware payload", "value": "f57c4ce41c7f8947b71f2b41f6743f39216bdfe037645de7fb46e7ecedf6bfa1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403496, "uuid": "7cb762e7-8f56-4aa5-86f8-1180c6438002", "comment": "Malware payload", "value": "76b1f330166706bd0d079e96eee648b2e21b191b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403496, "uuid": "bcfe9248-1579-4db3-b601-cbd71edbb846", "comment": "Malware payload", "value": "31a5f910ec5fc8694ec6f5081bd5e7fc7ef68f4779f82d826ed838f7db7abb3e169a1472c932a4802b2da88a640ac87a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403496, "uuid": "08d7be7a-1a19-4d01-9dbd-3994a2ae471b", "value": "T18161E009326255B13E0C48247ABB21213D68025706312CEF75EE66647F8B79973FBE97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403496, "uuid": "6b2a54bd-8c3c-4849-ac33-f28f288c6a95", "value": "48:mM6FL3JZpVR8TY53JZpNR8bY5Z7EL8E6OcKI7wJ6OLf4PV2td/s/Na80BV:WFbJZpVR80JJZpNR8c5ZKPBEPEEOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403496, "uuid": "610919fd-70e0-442a-b1b0-10d592c28c0c", "value": 3346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403496, "uuid": "3995f62e-9581-454a-b374-4e26a95b497e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403496, "uuid": "8f5c383e-21d6-4fa5-9600-146e3b96bd96", "value": "deploy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a848418-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355377, "uuid": "688bc38a-6572-44c6-b12b-9a2c5f46c6f9", "comment": "Malware payload", "value": "98678b5384731a9713535a339531a364", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355377, "uuid": "e193a65b-c3c3-4f9e-829a-7b406dec50f7", "comment": "Malware payload", "value": "f5df90cd4981c2a67dc39b0548183617f9b287875d4022f43dea0d03ba54e73e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355377, "uuid": "b48658c9-15de-4f6c-a898-49583dd63f09", "comment": "Malware payload", "value": "b07673e0863e034c879d180c23967ed0ee174c59", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355377, "uuid": "b10e692c-fb36-46e6-ab3d-a58fca76a353", "comment": "Malware payload", "value": "9b55bd94402275707e65eb7125092fdbf37312f28523606f1d368e6e045992af44af9b5f2d399bde91d68e73b2407ecf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355377, "uuid": "78a93dad-383a-4d65-8343-9c6d7e013c1d", "value": "T165372311BD7F1DBBA6F831BC4CBF03AB15E44A2D66002EACD3A5A0127D4E71961643BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355377, "uuid": "90ea9f0e-73d8-478a-9805-954dbc5d2e9d", "value": "49152:Ow0wZwLwawYwGwMw3w5w2wxwcR0WwFwxwSwKwsR0LwZwKwjw8whwpw6wswlw7wVe:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355377, "uuid": "db868a0b-5d0d-457c-af4b-60cca0882c5e", "value": 23164078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355377, "uuid": "ffa81163-8921-4794-ac11-c5df97831ecc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355377, "uuid": "798a2021-ad43-423e-835f-3a879304133b", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3686ec0-42dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777365512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365512, "uuid": "f8cd066b-d5f4-4adb-909c-528e94536aba", "comment": "Malware payload", "value": "4b6174aa2b0d7065c543a800537a48b4", "object_relation": "md5", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365512, "uuid": "859f1bcb-8e0f-4b6c-8840-f5c2a14bb80c", "comment": "Malware payload", "value": "f6f7d15736d0b0dbb3e6f3fabafd28ccfdb300466d4337781b8a2542221dc71d", "object_relation": "sha256", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365512, "uuid": "7e174e9a-a0ee-4839-a92a-27575bf8eabc", "comment": "Malware payload", "value": "802aac84cf4ab660559b95e77c9b28c47df75d6f", "object_relation": "sha1", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365512, "uuid": "ac97ed6c-6179-432b-a244-bfd8ba1c9bb1", "comment": "Malware payload", "value": "377db1c917f0fa5ee65d3129c59d5c1f34c71707e427fbf2a9ba4dc6b435667458d1f7d48f4efc2a9c555077e7ef693d", "object_relation": "sha3-384", "Tag": [ { "name": "ENGINEERING-AND-TECHNICAL-PROCUREMENT-SERVICES-LTD", "colour": "#715DD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365512, "uuid": "18594e76-0b38-4d36-b30b-d2d37a985a9a", "value": "T19666133FB28B653DF06E5A357AB3E110953B7A61A4174C5696F4C48CCF260B02E3F686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365512, "uuid": "c51b04ec-94d2-477d-9f41-4e5a6e6dbe7b", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365512, "uuid": "1cf7dafa-f61e-46a1-9c7a-d1852c3ed943", "value": "196608:LZC4pambOUuzUiLPD6J6d20Xk6QbcpHUQ5dB:LA4nWzUUPeeRXkjbcpHjvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365512, "uuid": "5ae391a5-a55f-4044-92f2-60e7e0092d11", "value": 6649360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365512, "uuid": "b9fef6be-ba35-4552-aa23-5ad6bf8ba560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365512, "uuid": "0989fc80-d82e-44d1-8565-d52af88cba40", "value": "f6f7d15736d0b0dbb3e6f3fabafd28ccfdb300466d4337781b8a2542221dc71d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eff102c-42c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355492, "uuid": "d2272ad7-ac0c-49d0-b8a3-52d45a5ddb55", "comment": "Malware payload", "value": "a1dc5a131c61da8137a73f695952d6e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355492, "uuid": "29525673-0123-4a61-a315-2d99eef3e1ad", "comment": "Malware payload", "value": "f73e30c1f15772fac4540d7a365dea5691c0dc6553955b13b9889ee13fd82bf2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355492, "uuid": "4f5797c7-889f-414d-bfd7-7fa204357b42", "comment": "Malware payload", "value": "81a1b0d71c712ddcbfbfd2317f81156d84bd9cec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355492, "uuid": "e22184f5-f2d7-412a-b4cc-5feda94d8a4a", "comment": "Malware payload", "value": "a0cc8645cb8c8143854c3fdd340be4973fc108af0ae4e72e5d19bab54e7664af87e23accbcc65ae4f299ae9bcb132deb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355492, "uuid": "4a79233e-f1de-4527-b4b8-dc757b97f483", "value": "T1552723C5483DD3BB09BD512339F26F9B29C60D0AD0B060D723FB5D972D47E241AAAA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355492, "uuid": "5878f27f-8197-4664-9fe7-52478197af0c", "value": "49152:HoCodo7oSoAo6onoCoVoZoko4og+Oo/oqoEoko9og+rozoOoZowo2ovoQoOozoY8:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355492, "uuid": "27674ecf-33f6-42c9-a82c-3992c781dd08", "value": 22123547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355492, "uuid": "1f9b6f89-446f-404b-b411-1910f8ed7f7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355492, "uuid": "52f95034-67a6-4ac7-a655-05bb07017312", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3a0066-42a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1777341767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341767, "uuid": "2d5e6d1f-2c95-4678-9ea3-07fd863667f1", "comment": "Malware payload (Prometei)", "value": "003b086ea93b0b733423a6beb41dd3ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341767, "uuid": "ee94712a-4f9b-4bc6-bfb9-e6187eae40e5", "comment": "Malware payload (Prometei)", "value": "f756ed3844c12bdec3edc800fb3d38348a21bc76a0a964b6ab2cbd5177953b8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341767, "uuid": "a9dab9a9-6e9b-4df2-9a2c-1c3ec0ee2b0e", "comment": "Malware payload (Prometei)", "value": "bcebe983591391ede1a3c4b891e6777d59bf22d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777341767, "uuid": "a342b7ce-7aa3-4d65-87d9-e8a88f8f9153", "comment": "Malware payload (Prometei)", "value": "2f5e3c47803a4dcb5b2e54ea0ab7497d6789efb5089cbb791515c34b209175e084ee18388aa022c260551b1255b6d52e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341767, "uuid": "a0406e34-0cae-4d9d-b00f-12eb4d2836fc", "value": "T147166D6AB2B354FDC15BD03097AFC6636835B4B40131BC7B26809A352E73E605B6DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341767, "uuid": "f3846208-8edb-45ad-8aa1-ab2fbed04ed2", "value": "98304:RRH0MUCZs3WcmDZXeC+CSePlPqSJWTREfmeBeetfAZR:LRvL8REfmeBtfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777341767, "uuid": "acde5bf3-6cbd-4fb6-9fc2-982631174dba", "value": 4284336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777341767, "uuid": "96b46d6c-21fb-4f5c-aa9e-5f2ecc95cdd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777341767, "uuid": "5444d690-3d2d-4c2f-9c7c-1ef14bb32318", "value": "6665b814f6f2aaad5d603684c7cdb5171058ecd08490b84d9d1f494ae7332357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d9ecce-4357-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777417867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777417867, "uuid": "ecaa3b58-a216-4c62-a6d0-5b3c6bb49373", "comment": "Malware payload (Mirai)", "value": "5cf54587ad1e16b607259c133ee914f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777417867, "uuid": "1336668a-770e-4943-b23c-6f9e6b55f2f0", "comment": "Malware payload (Mirai)", "value": "f89882da80f37d753be86beada7560cb7a7ba0d60d129fc5ebc74865d0983b9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777417867, "uuid": "256c2906-dac3-4e20-a478-f92e375b9caa", "comment": "Malware payload (Mirai)", "value": "fe64343b0bdeb8e940daf61ccde58d11508cb7c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777417867, "uuid": "65d18c11-20e8-41b0-8901-b244d16bdcd7", "comment": "Malware payload (Mirai)", "value": "a9df6d2c8d7fcfd601ac20907b89a157705dc25b5cb63cb9c422329a2af0b1780858c7b762083e0ea1563f33a3197731", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777417867, "uuid": "62d7ee03-0b0e-44f9-93bb-49fc0d01aedf", "value": "T127A3E60BEF500EFBD82FCE3706AD1B16258C554622B87B3A3674C928F65A54F09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777417867, "uuid": "331ed299-554f-4ef1-86dd-cbba5fb5efd8", "value": "1536:PDyxEdMPfYRPtyl0lDsGZBZXHnRScX1SGBygSJhvQKjLoHA+:SeZttl3uSczvjjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777417867, "uuid": "07ed0b6f-c1f5-4f1e-805a-6ec1aa21d7cb", "value": 101388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777417867, "uuid": "f5a8ca28-e450-4d1a-991b-22cf57da452d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777417867, "uuid": "021c0a5b-ca3d-495d-b87c-220e46df882a", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc72ffbd-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355299, "uuid": "f7b4030e-fce3-443c-8921-21ccf3cf3a53", "comment": "Malware payload", "value": "9a512c64535e8da141c7818572b04401", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355299, "uuid": "c90b3449-8867-4c5a-8ba3-36dc5e66e36b", "comment": "Malware payload", "value": "f8c5a4c6e3a63bdfe20c29325e52ad338d6a1b55d13fd21c2868b07277961074", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355299, "uuid": "51f8abd4-cd7e-4867-b5a8-b3ff7a521cd5", "comment": "Malware payload", "value": "fc55e47fe061c154afe1a23c1dd21324031c8883", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355299, "uuid": "50cd7382-bd4e-4e8a-a27a-adfe42d71361", "comment": "Malware payload", "value": "f16ddb4c76af3a91a307365576bd1eedd68bf8059ad7aca2838baee46324bdc32f601f1aa2b1b587af6e53b9892c50e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355299, "uuid": "0257ccdb-c17a-4ff1-9e29-8565b745ef3a", "value": "T1BD3723030EDB363986C079C8506F674F3DD4220A86CE96E84BEB6DAFD11DE4E5147A39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355299, "uuid": "36866cf2-be5a-4611-a2d5-ae931affaa73", "value": "49152:w/vUR/vUW/vUJ/vUF/vU4/vU+/vUu/vUD/vU7/vUc/vUZ/vULaxGzQP/vU4/vUBi:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355299, "uuid": "5af8e93b-44fe-40b5-a916-c46c874c0bc4", "value": 23684335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355299, "uuid": "37b99a1c-024d-4b6d-a6bc-3448f79d5563", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355299, "uuid": "6aff39dc-43d6-48ab-8382-b496bddb7b8d", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54280284-42fa-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777377834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377834, "uuid": "15857227-2dd4-460f-bc14-9e3bfeac23b2", "comment": "Malware payload (a310Logger)", "value": "a98d26b34f389907f397b0aea5da4cc0", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377834, "uuid": "6d1005a1-9482-4750-92ed-126e49233182", "comment": "Malware payload (a310Logger)", "value": "fa1e48a368564e57b27c69acd1bf149b21d58e9a75d276b4a6d6f7572ddce3f7", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377834, "uuid": "88b78632-9fa2-4a3f-9b7b-065b208a3ce3", "comment": "Malware payload (a310Logger)", "value": "b917ed5784a2bdfc57858f299bda6a3112d9c581", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777377834, "uuid": "52e54e88-121d-4144-a602-201782d7df74", "comment": "Malware payload (a310Logger)", "value": "05e432b6ef7a186b0c21b77bdd5acf6e438a10f1cdcda8f7272cafe17aba805c2f447d52c7fb36a6ad9497d08252aacb", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377834, "uuid": "b085d1ac-cba9-484d-a17a-b69a85b6bae0", "value": "T19E8533A58FF07DFECD78962821BFAE4A07E94C9F605E42E547D512C2261B38A4113C7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377834, "uuid": "5f0ef170-bd77-4c58-93df-bbfa0eeef0a7", "value": "24576:IPLORUyxkFn99rm1Nak029+QrjXF/X+JkhYpDbcwv8esWaXE1IBKN9MG9aEODtdS:BUdvUNakdEaX3hYJwgl9ubS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777377834, "uuid": "fa1ef162-feac-4a95-bcec-12e4dd02c718", "value": 1775012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777377834, "uuid": "b31fa654-28da-4276-a881-f959b368dc17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777377834, "uuid": "c255e11d-2ea3-4a77-bc0f-0ed7a189fd0e", "value": "ps_Ru7dVxaVwq6i_1775727976106.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a186a9-4313-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777388435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777388435, "uuid": "bd7b0425-2c87-49b5-a9dc-8b815c130222", "comment": "Malware payload (MassLogger)", "value": "9391d27df10b0b2b7c436dc9d787cc8f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777388435, "uuid": "725d2f10-4254-4d8e-9ea7-8ca468d3a9ae", "comment": "Malware payload (MassLogger)", "value": "fb905df5f8331f4e4a47130c8b48c70fa1b8fee5f64d34365b5ca34a6872eda6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777388435, "uuid": "284c936d-17b3-47cb-87c3-8104f8e67deb", "comment": "Malware payload (MassLogger)", "value": "11360974eeab03d201db5107cb67a2b5f92178e2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777388435, "uuid": "7c9f19cb-9816-42f4-b5b7-6e9f37370128", "comment": "Malware payload (MassLogger)", "value": "23547b6d3842166e26d471907b8bfe90512947ee281caa21b6854e4e40633906e16d662620ee4aabcecf47485df83c89", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777388435, "uuid": "e503a490-1e1b-4b7c-bfe1-a81292ad0c9d", "value": "T140B5EA25243FF690D8034DFF53849622C8EDB23AAC3389D569B69AFC5EA9CF484D1D14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777388435, "uuid": "4d59244b-bbff-45c7-9366-b194610bc2d2", "value": "1536:FPmnxFGBVnyYt5GsnVp5hCHkw76AvFuE3wtrTnqy1VbnsV70xn35yxB14axwtrTp:F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777388435, "uuid": "1029084b-fb3a-47bc-aa3e-1a0db50163a5", "value": 2366772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777388435, "uuid": "a33f4761-0715-49e6-824e-d9877db7fd54", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777388435, "uuid": "282f8084-0b4a-4387-b95c-6685815e5980", "value": "TeklifFormu_2885.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758793b0-4328-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777397647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397647, "uuid": "1c0b47d9-5029-4d70-aa01-d01b96a9b349", "comment": "Malware payload (SalatStealer)", "value": "20bca8677f040179e5d91f6706bbb659", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397647, "uuid": "b2e9b0b5-4945-4764-ad89-6b5c14a4a6a5", "comment": "Malware payload (SalatStealer)", "value": "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397647, "uuid": "4a2ba173-1360-4323-aa11-506a8733ec92", "comment": "Malware payload (SalatStealer)", "value": "da87bb4c2df009a448d28b92b1aa4593b965617a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777397647, "uuid": "18b450f2-6522-4fb5-b2ab-284160bd6ab6", "comment": "Malware payload (SalatStealer)", "value": "4b44d47d82137b906f8da763781abd198e8dfae9bbe69b7afff9c2bb689d585b55ca97d1561ed8db12e72684c569e5e5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397647, "uuid": "5ea629b6-53de-4c37-812c-03fc2e109a6f", "value": "T1B956BF037BFEB04EEABB97B0957962518624FC370C51845971CD549A4F9BA003EBC3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397647, "uuid": "436ec7c7-885c-4b6e-ba98-d0807793260e", "value": "abd494edc324553e8117ba30771f3eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397647, "uuid": "6a0ce248-987c-4232-a417-66e5e3e179be", "value": "98304:yULuZI0Lsbw69bVptrgRWW3j/h7XnX+zZ52mC1n/t2FTz:6Lw9DDeWmN+D8QFTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777397647, "uuid": "508bba9d-e595-4571-9222-9b0feb8121cf", "value": 6395392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777397647, "uuid": "d35b3c20-ea95-4d62-9cfe-facd49d2a040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777397647, "uuid": "266cf9ba-4454-4b95-8ef2-d5a366859850", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781046cf-42db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777364580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364580, "uuid": "d833f00d-f7f0-43f6-8db4-f526ef9c8af8", "comment": "Malware payload (Mirai)", "value": "ecd66fa2a894dfcd49871215d63d2e6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364580, "uuid": "c180b5f9-9c31-4411-9625-ca62683ba565", "comment": "Malware payload (Mirai)", "value": "fd7acf8ea2be7bb148096057431248d7618b299d2cabe805f38256877c46b486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364580, "uuid": "decd750c-8789-4d8e-99ad-5b0ee514656a", "comment": "Malware payload (Mirai)", "value": "976db8fa7c767cf5ca5b9804c0ab630e3824865e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777364580, "uuid": "7457be14-e90e-46b8-bfaa-cbe5781a9fea", "comment": "Malware payload (Mirai)", "value": "c896b360d97b9521aefefde0c3a6a57e83404ac7adad42434955b9d5e2fcf717e272d5b96ccb580dadbfb3ab3ed149fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364580, "uuid": "c86581d0-7fe8-4283-a0ef-4e488378e222", "value": "T1F2C3B91E6E21CFBEF65A837407F78E21965877D62AF1C585E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364580, "uuid": "5676b535-a21e-4707-bb25-532fedb41695", "value": "1536:Nw4lPfv7d7Y/YLpdYo1fpNeHvztsiwMfDIs1ISFl63ae/NufhuF:blPfDdMKdYo3wHvztqMfDIsRc32huF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777364580, "uuid": "a3430c6f-a28a-48f4-bbdd-94b1a770f7bf", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777364580, "uuid": "6ea6e311-e794-4c8e-8799-c93000ada260", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777364580, "uuid": "fce900b3-b280-45da-ade7-cd8b13265b3d", "value": "SecuriteInfo.com.Linux.Mirai.9838.2100.13921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f422d98-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1777400562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400562, "uuid": "e28f94c6-5827-4f69-8f06-8e3b0a87e2ec", "comment": "Malware payload (DattoRMM)", "value": "bd9ee5ea91f881132bfe141577dda7a3", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400562, "uuid": "3e2c9106-afd7-410b-9395-95c6db91fe33", "comment": "Malware payload (DattoRMM)", "value": "fd8dd17ae2cd8da8d88e61727478651800ac8655a2edc861beafcda1c0a866eb", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400562, "uuid": "85eec318-b3c3-481f-9944-563dc941ba89", "comment": "Malware payload (DattoRMM)", "value": "f1b92f37e028108e43e8c8249f1eaa807fb9ba40", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400562, "uuid": "9fee35fb-3976-42bf-b0cc-0b0bce3034af", "comment": "Malware payload (DattoRMM)", "value": "0f80a4cd9850816e0dc0546c8317282aa9e453b03f110d804348c2e2a01b3bbd2881f4c6c5e7f6c18fb63f25e3163a57", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400562, "uuid": "a178ee8b-74f3-42cb-b6a3-375828b94524", "value": "T1AFB63307DE3B8EF4CB63463C89831A57124F598D8C47E4C9F0482A3589E799ADE38F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400562, "uuid": "d33ce108-2a62-418d-a64e-420a53b2c123", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400562, "uuid": "c5d73bf0-6144-48da-b7e5-5ff06e21e7eb", "value": "196608:haZk+wabLGmnYZJukGkxGB8rM2VPFOsti7A95vM9sFp29XaIT030HyyG+zzDK:FnInkGkx08rtE7AnMGp29qIT0Wzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400562, "uuid": "8c4fc445-2f93-4b30-a4e3-ccac21f60103", "value": 11055544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400562, "uuid": "eab06e15-a371-4918-95fc-e1ed2a83e910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400562, "uuid": "c9ccaf45-4ccd-4c81-81da-0a771f811faa", "value": "rsvpguide_ace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b15270f-432f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777400555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400555, "uuid": "07dfc68f-1e8f-46fb-8b1c-9ef1de65160b", "comment": "Malware payload (ConnectWise)", "value": "b7e3dfef4ace9ebb619dec7eac5f00c7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400555, "uuid": "61ead842-af73-4497-a78f-45735d364984", "comment": "Malware payload (ConnectWise)", "value": "fe580e517b77136ddd535a05feeedd8a8e73d99d590f2ee1ff96a2f1de75e2bc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400555, "uuid": "27d807e0-c712-48e8-a17a-ff4970ae6089", "comment": "Malware payload (ConnectWise)", "value": "44a8d646b6db1ef3c7a2af19929f11f1e3b9ed77", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777400555, "uuid": "a5de6825-9007-4864-909a-5e12f9effb13", "comment": "Malware payload (ConnectWise)", "value": "e86fd2ff38aae6350ea204d5c0f9d99f72163550b5e7a0bee2f15195099e75072c1801a49f000574644be55966b6ed93", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400555, "uuid": "885eeb69-8c07-46ba-8225-5cfe89121b50", "value": "T1DED61211B3E595F6D0BF1678E87992655632FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400555, "uuid": "3a17812f-7aa3-418d-ba83-4ff73b7eaec9", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400555, "uuid": "25c8aab6-fede-4ef1-8d1f-cc56cd685d57", "value": "393216:wCXvI5MvHx6JlCXvI5MvHx6CXvI5MvHxPCXvI5MvHxU:wZ6HxCZ6Hx6Z6HxPZ6HxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777400555, "uuid": "b6ee91d6-b84f-4480-bf33-0d58066c16f0", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777400555, "uuid": "f7624e7c-a763-4478-a2c5-f24e8b9ab42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777400555, "uuid": "2dc56ae2-f61e-410b-80b7-cfff223aea15", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533452d1-42c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777355069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355069, "uuid": "f94787f8-f1ac-408e-8a84-cf2a35a3274a", "comment": "Malware payload", "value": "38e43130fd728c85a6bf29b537b676f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355069, "uuid": "bfca1459-eb88-407c-a8e7-05ab2e401559", "comment": "Malware payload", "value": "fec6cead7be5db94e1a9d255ac0507462787d92d96b7dd7f731970101fd07947", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355069, "uuid": "18202b96-2d88-449c-bd00-87123c203420", "comment": "Malware payload", "value": "d51768ef1f46c19fbe54bd09a34060935644e439", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777355069, "uuid": "528aa5c8-ad22-4a75-9290-ad8103b78b1c", "comment": "Malware payload", "value": "ee53b45739b6c9ceb9d715e5a38f1fb081eb0f0a35ff007831c8d4e0c17a0d1b9fd6d6c8a3c1843e4ccc8753d01a58ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355069, "uuid": "e98b4218-81e5-442b-ac5e-ea817dac143d", "value": "T1F33723848DB99EAF53A4402800FF4ADDD285CA09572D67CED3B37C692D9ED1B0E1239D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355069, "uuid": "a8940869-273d-446b-a568-d26f9c8ea07a", "value": "49152:qa4a2ama0a1avacaKa4aOa4amVA/yqaXaSaQa8amVA/yrauaZaVaVaSauadadaE4:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777355069, "uuid": "40fc5fa0-f335-4ef3-8957-f7882d3d7d5f", "value": 23164063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777355069, "uuid": "7ed51c49-26e4-4f94-b0be-e5559cc2fbae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777355069, "uuid": "7ba2b703-c5fc-4f70-9d6e-3a1d257a4732", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e133c892-42df-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777366474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366474, "uuid": "7879e129-48dd-4c6e-9a76-99169f360078", "comment": "Malware payload (MassLogger)", "value": "9f3e28617b444110b1e535394a632d0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366474, "uuid": "53a2954d-e194-4116-8ba2-d16f1a2b769a", "comment": "Malware payload (MassLogger)", "value": "ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366474, "uuid": "5de18d84-ec00-4cbe-9dba-7cdd476ece82", "comment": "Malware payload (MassLogger)", "value": "f81331aa7cd1ccb6240817bda3b0c6f4b9fb9086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777366474, "uuid": "e25c5228-45d6-4775-82ab-af98197a4082", "comment": "Malware payload (MassLogger)", "value": "57533025ce9be1dad34bbb9b30067223f56f1f71588b87405376a4d78bda5b18390b77c5da0b6ea7477f5e6955922c27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366474, "uuid": "58358f26-c6b8-4213-8492-eef85dfdabb8", "value": "T1902522F9AD09C147C9A70BF15EB6C33623A26EDDF005D356D3DCBDEB34A5290A828191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366474, "uuid": "b062ab22-e673-4af8-bcb4-70c65943dc6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366474, "uuid": "e828b3d5-1e78-48a7-90b6-fc01beba4532", "value": "24576:+Hn9qlWMTjlIazrsRZT8MI1CpXfA0znVBqyLBUN9uDfIilVm:uRMTjlIurg6L0pXY0zVLBU+z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777366474, "uuid": "50a8e873-7a55-44bd-8d2a-7c696d5dd515", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777366474, "uuid": "fdb2c84f-e917-4f6b-a7fe-3aea0d358fe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777366474, "uuid": "17df753d-3252-4221-bfa2-04c48d44af50", "value": "Fiyat Teklif Talebi-DUYGUGROUP PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9067c26a-42dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777365050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365050, "uuid": "f4136cf0-5751-4169-9857-a5be244437b6", "comment": "Malware payload (Mirai)", "value": "45c28a8e555c46e458df48d23267a09c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365050, "uuid": "d3376ac1-8d0c-49f7-8a57-b0ed24a7b3c0", "comment": "Malware payload (Mirai)", "value": "ffa40846166f9c8e3e848db97f60881a3d38ac7c649bc322d208cbcf05199cdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365050, "uuid": "e109d415-fe51-45ac-b82d-2cbd7705f0c0", "comment": "Malware payload (Mirai)", "value": "6af4091f6820c194098b6e27a901dcc889846f91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777365050, "uuid": "312b8a8c-b34c-4548-b2be-ad8f0543920d", "comment": "Malware payload (Mirai)", "value": "81fdc4e3a7d7cfc372f26a7c4ab5d8174431c0b426fab6ea2d92e60f213e9d75eb75918c1ba0b143fb9edee9b65f0ec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365050, "uuid": "7697de95-897b-4319-bf24-bc4f82d01ba4", "value": "T1AA533B02B30C0947D2671EF0363B27E5D3AFE59021F5EA48795FAE8592B2D3215C6EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365050, "uuid": "bd1ee236-2d3c-4f66-9957-6e28a0e8f206", "value": "1536:woF6iGUA2ktuGRNLwQOV9aSFCOgdeAnrYr+OwcaxR7:w86jqV9acgqKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777365050, "uuid": "75a9c072-07d1-4877-a078-5481c6141285", "value": 63304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777365050, "uuid": "3f7309fc-448a-41be-98f2-ea339bf99a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777365050, "uuid": "a014d5ac-6d45-4183-a521-b05999d7308f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e9bffe-4335-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777403265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403265, "uuid": "4fe3624b-d144-45aa-8395-ad660e74bea4", "comment": "Malware payload (Mirai)", "value": "12d3451458161cc2cc8cf15f33a5950d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403265, "uuid": "95c2ae64-a415-411c-a804-47b179ab3433", "comment": "Malware payload (Mirai)", "value": "ffe1a6163e7262d25327143f035e31304b172a9494956fa9a801feba1330648f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403265, "uuid": "52caf035-8df5-4260-905b-0316c6bd4f75", "comment": "Malware payload (Mirai)", "value": "c6124d3158e30c8d60bbe1d74749f2d215dacd3a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777403265, "uuid": "60c73a7a-8024-4a10-9ba7-b6167428361a", "comment": "Malware payload (Mirai)", "value": "460c730e37f91b40a99e6dc982c665726ec9b26d1e7c1263bde4dc2546ae20ab00ee60dbc0d8cdb9f22919e91a1b0645", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403265, "uuid": "f9e408c5-5db8-4c31-acc6-b1cc7614145a", "value": "T117E34B0AB5C490FEC8D9C1B44B9AE136D972F41D4135B26F27D4AE222F4EE315F6DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403265, "uuid": "fb0c0e5a-2631-416d-af69-6d702a156c01", "value": "3072:5AqDslbmOWgRyBpURnexzLln77rDc22VHgLfRITcI:+lb/NSZx/RDM+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777403265, "uuid": "88134e5e-eaa5-40fc-a2ae-97ac3895f1d3", "value": 151368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777403265, "uuid": "dcd3a671-b722-4206-929c-7c343a3e3d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777403265, "uuid": "f405400c-c695-44c5-8d5b-1f504b39b194", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }