{ "Event": { "published": true, "date": "2026-07-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-20", "timestamp": 1784592181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b5e501d4-376c-4be6-ad63-eb7be0fc2f46", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99d75ab-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509395, "uuid": "143264b0-28b1-4acc-84d7-0c744180b702", "comment": "Malware payload (Mirai)", "value": "ef5c3fa7c602553e5f972bbdc495f302", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509395, "uuid": "a7ca9fda-c019-4403-82e2-b02efc055799", "comment": "Malware payload (Mirai)", "value": "01e10a0d58ddfef9d4f5c8f16f6397a8f3cde32759f0a2a9458aa4416a8fa8ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509395, "uuid": "64194ddb-7800-4132-8114-825888913750", "comment": "Malware payload (Mirai)", "value": "a289fd93dd211682cab4a08405285d16f9d5ded7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509395, "uuid": "ac7003dc-4cb6-4209-b22d-a1a26bdaada5", "comment": "Malware payload (Mirai)", "value": "89ceb9f481398cafe29c66b9e6822e1cbe40951cc689f82ce291550ec372ceb5e9a0b3ba9cd7b91055fe3465a37f9a8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509395, "uuid": "861c95d9-2115-4434-911a-db2a5e81faa0", "value": "T14EC3AE97F78B24A1C86146F007C76B8D3EA362019E6BE9E76C1E753B193A1DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509395, "uuid": "4705f5c2-97bd-48fa-8d5b-cdeb9911ea8a", "value": "1536:nq189r2mIHgqH8INi8TNB4ZPLaLWq0IijTQEE8+FCUxZJ3eg9B/LWg:q1ur2nj7BZqZPLetETQC+FCkeg9Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509395, "uuid": "51d33642-ee45-418b-b223-4c2fac8fe087", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509395, "uuid": "2a734f04-eb2f-44fc-a1fd-aea4110b58cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509395, "uuid": "bd0bdff3-14e2-4911-9310-cd500af2047d", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9048d3b1-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574582, "uuid": "d3b8fdd2-8aac-4f3f-9288-c932c8d07b7b", "comment": "Malware payload (Mirai)", "value": "771921023dd46aa3eaf62a4af9504153", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574582, "uuid": "a280907b-dd2c-47b3-b490-f2fb2ace2bd7", "comment": "Malware payload (Mirai)", "value": "01f7dfdd5ab6006cc3d4dcfbcc65e6a145ca34336f21559588c6dbc5c2121d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574582, "uuid": "0b560119-12a3-4a15-b860-5a06a9ac1458", "comment": "Malware payload (Mirai)", "value": "65826959b0786e48f161846d8f00fbf78b0c2740", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574582, "uuid": "4662477c-e2a7-4a85-b16c-d5883c18f8a5", "comment": "Malware payload (Mirai)", "value": "d1173bc9f0dfd9bb3a3fce421425e01f7fbf499bf07345a7b1e10b3e7322ac2f268707c8dd0ee48aab0e4adeda2745c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574582, "uuid": "4ffd4f54-9854-4e35-ac5b-94e6835dc03c", "value": "T1C9430272354D6472C5CA0CF028EE5151F38BD7DEE9FA32B050BDD6A4B73108BB46A865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574582, "uuid": "6f88c181-3e03-4c76-9d94-4284efdc6ba5", "value": "1536:lQxgxPJhfVIz2FzQOQRgD3jEShEFENC2fi:2xg1JhdIzOQ1RgD34ShcSC2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574582, "uuid": "06e1fb11-33e0-4105-8d78-630eeb63d10e", "value": 58892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574582, "uuid": "32b48d0e-0692-4d38-9757-c0da10a6b4a4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574582, "uuid": "8e340ea3-f8a2-4208-8f0a-1338362d1dfa", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d344047-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574792, "uuid": "9c5ccec0-54cb-4bb6-aef4-62e57c2bc459", "comment": "Malware payload (Mirai)", "value": "c4d2627fbd082385b1274e3e31a1f8c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574792, "uuid": "2283800b-79ab-4bbe-9c70-de41c21faeff", "comment": "Malware payload (Mirai)", "value": "021427534dbf7d135a102de94627a2809ea47ed6dd9753116999aa50989771c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574792, "uuid": "45c08bd4-9153-4b45-a2e2-259fe476020d", "comment": "Malware payload (Mirai)", "value": "453d181ef5b33852e635b091c0cec41007e4bcc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574792, "uuid": "f4988ea2-ec47-43cd-9e2d-387fa799eb4f", "comment": "Malware payload (Mirai)", "value": "95b0a69237e6b244132bc9b021d9396f8246e1f97e3df9dfaafafa13c285956185d17db190375a0109ef129b33236a85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574792, "uuid": "affc9c97-7c1a-4554-9468-a318425d9a05", "value": "T1B58312D24EAD11BA3BFBEEFA257F058E82856351771196363D40C5B83E320C1D292A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574792, "uuid": "d532625c-31eb-430e-88bf-b00f45aae81d", "value": "1536:S7N4aVi5FLkGQSiHzDkjgpzFsw6YUVVvbn6euCRZ5tsp9Hr4IwsYW4fha02TL:/aViflQSiTwjgpzFtUVVvT68RZMp9HrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574792, "uuid": "c138aa03-b532-4938-9b8c-33a7c98677bb", "value": 85492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574792, "uuid": "2fc1a053-208a-48e3-be81-d7e115893930", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574792, "uuid": "cf17e864-c2d2-465e-a4e1-383215b7413b", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857b7cc9-83d7-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509710, "uuid": "54842a8d-e471-4477-8d6f-c23fa09dafa9", "comment": "Malware payload (Mirai)", "value": "1330a8a7da029a7eb311e4be5c733d2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509710, "uuid": "658d442f-4bbb-44f4-8a4e-1664aab9e28f", "comment": "Malware payload (Mirai)", "value": "02e960e5278a686f38a356e5e7842def5797e07ec0b06b8fe5f34d0b28fde0b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509710, "uuid": "0b2cf510-fb0a-49d1-9956-fa7fc1f99322", "comment": "Malware payload (Mirai)", "value": "c18aad82a1f930b93beb3d9360330780e835b8a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509710, "uuid": "2adb5f66-1123-4dc6-8ded-034780d76014", "comment": "Malware payload (Mirai)", "value": "dd9b21af62d4b2c23242da0aa2cabba8d4dcbbee3a2b7e4b899da22ce96e9d153cff3c9c1f010fa6d6fcdc0d6f1f3244", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509710, "uuid": "f6eba47f-761b-4239-855a-db060355fefb", "value": "T149C31855BD829A12C6C22677FB5EB2CD331733A8E3EE7117DE245F25338B51A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509710, "uuid": "b84a8bd0-da6c-409a-8d47-32f40b27c3e1", "value": "1536:t1OJ2qrIOHj6k54wgwgobpxfhsMOyZVyaKmKi1VPCXoZ8vqNdkyVhQdlSHRgaOUu:tnqrLHuk5JfhsMOy4i1oXmQdlSxBFr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509710, "uuid": "c2384c5c-df71-4011-84e0-9c139dfa5301", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509710, "uuid": "5b3aeb43-08be-431a-b381-51840ed75f95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509710, "uuid": "f930b596-4911-4ba6-aaf1-c426c9b034e7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b543c967-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574644, "uuid": "b80757d2-3234-427b-896b-c934e18d76cf", "comment": "Malware payload (Mirai)", "value": "336b7b26739e33befff7749cf4e27ddf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574644, "uuid": "b0f41799-6548-4bd8-9d48-82b517d4d705", "comment": "Malware payload (Mirai)", "value": "03fa1116cfe971b1ffd4267744e0948d0ba6a2b410bc8a9c249c134bee8db363", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574644, "uuid": "448845cd-3f87-4f28-addb-6ae691d4a1b6", "comment": "Malware payload (Mirai)", "value": "48416e85c9c420fb83bb1c16efddacb05c417d08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574644, "uuid": "74930b8a-311b-47a3-b302-f1873e742326", "comment": "Malware payload (Mirai)", "value": "29a09394682811bf319fa788f22c7c064d727c3670101e5474c00e4d91ca623ef877dbcb8045ab4ea6d8e09bc6f20c7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574644, "uuid": "f06ff3e4-7f2b-4f1a-a77a-e325ecddd987", "value": "T1DC731A2679B46E1BC4DDD2FE12F78724F1E62B0D28B4855DBD721D8EBB2059029133B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574644, "uuid": "2c7cd830-4241-45e2-aca0-ddb44f970dda", "value": "1536:P/SuXipfXfNMCp2W5hbZuQxWdTWpmtulEB5h4jQ2xHs+Yn:Pau6fW25hwQx4TtTIBsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574644, "uuid": "02bdebd9-c0c2-4f84-bb7a-8e5a6e227f2f", "value": 79532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574644, "uuid": "30ed3168-51fe-4376-b75d-27022fe10ed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574644, "uuid": "111f2745-13d5-44ef-8af3-e755a8acb87f", "value": "nullnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf06bb4-8427-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784544136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544136, "uuid": "491a81b1-0f77-420a-b71c-9721047c59b8", "comment": "Malware payload (RemusStealer)", "value": "6223ff0e9ca0830f73b555366781ca8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544136, "uuid": "3fb34eb3-48c1-46f3-b2dd-b7d6d820605f", "comment": "Malware payload (RemusStealer)", "value": "03fe281c2603a01f649e2f2fc0c800af4d882d4ff0d1a38450198482700e87dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544136, "uuid": "66bf0ff0-c647-4f4e-af37-9c496f036b4a", "comment": "Malware payload (RemusStealer)", "value": "f54d45220084812d825694829ba619d07a2bc559", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544136, "uuid": "635fbb01-9b69-4a73-ad51-248ef39bec11", "comment": "Malware payload (RemusStealer)", "value": "6a7fe2d23e5492c904ae3a2f86bb35afd73067b49a8ec3db08db38f8f7785f30e99acfd6cd42c5930915498fda90b2c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544136, "uuid": "38ba3c2c-62a5-41ab-8308-70af1bfb70e5", "value": "T198835AB0C9A1057B4F87AB58BCA58660C66D8716853305F0F6CE870C9109DECE779EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544136, "uuid": "b9efe39e-7b24-4c1e-bcb4-d8a2119d1bdc", "value": "1536:/tZVc5LUW7cl7gWK7uTAu0P1YXqno3bn/kVp09CAMLHS4UUtQtNSH73d:/HVuDuT4gFrn/kVpqCAMLHzUUtQnSbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784544136, "uuid": "06aeddf9-452c-4419-b021-2f49fcbceaa2", "value": 83716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784544136, "uuid": "e5e7ca53-cc74-47b7-9d69-d91e663a4e2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544136, "uuid": "15c783a5-db4e-4bb5-8bee-1ee470688251", "value": "SPA of goods (draft) final 20072026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb4531e-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784534235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534235, "uuid": "79aefa10-1ca3-404d-82ad-2914946cc457", "comment": "Malware payload", "value": "acba4aa846fce4a6a35b6b8b14f9ef5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534235, "uuid": "c1659439-9750-4539-94f7-3b628a9d3310", "comment": "Malware payload", "value": "051e9378d66417c9e5861d3205f1120fb9f6a89cd369d679ee03ddec516678f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534235, "uuid": "5ac6fba4-89ea-442b-b4d0-e434a09d4c6c", "comment": "Malware payload", "value": "94b7dba738765974e37dcc2b8cbb81de734046a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534235, "uuid": "10659fb0-c767-4028-88a3-7e2f216ef5e5", "comment": "Malware payload", "value": "bf262d8323bb929110243508f883ef1d5380ea5e85c480eb9250fe00327792e104b8f741c661fb3b8e6852f708381afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534235, "uuid": "6e2fc882-2069-446d-aed8-c84503574e52", "value": "T1C135F11A13E85BA0FBBEEB785175004083F1F543E726DB4E6F8D51E99F22B858242763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534235, "uuid": "c2bbc376-4935-4e55-8f86-bd86e74a3d88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534235, "uuid": "9906d738-34ed-4d25-9444-0598c0a7b412", "value": "12288:kcWh5YX8kBzdG7oe9mxHewPrQjQZeGRpQ6s7Ewrz4RH6q2mlTBhcynt:kx50jhwH7krKTiKtzy1BhFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534235, "uuid": "c7b2bd6b-0e84-41ab-8803-95bc660dc7f1", "value": 1083392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534235, "uuid": "df8dfde9-c5ae-4b30-93cd-3ebb215f59e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534235, "uuid": "5176a0b0-a11b-4b72-adfd-992e1655e687", "value": "NEW QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb7ffe9-840c-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784532541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532541, "uuid": "9f235339-3dda-472e-afe7-fcba89a5283b", "comment": "Malware payload", "value": "c46d2d8ee901dab0fb0f53537564404e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532541, "uuid": "20947de7-e397-451c-9697-3e236451e4db", "comment": "Malware payload", "value": "05a0ca0ac2527c0faddc2a8ec456e69fc1f0e0c9fff9d2d396327faf3f876c30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532541, "uuid": "ca570541-d2cf-42a3-a28f-426286fdd321", "comment": "Malware payload", "value": "e363b3ce1f6ba1bb48d5a4e8ad511b07a914885e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532541, "uuid": "c1c7c330-2fe6-40ed-8346-5a6fd329d651", "comment": "Malware payload", "value": "7f45e51895da8c1cd732b6278cd1d54f76c7d4f486d07d20c78225748b390f52f32260a40b108b7824a957cc2347ec89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532541, "uuid": "4be6711b-0071-45c0-ac96-48845365f325", "value": "T125C31207723E4E12EA917D76680DDA3771C1C06BB71A817BEB59C194ED4CE0CCB60DA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532541, "uuid": "fbcfa194-9c72-4447-9233-febc1b8f1787", "value": "3072:J7H70+/4rU1MUekp/q08G6SyVhPw3l0CEUN85xzN:J7b0u4gZRp/hMSyvu0CEUuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784532541, "uuid": "c1c59d04-9b37-418b-9556-a886b0a1337a", "value": 126716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784532541, "uuid": "854506ea-4022-4bb7-a5e3-25f148140009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532541, "uuid": "fc516f5d-86f0-4bdf-8975-4b5fae5771e1", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5341803-8427-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784544177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544177, "uuid": "1861bd93-978d-407c-b60e-a88a12c0c273", "comment": "Malware payload", "value": "39c3cdae84ed3bf8c72246391064819b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544177, "uuid": "cced11b9-84ac-499e-ac90-7af5070f419f", "comment": "Malware payload", "value": "05bf6c79b47290c8dae9a55a25e3e0f6b4f353beb8588a5cdadd7b39161396f4", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544177, "uuid": "c0f9ff58-0d5b-4f6c-a34d-b214b5e255b7", "comment": "Malware payload", "value": "5d7a20f0810aea3823a6265a2da13d8372b4183c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544177, "uuid": "ac46f35f-1508-4918-b093-14798888ebdd", "comment": "Malware payload", "value": "da21cc8ff07478030f59f16d7915a291afe916029066a48cca1f3e9fa7494d900956a6a18a35b15e8dc6aa01d5a11545", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544177, "uuid": "35358eed-eca9-4d0b-8b9d-04c8ab0ff08b", "value": "T12FE4232EF5A4CF36E063A2F048DCD89F014CBDE22F9ABA1F6A54B70C05785B5D9C6941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544177, "uuid": "d0b9a5d7-0f48-414c-bb79-53720541b4f1", "value": "12288:ZWyGfwI82fIh55TEYP4N0W3FHLNnYf87NTxN1ySURANExVm6fdDOU:ZcfwI/QyP3pLhYS9RxU93msdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784544177, "uuid": "2e2b94bd-335a-4e19-b4cb-d4beb76707ad", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784544177, "uuid": "d43a5037-7dd1-4d63-b572-b2ac96b62b30", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544177, "uuid": "b808d6a9-f23d-469f-9ea5-6af7bfd71f98", "value": "IAT-PO-1403-328.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9688aa9e-8475-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784577599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784577599, "uuid": "ec59ea24-7400-45c4-9574-3b3715540b70", "comment": "Malware payload", "value": "b5348c5746c4c1521d36813b97e04e43", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784577599, "uuid": "b122a133-5c65-47d3-bac6-3c426c4106d3", "comment": "Malware payload", "value": "05feafe05fedb138116489ceca8a84b302ed59e2f3d18daa9527b057aa485c9a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784577599, "uuid": "f41246e1-f0d8-435f-b0f3-cdbeba61490b", "comment": "Malware payload", "value": "fc739f2d544cf440c9e107c71137bdaecb3de59b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784577599, "uuid": "587ad82b-74d9-4885-83fd-31c9d3ba44b4", "comment": "Malware payload", "value": "a872df88d9823115d3ffce2c7c35d12b5a4b1bda6503f41fb351843fd6af72e807610b2f983a4977506e2449c0b906c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784577599, "uuid": "47a116f9-9d64-4bed-b8ea-4bfc6681de52", "value": "T1730188EA8254680040AD961D32976094F420D3CF168A4B39BFAC6D3DABA8804F02AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784577599, "uuid": "3809583f-879f-466e-8637-7fd3086a34d6", "value": "24:kXCKysE2hi0ziQvZohad3lKSH0FvXt9MZX:e9Qp+Msdw60Fvd9KX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784577599, "uuid": "5a5a1bc6-ca50-47e8-b5c0-aa8bcdc133ed", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784577599, "uuid": "dfe4548e-7678-479e-8087-2d68695a514b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784577599, "uuid": "bdd2e25b-7d82-426b-8646-621249d6fe08", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6d80f0-8420-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784541129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784541129, "uuid": "708022b5-c82f-4416-9b21-29b8ccc40d73", "comment": "Malware payload (Efimer)", "value": "6dc060b0ef5c1eeefea3a4c71fce3ae1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784541129, "uuid": "606adef8-778f-447e-a6e1-c839a5a52db8", "comment": "Malware payload (Efimer)", "value": "08138715841b5e43cd0a1ec83ceeda599ccfd4149250a47604b5eeb49df7adf8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784541129, "uuid": "52d57e74-fa51-496c-ac93-1efe876a1671", "comment": "Malware payload (Efimer)", "value": "61a75190ddc96d44faaf5f4c36de7a5ff77aede7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784541129, "uuid": "a5be2ec3-5682-4295-aed7-16abae877f01", "comment": "Malware payload (Efimer)", "value": "6c78d899c5fe2bdfa95e699fa8d250527b2149d3ea908389f0e3f435fc396232135142725e5256d86b6b3baebe051315", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784541129, "uuid": "6fc81791-cc4d-4515-a135-a74bf586a6da", "value": "T184E6338CA9D012E9F9B3453EE5E01986E4A578394373C99B07BCC7B26E531E0493F663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784541129, "uuid": "1d1aaa14-6ea1-4dee-ad33-96a10b55e72f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784541129, "uuid": "7651dacc-e117-4372-b0bf-2f78f70193fb", "value": "393216:v4XgTPIahbFRjFrh6oG5XMCHWUjXxcuI3/PGTAI:vlXLhU5XMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784541129, "uuid": "30a56db7-c189-403a-81d7-2490b6ce0e87", "value": 14294918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784541129, "uuid": "b51129cb-97d8-4cfc-b960-63d58f8e7065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784541129, "uuid": "a3af58f4-5876-4b48-9cbd-e7d8e0f69a8d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb4f913-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784533296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533296, "uuid": "94b5edc1-de8a-4336-ad7d-44480ee882bf", "comment": "Malware payload", "value": "d5fbc4827349d8b76ccdf14eac811d27", "object_relation": "md5", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533296, "uuid": "89130cfb-9971-4123-b54b-c0411a142639", "comment": "Malware payload", "value": "082284d37a7f43bec5b4660ec584f657ceb4b9f047caa256225e8940438f4b62", "object_relation": "sha256", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533296, "uuid": "ddde0cf2-2095-4703-bac1-d1814b38f605", "comment": "Malware payload", "value": "885ba17fc7ff7d40169da4af8a97e1bff908c796", "object_relation": "sha1", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533296, "uuid": "4bc7573a-f9a4-4f5c-befc-5b05f6722f9c", "comment": "Malware payload", "value": "6d08f004a4f67de79c4de1ffaddb9ebe7706221b8bf5a9e8a52d4ea7651e37eaf7a8606f3620a3bab677d4640942154e", "object_relation": "sha3-384", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533296, "uuid": "4bc27adc-5af2-4241-b9ca-b57af90ee810", "value": "T134E69D02A3FC02A8E6BFC278C5665517E7B2781A1720E7DF515095A92F33BD05E7E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533296, "uuid": "3fb52516-33f6-43ba-9da6-4d55af880232", "value": "4b1892ce4fbcfcf064c6f69d693fc6a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533296, "uuid": "29be9b7b-9410-44da-bac1-bd7278515c96", "value": "196608:S9RqywLxg3DdocGG/7NAfxXEdZXp6XpUJusO:WR6NgT1/7NusXp6MO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533296, "uuid": "aef05af2-d3a7-4b77-94a0-96fada80a364", "value": 14382389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533296, "uuid": "307a6b73-d692-4291-8aa9-231aad5c1bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533296, "uuid": "5c4dfe77-74f0-4b26-a667-b54d6e16a15c", "value": "082284d37a7f43bec5b4660ec584f657ceb4b9f047caa256225e8940438f4b62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebde3b2e-844c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784560133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560133, "uuid": "14a9db8e-13bc-47ea-94a6-f13d3373db5d", "comment": "Malware payload", "value": "07326147dff202fbfd3f00db33fb4d33", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560133, "uuid": "3b0c0b27-b30c-403c-8d93-2c462c92402b", "comment": "Malware payload", "value": "08cb5a6819ac46d34c1baae74d978949237c7a7e22592a221bbcd04c74a1af90", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560133, "uuid": "f670f4c8-f47c-4de0-b64b-ea5081f466b6", "comment": "Malware payload", "value": "c7caf7ffef3e5755f71d715245ee01d2663755e5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560133, "uuid": "1fbb4db9-ee27-497a-874b-76a84552b437", "comment": "Malware payload", "value": "cd92d261159cbffe4ef37afbef8f1f8399d9eb10d2952ce726e5c76019c2f83248bbba25352fa36cb9c70bec3effc60a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560133, "uuid": "b48f0d00-c4c5-4851-a45d-f820f44ac46a", "value": "T18C864A43ECA559E9C4AEC2318A639613BB717C494B30A3D31B50F6382F73BD0A9B9754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560133, "uuid": "307cd27c-87ad-4398-be7a-1687b24af07d", "value": "98304:tcIwZ8arGF8siiIZmR7KVqJRnQHZrgwvE+l:+fDr0Ei4qJRnFwsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784560133, "uuid": "f08598d8-9eb8-470c-8df5-c9153f270df7", "value": 8102014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784560133, "uuid": "0b730891-17d0-4b5c-bf19-cef93c12c02b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560133, "uuid": "b461e6b3-8725-4c0c-991a-7a32f185435f", "value": "bh-linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5651625-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509442, "uuid": "fe2bda49-7842-4223-8af4-ff26fce9b579", "comment": "Malware payload (Mirai)", "value": "04d6fe4ad8804679aa4a5337c7e5b0a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509442, "uuid": "9294971c-8451-4668-9a16-ea3d76722946", "comment": "Malware payload (Mirai)", "value": "0927ba3ed85ba9a8f3984e1e6d135e5db7f37316af7189d894d56dde90b986a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509442, "uuid": "87870f0e-9d50-4887-be99-3d77c2299e3a", "comment": "Malware payload (Mirai)", "value": "e7c2ec8edd060db7dff6883dd4c0a37c693d822c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509442, "uuid": "42186ae7-a7eb-484a-8741-f75f68f77301", "comment": "Malware payload (Mirai)", "value": "b09a93cf76fa7b57749d84446945da0ec3185ff41fed672a36d758577325a666ccfbe2eeb4a7829d4b60002f7dde6209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509442, "uuid": "e2635187-e151-4201-8a6e-cda3db16f0eb", "value": "T162431681F8D2996EC6D4137AA73E358E33A1B3E0D1CB3613CD585B25338A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509442, "uuid": "72c4baf9-4e4f-4b43-8460-f7fa3427bd95", "value": "768:vcyaknuYHAf/StW3QQoyLEFMApBV5kTCS8kTIsYcLHKIoNDitRMfgrBNNTWnDrKL:vJnbHA36AzrEFMOkZcsrLHKotR7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509442, "uuid": "64e5df78-304c-40e3-9c08-fda3de2449b8", "value": 55876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509442, "uuid": "70bfff39-e36e-4c15-bbc8-fcd7adbb99a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509442, "uuid": "30ad9ba1-2b75-4755-b5fb-a3c0d78a12c0", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894cea54-847b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784580154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580154, "uuid": "c3e45d27-ef90-45f6-8442-c10a3796d348", "comment": "Malware payload", "value": "9d89ff7f54073cd31a6c6ad15b1326d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580154, "uuid": "5797730f-b443-4485-ad74-6cf7aa28f4f2", "comment": "Malware payload", "value": "0934db4eb30297c9815b0eefed038850d56b721cca115fc6881f4b870df41753", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580154, "uuid": "894e0bc9-8829-430d-bdd1-e2ea14fdca98", "comment": "Malware payload", "value": "ae3b5f9c6e427fcd5c3e3dcccc08ceaa039a694c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580154, "uuid": "0281aa12-4453-4196-b721-57352f1c104a", "comment": "Malware payload", "value": "fde3527631e3794faca5b6936aa9e8597a2b0a0dc9783b084a46fb1e38f308f9022fb775ad151f4305bc57507e3f58f1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580154, "uuid": "5733eab2-7f2d-4203-b71b-8cfd707adc9b", "value": "T10FC27D956A967C44BEC98A3E4CBD2B0D6DF5C3D1224942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580154, "uuid": "7137f3e0-517f-4748-b916-8dbe81bbba8e", "value": "768:C8vCB+25j6es8R59FYpMSUpi+20qUpi+20YQX:C8l25Jfd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784580154, "uuid": "c42474eb-3c0d-481c-9b91-1b12a8a4966a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784580154, "uuid": "5ff0764f-d086-44b5-ba73-dc1f7e5312d6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580154, "uuid": "a6979e72-87a8-4d6e-9bdd-cfef0766561d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddcb214-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784533320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533320, "uuid": "8ee69ab6-24a2-410e-b7f9-fa642e96120e", "comment": "Malware payload (Vidar)", "value": "788fc952b7bdc334fc677426dcf2af39", "object_relation": "md5", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533320, "uuid": "1030bd1e-16c0-4c11-9d9a-7d1d316547f1", "comment": "Malware payload (Vidar)", "value": "0a4b3b6e4de78361552735cbbc95a1819a7338c810e7f31e1a3d68a06a5252bb", "object_relation": "sha256", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533320, "uuid": "00e85529-5873-4be0-8fd2-b06ca8ee20dc", "comment": "Malware payload (Vidar)", "value": "2dc11386a208dfe528ef8fdd70d7b81290e7b5ce", "object_relation": "sha1", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533320, "uuid": "81daa4da-a391-44fb-8d0c-7b62cadbdd5c", "comment": "Malware payload (Vidar)", "value": "c750b59093057562501db5d999203db1aeb57667068218b0decf93a181ecc846211ca7efb7191df1a0f02b89a1e65540", "object_relation": "sha3-384", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533320, "uuid": "c63a1d63-e7dc-4959-a5c8-44813dc71019", "value": "T168152BBD9C50E336F60CD0BAD287E7538F6138001236B9A319BDA72412465729B677FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533320, "uuid": "09e75e57-9bad-49bb-b306-53f4fc50cf61", "value": "12288:iq4DrYI6HlXEHDm86s9MrOXrzTPaM+W31CAG/JUQI1:94DrY9lXEHD96wMrgrzQoG/JUT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533320, "uuid": "d0598ce0-72b3-49c4-ba07-a68feec41fce", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533320, "uuid": "2d530dac-c685-4fd7-9a8f-664639edf774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533320, "uuid": "b13dd98e-1d3f-4ad1-873f-48f661da6170", "value": "0a4b3b6e4de78361552735cbbc95a1819a7338c810e7f31e1a3d68a06a5252bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ead53f6-8400-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784527308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784527308, "uuid": "0175bdc3-59a3-4448-bd8b-a0c80f754123", "comment": "Malware payload", "value": "92c9e436018ee6633b58c902f3a5132c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784527308, "uuid": "c5d7368e-3d59-4dc4-895b-1c57004b04fe", "comment": "Malware payload", "value": "0ab574c5577bdd347cf07c59838b674c10e3b806d63ed178a4f27cece92fced4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784527308, "uuid": "fbd0eab0-cea5-440c-bfeb-44345ffae2d9", "comment": "Malware payload", "value": "03f073162472c97f41a742613207327f9fb42de1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784527308, "uuid": "ada8e883-97f0-45ad-b25e-0cad045071fb", "comment": "Malware payload", "value": "f31038af72c590856a30ca13af911829f94986b175657e14dab2e5f0ecb3c2e274e94026aaac540b7361928765f896c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784527308, "uuid": "70bea33f-1b1f-4131-82c9-1fe5b316e695", "value": "T18D237D652A817C14AA98C4371D7E2F0CB9AD43E6324492ED7FCF3CF68C4A69DA10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784527308, "uuid": "3cc4e748-dff0-48e9-bb1a-266cf1ab9a7b", "value": "768:yXOGVvl9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:kLucr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784527308, "uuid": "134d72b7-5d05-4de2-b5d3-c00436337c49", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784527308, "uuid": "a5ea2106-d828-4c78-8f30-01088ae08821", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784527308, "uuid": "dcae2893-e937-427d-86b2-093157128e46", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9da854-846d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574178, "uuid": "63c22f0d-fd86-4227-b072-22182db3cc6f", "comment": "Malware payload (Mirai)", "value": "bbfcdfc4c5c2fd963e4ebeda8f5ddf9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574178, "uuid": "d91f4b19-013b-4018-ad5d-dc9c7cf01caf", "comment": "Malware payload (Mirai)", "value": "0d3d1963feb36dc9a1bd16b57433d607c4de79cd46cd4205d10ec84d7b2edcf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574178, "uuid": "3bbab16f-9e5c-4029-bd98-1aa61585a56f", "comment": "Malware payload (Mirai)", "value": "ec9c2ee5eb5b32fc9f42f6f8fa86eeaa1bb180a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574178, "uuid": "8754d56e-e63a-48b7-a308-4ddb0354f219", "comment": "Malware payload (Mirai)", "value": "37aa909c8aa871b1b8b1dfec1a6c20fb7fa2717cd7cc2d1696c647a6f0f9ec6a5f9a137b685857943a252e7784ef6db2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574178, "uuid": "8da724bb-96fb-4330-ae71-546a3bf0fdaf", "value": "T1EDD3C54E7E219F7DFB99C23447B78E21A65833C627E2C585D1ACD6011E6028E385FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574178, "uuid": "8b3aa1c8-fd98-42e6-a753-924f74d21cd5", "value": "3072:Vokwrt+CDrtmG5HPxuUjHdyCdPyeIRpNKRBpRTS:EECDrtm8HPxuUjHdyCoZEBpRTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574178, "uuid": "833eefb3-2bd7-4a47-9dd3-55a46bc3963c", "value": 137924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574178, "uuid": "39a98dc2-7009-452d-ae70-55e258615f1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574178, "uuid": "e1ae6520-f937-481d-9c64-f1a4c1d8973c", "value": "8f43a7dc8f4716f2c7c73c43d55277e0d9f214ed9b0ac332042efb23ef1d4c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2154d57c-8489-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784585992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784585992, "uuid": "606b8940-9113-490a-8b3a-72ad3441113d", "comment": "Malware payload", "value": "c057c2ba117f199df9f9f90e8caeae5d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784585992, "uuid": "84f42ee5-c2eb-4256-a948-69383089fcbe", "comment": "Malware payload", "value": "0e1ca1c207eba5bc7b8fb7fb14698999fe9e4189d56ca5b88f86dacfbf409ddb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784585992, "uuid": "1dab7d8f-5bea-4e89-8f89-40150e75cdaf", "comment": "Malware payload", "value": "c3ac736ebe013619980c44f5690f3723534212a5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784585992, "uuid": "1561b1ea-405d-43d7-a25f-915693a27bf1", "comment": "Malware payload", "value": "d8668ff7ebc9d10aed75c709f80bfe6d96518fedc06c13282bc05e0f484a7138cf87046f3f5b85a41d4a147dcd4fec55", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784585992, "uuid": "9589beae-e97d-48b2-afea-d302a35ae3d1", "value": "T19C825A0FB9424726C5E11074A275877BDAB9A8B2338814DBF7D089A90B782D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784585992, "uuid": "4278f835-83b6-46bc-b5ee-b9543b53d6f3", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784585992, "uuid": "d342b6fb-dea8-45e6-a182-8e60f395457a", "value": "384:+IqQVVaFYhKUygZu94gNTcNQav8U9c2KF:8pUyV9da0UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784585992, "uuid": "e162e93c-828f-41fb-bd49-84119cb27a7e", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784585992, "uuid": "d08ee59f-82de-45ed-8ea5-239d0c82b7b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784585992, "uuid": "3ee91232-fb80-4bf8-bcbe-cef42197885b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bedcc2a-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574843, "uuid": "81d042e8-1317-4eae-bb2d-5da954a24a47", "comment": "Malware payload (Mirai)", "value": "2144842ddb06de51407e17510420ed35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574843, "uuid": "6c91be36-b066-49de-8e92-fd4b075d875e", "comment": "Malware payload (Mirai)", "value": "0e2f88421bec2bf2fb22c26c8bd5b10469921fc66310b01b39937487d5a1904f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574843, "uuid": "d75f3a3d-e144-4227-87a4-0cb963adf6a8", "comment": "Malware payload (Mirai)", "value": "ecd2ae6ccea1e8a5393a1e6aae0d21ac7f127317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574843, "uuid": "431f1529-b002-4a89-a1a5-a9fbf1fdd5a4", "comment": "Malware payload (Mirai)", "value": "8a81ea6cf54d8eb29bbb3dee7a5f6fde35602e4216691b22dbf27e9f24279d1135a55b865853c7810808d520ccf6ebe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574843, "uuid": "53e7e4e7-6576-4035-8ce1-1119b0e5806a", "value": "T1C6731942BC828A2AC6D013BDA67EA68D33A1B3E5D2DE3117EE145F117BC520F5D67E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574843, "uuid": "d9c09a1b-fd1d-4fe2-a184-230c77e159ce", "value": "1536:CIJdLxqIUWI7z1Kd4joarU2oIZe0XGginEUKYgO0MQz:pzlqIUW81U29a/KpMQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574843, "uuid": "636f3207-e39b-4375-984a-ad147ffe2569", "value": 76824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574843, "uuid": "693d661a-6c8b-4a54-8492-5dd6f0c1a5eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574843, "uuid": "38ac9ace-5926-476e-bf32-9a0da41070cc", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f10e482-840f-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784533724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533724, "uuid": "cc96ec3e-2959-445e-9e6c-3fd92194e859", "comment": "Malware payload (RemcosRAT)", "value": "b8024619d56ed6eac1f9b07b02cf8034", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533724, "uuid": "a02f8818-e7bb-4726-9234-9573f17954ff", "comment": "Malware payload (RemcosRAT)", "value": "0fe4a027df3228eab48c5070e0e31a7f744b3db55294346fb168d778e397a875", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533724, "uuid": "7aec53a2-80dd-4c07-a471-26e708b4cd51", "comment": "Malware payload (RemcosRAT)", "value": "c64a079e749a88461595c8b116368be23e52f1f4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533724, "uuid": "04f1dcd1-e1e5-418e-b8be-05eb934fdcdc", "comment": "Malware payload (RemcosRAT)", "value": "78de20529d8943feb39fa483cd6044abca5cea97c01f85f633eb27303cceb7dfe81acc37e696204d645c45f4b2c4a9db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533724, "uuid": "06007c03-8623-489b-8521-312c3cefe75f", "value": "T10E834A60DAA2017B4F83BB98FCA58660C66D8315853704B0F6DE870D9109DECF778A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533724, "uuid": "48748b1f-f28c-4510-ac91-dd660adbef3b", "value": "1536:/t4R0m0NAd0zdD3DjxOs0MtwHsFOKZ6Hv8Hn53:/SRXGPdD3Djcs0MtwHyOKZ6P8Z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533724, "uuid": "1b623e77-0509-430f-919b-43ee919f788f", "value": 82591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533724, "uuid": "a71cdc8f-0d2c-4a5f-82ec-9aba1a52ec92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533724, "uuid": "5640a2bb-9258-4246-8a2a-819955e31d6c", "value": "PRO260717-01_0A26000212_EGARATELEK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d08af3d-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784525077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525077, "uuid": "0e9419e8-f219-42df-8418-96f11878e167", "comment": "Malware payload (Mirai)", "value": "b66b36aac6d02f0a7bbdf9c8848fe0e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525077, "uuid": "514c2e40-4c6f-4da4-af17-c9489107ae11", "comment": "Malware payload (Mirai)", "value": "0ffe24f30b6466cca33c05fc8b59b0f8b4b2fd6a115575bff19d4c671303d2c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525077, "uuid": "6cce6bc7-2e6c-4b33-a374-cb9e37da6b55", "comment": "Malware payload (Mirai)", "value": "d07debd4bc83706132dabc738fd0d877e192f0e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525077, "uuid": "61e32311-5543-4e11-bd29-f3e7dff06392", "comment": "Malware payload (Mirai)", "value": "e123f3d42fa50002561c6ed3a6337804eafbfbf51163566eb0571969b9583e4ec1f1a9b972367cf5feb1cc609e7a40eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525077, "uuid": "a54709bb-8074-4ee2-9497-2ab7dc232444", "value": "T182E3F887F901DFBBF80BE376449308157530FFA60D521A72726379AAEA3A0D41467F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525077, "uuid": "ad245d3e-4e63-4448-a78c-1eacd1edd4f2", "value": "3072:QaVwqujJmHgpewL/hrHzAGPROJ5PJVsjbiBLfUT9y+PdTU:pV508Kh7zd45PXLcT9y+JU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525077, "uuid": "1bf6cdd7-70d2-447e-ac29-921f30d4a726", "value": 155808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525077, "uuid": "1e773c74-cf54-4032-848d-ba4ca90a71be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525077, "uuid": "47787dba-c617-4a9e-bbdb-74dc4576a823", "value": "eclipse.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b710adb-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784525075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525075, "uuid": "451951ff-4379-49bd-815b-e777d5f08fad", "comment": "Malware payload (Mirai)", "value": "c4c058b8b3a1fa44a19eeabf8afaef8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525075, "uuid": "a11da83c-6d7a-4147-93b6-0c8f63e6ecad", "comment": "Malware payload (Mirai)", "value": "127b2677e32cbfddc212f8aa5a13d7b101c2c4ceccc3ca45f1daba88bf0c43e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525075, "uuid": "a8033463-a769-400c-99b5-6c314ce9b567", "comment": "Malware payload (Mirai)", "value": "ae85e1f35ca99d6532ced1738656266f34dc9bcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525075, "uuid": "7398b7b4-2019-40e5-b9e6-ee2727840bd3", "comment": "Malware payload (Mirai)", "value": "e42c551aa631bcdf4d031bf6ef0e9d064d86b3a2101f936934db5d0625e0c2f7c753e8f63618a15885a68c61e36084c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525075, "uuid": "60e5d9bd-6b50-470d-9406-c31fe23fdba6", "value": "T16C14541A3A22DF7FF56D827047F78920579876D63AE19584F26CD70C1E2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525075, "uuid": "a0026833-f703-4063-93f6-f481e99d9f7d", "value": "3072:6x+SzdBLGYgtQ1RXoB6Xey6T1xIe2HN1xwHQy3:68SdBLGYgAYBBpxqN1yHQy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525075, "uuid": "8c87683f-592e-4b8d-95ae-181d4493d130", "value": 198812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525075, "uuid": "5282ab19-508d-45dd-9a1e-14c4d88d7c02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525075, "uuid": "eb5e5e51-78de-471e-99a9-0e8a7aa29c9f", "value": "eclipse.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60da5826-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784531123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531123, "uuid": "860518b7-f0e7-4ec2-a2b2-dad210698aa9", "comment": "Malware payload", "value": "3aac6a1ad65a120cf0768f09e1d35297", "object_relation": "md5", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531123, "uuid": "05ac17ad-4ad4-4ab2-a79f-a308630e9a0a", "comment": "Malware payload", "value": "12a701790f39f9d462aca26b0223dd1bd7f7ba94fbc9cbbd9546ef5bca2914a3", "object_relation": "sha256", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531123, "uuid": "10c191d5-6cb5-4a4f-be1e-069d733069c7", "comment": "Malware payload", "value": "c4b7412941f17a5d5ff65414dc888e97971d16c6", "object_relation": "sha1", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531123, "uuid": "a3fcffd2-f661-446b-90d7-a972e946e321", "comment": "Malware payload", "value": "c07405f26627af24a3a23b81364797833832e7b540cedb0335359262c181b200a62707d996c021fa2e4287d6b67fd134", "object_relation": "sha3-384", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531123, "uuid": "becc50f3-ca70-4b2f-b906-53c2ca8a579b", "value": "T1126240049C3118D8DAB6CA6E4B9271CCF919229333DA34B576ACF4856FA131C825FD6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531123, "uuid": "ed113062-8aef-481f-a13e-eeb5859fd88c", "value": "384:zyjxONneQovt9aVUsnci9M/ld6P7F98sdhwOo/t:WcTB9M/S96/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531123, "uuid": "7eee346e-6721-47e1-946a-7fd089bb564a", "value": 14749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531123, "uuid": "5242358c-ef1f-46ff-97d6-0b65d11bfd9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531123, "uuid": "5b891e95-3289-48b0-a44e-2bfecc8261cb", "value": "1_smb.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4aefad-83d1-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784507223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507223, "uuid": "350ecc7f-e4e0-4e37-82d4-56811b5f74e4", "comment": "Malware payload", "value": "c0043cc3241b422bd0ccdf5cbbd7937c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507223, "uuid": "5747ad64-fb48-44b6-8982-241518161998", "comment": "Malware payload", "value": "12d21b742c5e2a9e28bf0fc232a3b8d8963cf0c6c4278d4d551bda774495c3ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507223, "uuid": "9a7f4ef5-dfe7-41ec-9cfc-92b6a10fdb32", "comment": "Malware payload", "value": "329341116a4e35883118b5b1285af6a43cabc132", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507223, "uuid": "5e98dafc-9cb9-4828-b4ba-a2ca4288e4e2", "comment": "Malware payload", "value": "f7481a3ae670322bdbcda2f0d27074889fd335ed563a0a4ba3cf1827946a5afd5e8df37c68c3ff8d2a9fd338842ed2e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507223, "uuid": "43b3eaae-57fc-40a8-8310-b091b84078ac", "value": "T1A4B312B29D6F02AD59EA2A732FED4608510CF98CDA61D5F70AD572E590F8E693C03603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507223, "uuid": "928b94a4-6f6e-4a61-b91b-c1fe5e0d7421", "value": "3072:hLewLuzXXObGiPXsOyYQEfwq9ftB4x7R3quTkkoutD:8OEOyHjq9FB4xd3qMjoSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784507223, "uuid": "ce97d2ce-195c-4b31-b458-266d77df5847", "value": 114520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784507223, "uuid": "64f6e8ab-91bf-4ec2-9ee5-1aa7a59c827f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507223, "uuid": "301c7008-07af-4841-bcba-55dd0e82685c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c73fbb-83d0-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784506484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506484, "uuid": "b7403603-7554-421d-89d9-025a6dfc3b30", "comment": "Malware payload (Mirai)", "value": "97c4cd3a6398602c98512605e29df1a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506484, "uuid": "21794859-950b-4aa8-887f-d9a19e3e9764", "comment": "Malware payload (Mirai)", "value": "13f6c8dcecb6677e77680f2b75d82b17fcee135cc00b474bcff5d9c64a06e9bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506484, "uuid": "ebb5c971-cbd7-4312-97b0-8921f3859902", "comment": "Malware payload (Mirai)", "value": "5a710afe6600050143d1ac0afc92eb00e0e81f86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506484, "uuid": "0e8cf8b8-0230-493b-be0b-e5808a723fbb", "comment": "Malware payload (Mirai)", "value": "482db8c6a595fcf86befb42dac67129e3798c2459772ef0c7d34d872213e3c3370422fe2b57c9c1cb6fcb9e42caedeb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506484, "uuid": "72d19808-428d-4a61-bf40-c24690331761", "value": "T1C5B34BCAF801DD7EF81FC6764463690AB931E2615A831F73A367B953AC311E06923F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506484, "uuid": "2435a808-aa53-47dd-bd71-18cc4b6da9bb", "value": "3072:bEqlTGXzA07KXSbWavdyyt0RdAVhQjloBPX5BA6:oWTIE07/0ytydAbQkPX5BA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784506484, "uuid": "89cf2dcd-cf7f-4165-9d14-cf0ea6dea075", "value": 115960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784506484, "uuid": "d792f38a-669f-4e87-94dc-397e015fb1bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506484, "uuid": "566e762b-5ad4-4b43-a999-9a39688b24fc", "value": "ohshit.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083f856e-8408-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784530545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530545, "uuid": "e0ab98fa-16f6-4cab-949b-e5be337265c9", "comment": "Malware payload (AgentTesla)", "value": "11412f3a032fc7ddbbfaa205d073d789", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530545, "uuid": "619f35bf-1ffc-4518-9c8e-2cab18a594a7", "comment": "Malware payload (AgentTesla)", "value": "14b1cdf2803ab51bac5593ad512feb74bfa08ed03588bebbed11200e3ee5ad47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530545, "uuid": "e73b1957-8582-4c38-8d25-c76ffce65a6f", "comment": "Malware payload (AgentTesla)", "value": "65d4d6572b7be7232b3e58631a9c8bd18a9a6bd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530545, "uuid": "6557dd82-d556-4891-86d4-e53aa87ffb31", "comment": "Malware payload (AgentTesla)", "value": "49f3cb8d210e425f8170e5fb86a37e9ac425aeb2c9452c1415d0f4530a0225a34f870adb2e788a87f0dbc12852a037d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530545, "uuid": "5434a342-cd07-40c3-87ca-454d4f9e72a9", "value": "T159F5E540A7607273B320D3AE1136DE78940E501364EBDF26728EE668765CD5BA748FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530545, "uuid": "ca513c4e-b15f-4b2a-8874-5f7c1f610a62", "value": "98304:y1neNr3yqzBHOeuIOsSjB+4+Y8hRGhY6MVeZRygmB8tcl3kVK3SSePfDJ:ZNr3yGBLuZFv+JRGQo1XIud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530545, "uuid": "a52eb6f5-5b44-4637-a106-9f7bb4ccbb12", "value": 3592963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530545, "uuid": "53c8fe01-60a4-4cf6-a668-c800b4c5c35d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530545, "uuid": "04f5123f-4fb8-4dcf-b210-362db1336227", "value": "Factura 26-287.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825a11dd-847d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784581001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784581001, "uuid": "0d3d824a-ba42-4e1b-b4a6-e4dd5e8cdcce", "comment": "Malware payload", "value": "d3145cfdcfb520b12abe7a8ab9892a26", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784581001, "uuid": "70b39d9b-ddd8-4aec-96e4-724e206cfe80", "comment": "Malware payload", "value": "1551ea450f0da4f6e6494b4fab62a7637f7ec5d1b7d6d47b032314ab5e761717", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784581001, "uuid": "4db5f521-09e1-461f-8320-1788134f1710", "comment": "Malware payload", "value": "d7a1fa26361f42e7f35827d48b03820103eb4203", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784581001, "uuid": "2cff9132-7e31-430a-a193-b7bee41142b5", "comment": "Malware payload", "value": "13f0e5b75ccca796721c20bbee8c848fc067dc70593b8a1e8b6e5a03ee23e76c28f55c0129c5227657eb915a25498a6d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784581001, "uuid": "fa3441a8-2516-4ae4-a1c1-e529ab9da394", "value": "T16B236C6516857C14AA98C4375C7E2F0CBDAD43E6314492EE7FCE3CF28C4A6AD9208B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784581001, "uuid": "f4cdc140-6933-488f-b6f6-209908a83e92", "value": "768:Vgq9NyXsZztCQ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:qqHusZ4cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784581001, "uuid": "4b372025-9853-4d27-a91d-128660e6d80e", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784581001, "uuid": "d6cd7d61-6dbf-48c3-86d7-a217270e0b05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784581001, "uuid": "b8e62c9b-f921-4832-a8d5-760c3f6ed1fd", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b120dea-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload (Tofsee)", "timestamp": 1784534201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534201, "uuid": "7226ef8c-ba84-45d4-bb57-a2b53ac7e1a5", "comment": "Malware payload (Tofsee)", "value": "7aff39817fd60f3ea5b9298e8838b481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534201, "uuid": "1d63e939-ca5c-42d7-8d43-4db6002128e6", "comment": "Malware payload (Tofsee)", "value": "164e4dd739dacd0e13fb125905abd4ef3293391d34405421ddad4470826c1941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534201, "uuid": "4fb4dcc7-0ea4-4620-8631-6f7cdc005db2", "comment": "Malware payload (Tofsee)", "value": "ed5e0b6b2cab48f0d86d7f2b6cd7354ce760c7ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534201, "uuid": "ef87ceda-1c90-4df0-9c8b-c145782a9dd4", "comment": "Malware payload (Tofsee)", "value": "923ac0bf8cac451bbc7551933eb118f6ac7fbfa85340c81b9d71ac6c10c42222156dfbfdbd2a13f9d22b7e3e723a0e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534201, "uuid": "104d831a-9cc7-44fd-8743-a0cda80fad07", "value": "T128D601736349A93EF06A0735897299A0443F6EA1EC024D0B96F4BCBDDF351613E3B646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534201, "uuid": "f5fb648a-51ab-456a-ad0d-299a4e358373", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534201, "uuid": "bf3e69bb-b413-4b81-96a1-b7db904e1b46", "value": "49152:AoJ+IwhhYitE+sOPo20thpJ0kstXxz7B0GnaPLXwCCqtNaxi2VEXmKiFt/gc2XFl:AoJJqZtTDa2ks/z7jaPvCoME25oc2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534201, "uuid": "37b4a05e-d4de-40e9-8fe6-82924af43541", "value": 13430388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534201, "uuid": "4b7ce379-31cf-40a6-8e48-29b96d69c028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534201, "uuid": "dded3737-0573-44c5-9432-17d7ffdd8361", "value": "7aff39817fd60f3ea5b9298e8838b481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cee53a-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574694, "uuid": "82b3b354-b7b6-4eca-846d-22215cd2e804", "comment": "Malware payload (Mirai)", "value": "58b3a8858337db98ed08899a995d8f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574694, "uuid": "f2147c46-879e-40e0-9539-596991ba15e9", "comment": "Malware payload (Mirai)", "value": "1684d94aee96c6c48111d57b4c1999cad4f4c490091a6b974492bef7a4519109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574694, "uuid": "00cfeca8-52af-4f78-bd43-03bf517383ca", "comment": "Malware payload (Mirai)", "value": "32cdf72049b323cf020fdf1d6141abe623377066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574694, "uuid": "dac8b0c7-674e-4971-bff7-37e62c637bf5", "comment": "Malware payload (Mirai)", "value": "5bb9b546842850e60ed5b93168dd189597e9b1bd75d7922c686c397ae8723e3355320d1eb2c7d25d3a5d87e39ea7163c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574694, "uuid": "2138ca1d-e8d1-4f31-9e3e-a597dd49f1e5", "value": "T1B3E33B45FC509B26C6D3227BFF4E428D772A1768D3EE320399256F20379A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574694, "uuid": "a8cdfeda-0261-49b8-bcf9-b148ed75d2c5", "value": "1536:xwfp4C9pIOGQG/qAC8NIo8PFlhN9IPhHetADL/7T5xUPp8YZXOOxdsSTNB2lcWwy:xrCPPGiJNCEtAn7FGPpPNaShT4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574694, "uuid": "edbb7980-8e0c-42d7-8109-3c2ca772d8f2", "value": 150224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574694, "uuid": "f9cca562-6101-4e59-8b09-e1c7e9ada31b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574694, "uuid": "af4f28ca-1144-4735-b8d7-cab3766efb86", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b69500-83f8-11f1-be1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784523917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784523917, "uuid": "6eb02309-ac6d-49a8-ace3-6c35eebdfbec", "comment": "Malware payload (ConnectWise)", "value": "8d9ae15bad75bb6a0982d24631ecff6f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784523917, "uuid": "70c0bcfd-3b8c-4580-b888-9b8da28cc557", "comment": "Malware payload (ConnectWise)", "value": "16d76fb73e844e7ae13081b614f4b7449d4f020246189bfd6d77585d33a55a71", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784523917, "uuid": "b8ca529e-8760-486b-9999-65bfd91fca02", "comment": "Malware payload (ConnectWise)", "value": "332e08d79b97bd05d35a8c84b621c2d040f2867b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784523917, "uuid": "8a36f077-008b-42b7-a4ad-e477aecabcbd", "comment": "Malware payload (ConnectWise)", "value": "9fa56424683872b12cf611eed64458704913a58087ded8eafb7003539b7f9d58c03686b91b41b1d1876a82ee59b476de", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784523917, "uuid": "d52ebb3d-7ca9-42bf-88b8-abe949969302", "value": "T1B2D61211B3D594B5D0BF0638D83A92656B35BC008B66C6AF6394B96D2D33BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784523917, "uuid": "7569b5dd-51fe-465d-81ff-38f415d840dd", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784523917, "uuid": "0807aff2-9a41-4739-a7f3-5b2be3018601", "value": "393216:Lq5VDBCDxiQE2q5VDBCDxUq5VDBCDxrq5VDBCDxj:LpDE2pepVpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784523917, "uuid": "b24e6c70-4715-4897-9293-c96034b5461f", "value": 12811320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784523917, "uuid": "c36348a0-2068-4f47-8e9e-4177af6693bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784523917, "uuid": "e28fa198-bc6d-47c9-aee7-46325d680979", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45abe8ec-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574887, "uuid": "26a33640-64b9-41fd-b84c-163448430fe1", "comment": "Malware payload (Mirai)", "value": "9420d8b22ef1c9ee3632e0bec7e24b3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574887, "uuid": "88801237-329b-45ff-a566-9c11f47f9c96", "comment": "Malware payload (Mirai)", "value": "16e1cd6a877ff9c0c0c4fbe3bb87a6077ca30dbe9443b8096456a7ad4dc63955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574887, "uuid": "d0031583-09ed-41f2-bf9c-8d608936b870", "comment": "Malware payload (Mirai)", "value": "785346da4d2c9e00b8af69795a4ec039aa51890d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574887, "uuid": "0d15cb47-39f7-4a5a-940f-79511fd70fd0", "comment": "Malware payload (Mirai)", "value": "66361b1aca12b7513f981d26b9af157bc6038f2c78eb539a862cdaed4cd07e5f138bbdba119a6932282ecbe4ea0e6334", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574887, "uuid": "bd539c12-2d9d-4879-ae63-bae1e9f12bd6", "value": "T157B35B02B31C0F57C1970AB02E3F17E587BEE5D121E0BA89651FDB5686B6E37144AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574887, "uuid": "6238f68d-9ad2-44d6-b015-f0e27dfa888f", "value": "1536:FBUs1+65Uhz9E0FUrBhyKt2c4cH9q+puhuOYffFgJi:FBUs0lUrOt09JuaSJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574887, "uuid": "3144b0c5-1c64-426e-b0f0-83443d7d2b5d", "value": 108108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574887, "uuid": "bae67e27-cd01-4449-9261-8c7405e965c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574887, "uuid": "2a4c02a6-f94c-49c1-a50f-a559df159ee9", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3bc1b2-8448-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784558286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558286, "uuid": "105ca3ce-ba30-4ebe-8201-c6e9918beb5c", "comment": "Malware payload (AsyncRAT)", "value": "05303a7d2a6b9a8672abaa23abf2c99c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558286, "uuid": "ff119dd3-9595-4538-af21-435586b2c697", "comment": "Malware payload (AsyncRAT)", "value": "174047faedae187b42c666c6c34ba1fdb1791b16f1c63f6bd2258fbd6409b77a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558286, "uuid": "1f50552f-95eb-4341-b96f-7b391fd0636c", "comment": "Malware payload (AsyncRAT)", "value": "6c7c555a55f3b3d7b58c71f6ecb8df87e9296a06", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558286, "uuid": "ac935a9e-aca8-4f7c-9a1f-03c4c0413b01", "comment": "Malware payload (AsyncRAT)", "value": "50761771a2791de6ca8dcc756cc932f37c58bc3b04e19d11559b3196f7fb54f8c49094c81ef67bf373ad019505554ddf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558286, "uuid": "e63020ab-098e-4203-8414-5ef742596538", "value": "T1F294BF423D0CA8D7ED3D2372296785862FB474BA4B92169F7AAFF65648023034E1FD5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558286, "uuid": "907f6a6c-820d-49b0-8021-28564e4713f0", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558286, "uuid": "4cf36c9e-a0c6-48d3-9713-58a10479caaa", "value": "6144:Jwq3Nplp8rtzZ3vxjmMAQFEY86jgGf5LYR1tQ73cnfU71437AU4asFS7kq9DCfQz:JzhufPAgEYFVLaFkqooa4F8LW/cQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784558286, "uuid": "6155d5b6-bb91-46c3-baf1-f284d2bbe80d", "value": 412008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784558286, "uuid": "15107ff5-217d-4122-a8c9-bc55fac2aa56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558286, "uuid": "aaf6f74b-9e0b-4f2d-861c-e8c6b83c85e3", "value": "Sanseredskabet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09db9898-8472-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784576075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576075, "uuid": "258f1f69-b54a-4b7b-97a1-98a20a7eff05", "comment": "Malware payload (Mirai)", "value": "944f1df7d08cbd62983083bd586265a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576075, "uuid": "b35b9ff0-53f1-4648-a70b-a8ab654a2c02", "comment": "Malware payload (Mirai)", "value": "17d1b0c433da78f9a1de8e1ebb04e3174961f8b97aa5d489b21f28dec1c2ac15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576075, "uuid": "e59d13b2-d377-4a6e-b54f-7d85e240221f", "comment": "Malware payload (Mirai)", "value": "57268ed5426392cc682eb19ac5ad56f0caee7f5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576075, "uuid": "5b0c1e88-e7f9-4882-beb9-30e8beb39ae8", "comment": "Malware payload (Mirai)", "value": "c6038ff9fefea45a42712bd5267e0c06a0e38519c698dece765df78b01d345ef52cdfe9c89d5d362c2ebefc80e748cbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576075, "uuid": "66c8e38c-f646-4d6f-8317-762b77e56aa1", "value": "T1F7B35BCAF401CD7DF90FDABA4467090AB930A3A166C31F26625BFD93AC331A57D12D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576075, "uuid": "958b75ff-26a7-479a-9e47-000326f00db5", "value": "3072:vXgbJa9qvuV2/UZfiS3T2HIvBFJ3oMZJ+NigpmyuTpuh:fguqvPOfiYTPRHZsNkyuwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784576075, "uuid": "45129ae0-0d5a-4a14-ae48-e20a5387b388", "value": 114684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784576075, "uuid": "ead34e0f-1d72-4f1e-af67-f94d85bf7041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576075, "uuid": "6cdecb48-81c6-4ad4-863a-1f39d40ee622", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e348d7c-844e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784560727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560727, "uuid": "21adabfd-4c96-4c5f-b60a-a2608de93267", "comment": "Malware payload", "value": "a93dfa5745b7ac415ed1eafc4e33beb8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560727, "uuid": "06fdf1ef-3787-408a-9e85-6033c95342bd", "comment": "Malware payload", "value": "183def10cfe9473eb4ac24b08c39418253d770eef9a196e42115fef79072db9f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560727, "uuid": "3aef71b5-68eb-4756-bd11-872666c2a9ed", "comment": "Malware payload", "value": "ef1fc41a49db9c2cac5bc95fc86a445abac474d9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560727, "uuid": "6d1444dc-4323-4a6d-8937-7e4554978933", "comment": "Malware payload", "value": "311b8115f6d1b0adbb66d899caee22a2464f9ac5a9459e4fdd493501f35b802bdc6e7b205a6f45703db2c76e32d94217", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560727, "uuid": "4c6c6a9a-f108-43bd-814d-71c5ae0d344b", "value": "T1B16423718534D40F01FFC6782BE74FB27D5A399762BD1ED916AC28AC1EA8094FA8410F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560727, "uuid": "dd90c367-c259-40dd-8914-e61af5c5a721", "value": "6144:IogwsCRLAnnuFJysSaSY0RDnAv942iGWFrxfTafBIuKPz:/1syLAnuXBShdA1ziGWFNfTafBIuKPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784560727, "uuid": "d239e6b9-192c-4a23-8b1e-b759a8cadd2d", "value": 317912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784560727, "uuid": "7af7540a-c6fd-478d-b2ba-0a4adc2859c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560727, "uuid": "c742d750-462b-4592-96ad-6ff1c168cd27", "value": "\u0916\u093e\u0924\u0947 \u0915\u093e \u0935\u093f\u0935\u0930\u0923_79266.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4031ec21-842e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784546960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546960, "uuid": "672a3b6e-74da-4388-a9d6-b5b750a7aef6", "comment": "Malware payload", "value": "d6b2e1826c596ec94e96a2f5a4c80868", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546960, "uuid": "feeaf129-c3cb-436f-b439-ac12b5e3a5a1", "comment": "Malware payload", "value": "1849dd8e732e4e70410b48d598b7995f7af8d0935e4a85fe10928292daaaa41a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546960, "uuid": "663eaaf1-2303-44c9-86ea-5823e0c3177c", "comment": "Malware payload", "value": "c8165b39e83431daa32f57d73c0f6388fbbcdbef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546960, "uuid": "c10a8f50-d290-4f7b-9752-14f270fa599a", "comment": "Malware payload", "value": "9f2824506dce319dd117fa6cf9f33b2faeb38cb88adc87f9c9755143f4553146a60f2d08c39149e05b66a72c125abe47", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546960, "uuid": "dd28ffed-01c5-4cc4-8f7b-4a064de04a93", "value": "T13C44ED3075E81159E6F3EF716CF47BC69EABF5736531129A5842030A4D02E80EE65B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546960, "uuid": "d8ee322a-d957-46ae-887c-52fe4bb59048", "value": "96:d2Sy1YcUbAfC0Z6gy+HURIhydy+njym08uQ:d2GcIAfC0ZGWbc+m08/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784546960, "uuid": "bda6dfa8-b2f4-4639-a32a-af6d1b7be8dc", "value": 266522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784546960, "uuid": "9c55211f-64f7-434a-8a15-f484cb89161c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546960, "uuid": "0ca37c3a-5a99-4518-90df-1efb77134083", "value": "Invitation_Aug.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bea5e29-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784574441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574441, "uuid": "0cd87678-6020-42ae-a6e2-b6d82a73f961", "comment": "Malware payload", "value": "f9bc364d90ce3068857255f9d728ba6e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574441, "uuid": "4b85cf01-271d-465a-b0bb-c6375d0e59d2", "comment": "Malware payload", "value": "194742d59dacc09a04a398be2f1de1403b65e2ab7028a5125bd1b3d4f55f31c0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574441, "uuid": "0385e3c5-1815-4c56-9832-18256a44bb0e", "comment": "Malware payload", "value": "2556c885d1f59017a26d4ab8c8ad01d474e6e507", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574441, "uuid": "43358964-3736-4ed2-8c3c-d3b12c05c4ef", "comment": "Malware payload", "value": "c7a1c789f626755953b3be6516c9e482f8d26720c496adfa83063e1bf9101e84697aba3309bcab262708979aff9b8817", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574441, "uuid": "cfaf0158-5259-45e8-b2c7-608efe8947dc", "value": "T1F86423783DEE046E4065DE6DE0A67231DEE83724B564D7AB69E34A0C078CF364F0951B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574441, "uuid": "1a280581-7565-43b1-908b-f886fd235fff", "value": "6144:l9cPfRPXe/NqgoOyYeXFl3lXK8RhotTVpIq9gA3HA:cPU/Nqgose1dABIU73HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574441, "uuid": "d09e1231-4076-4957-ac6c-e94236785201", "value": 321486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574441, "uuid": "3f643a63-8a02-490e-a65a-af1b8eb9992a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574441, "uuid": "b1cd9106-7ed8-4b76-96e2-f502c237471c", "value": "apartment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c676b4c4-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509390, "uuid": "a7c01065-8e14-498c-a33b-6db78dbb039f", "comment": "Malware payload (Mirai)", "value": "f366c32cbf1af0fe563595db24b0a32f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509390, "uuid": "8b3030a6-76a0-46ad-ba92-7174864085ec", "comment": "Malware payload (Mirai)", "value": "197cc8cb6a519636b797ba4ecb540e908486c581c99f653971bc6bb328041d17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509390, "uuid": "dde12cf3-b9c9-4deb-bf0b-8567030b9f2d", "comment": "Malware payload (Mirai)", "value": "ac871a53c9869281ff009ed5db7028ec12cdee40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509390, "uuid": "ea069e54-f373-495e-85cf-c624ba69cc2a", "comment": "Malware payload (Mirai)", "value": "bb9bac1435f4039e5330dcd84b72facc9b2caa3124fbf95f5b0b05d08d87d1c535e8908440df3c6f10e72b7ece8bf01d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509390, "uuid": "98ba47d1-c239-47e5-a8b9-7e219a43ce8f", "value": "T167C33B0779C18AFEC486D67803BF7526C522F83E1B36338B67D47D693A09AD42A1D319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509390, "uuid": "b9e59f16-32fe-4a6d-8575-03c5cabac230", "value": "3072:S6SblaZFi4q0KI1XeN31xwnPEbt+uYr0uBtuerGulNpS:tyUFi4ZVEDwPRuYpBt9rGulNpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509390, "uuid": "639ab535-fec4-44ff-8d45-4b0e40ac87f9", "value": 126925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509390, "uuid": "4ca39bf4-4558-4b26-8f5f-4cb290c0d069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509390, "uuid": "7ad589c7-60a4-4d52-aa39-8c3ac94617a2", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcd06c4-8431-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784548328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548328, "uuid": "8a64452a-6f69-49b6-8ca7-4e52b3e09fea", "comment": "Malware payload (Efimer)", "value": "d42f013cd8039d201d487e5ccd3f0f9d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548328, "uuid": "6baa6779-3f37-4746-a1dc-5419a08a1cce", "comment": "Malware payload (Efimer)", "value": "19d5b8632069a97d24b45f9aa812869716823a01168b796c4eac6a95ad175053", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548328, "uuid": "ab9f4438-4ba3-4042-8339-ff88cdfe3d98", "comment": "Malware payload (Efimer)", "value": "c953e974b4d6b0e970209eada8554df8a48bd34e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548328, "uuid": "83966eba-aa93-47ef-9e3c-cff1c3e7ab8a", "comment": "Malware payload (Efimer)", "value": "5a65f0955fd039943494ee18f22ed53b120a6c126082cf310c702744850299405a47bbedf15c1db2e7c1f2e429c0189e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548328, "uuid": "095ebeda-914f-4f7b-80df-8b95a6e8c127", "value": "T1E6E6335875D001EFFAE3803CEDE1521DE9A4B8651F71C99F06A8C6A93D272A28D3D707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548328, "uuid": "1fc8ef55-79a1-47a1-abe1-931847ef1ccd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548328, "uuid": "07a77d4a-ce42-41be-a26e-2ac4b07af5a1", "value": "393216:2VWunmoJ9pdHZyyocbFCFXMCHWUjX9cuI3/PGTAI:2VPmCRcACFXMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784548328, "uuid": "7c5e60c8-71a2-4eb5-9bf9-2300d33980d3", "value": 14285613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784548328, "uuid": "719b11ef-ac50-486e-bb0b-bc77a886676f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548328, "uuid": "eb7fb218-b17c-4a30-9223-eb6782b56d05", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f19767b-83ce-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784505780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505780, "uuid": "9906f01c-909d-4eb2-b319-05705e0ab14f", "comment": "Malware payload (Mirai)", "value": "0cc5db6b5bb1ff767813f918a5de0fa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505780, "uuid": "af9d6d54-4998-4f3e-8479-a32f82832d1f", "comment": "Malware payload (Mirai)", "value": "19fdce2472485db5fc8d8820cda7c798212d01a830f76d22e6e1612f38dde37c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505780, "uuid": "bb848046-7113-4ca8-9432-2d3cda2bda2c", "comment": "Malware payload (Mirai)", "value": "4efcf94ffb9e9fec4df62912f82f3beadefeed2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505780, "uuid": "b9de9db2-1345-4339-9cd3-2febf9afc041", "comment": "Malware payload (Mirai)", "value": "c2b4916e741c009eae6949c2bf02f34d94571f1c055f4364f500f841c307f903c6d1e8721e406fe03a5e4013b52639d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505780, "uuid": "c2ff2382-db62-4e99-aec8-d8998fac4de2", "value": "T11A53F2A854CC63A0CB4A403825FEB2569C0D99A6DC59CED356DC983F64C3B443EE63CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505780, "uuid": "51c16700-3ce1-4f7a-b1a8-d3776d67e2c6", "value": "1536:qYvrcMtBE9odJRwdzC1XM4HUAp/SVS1T3HsJymA0NgTN++nouy8DMb:nBBGcGhecoUA9YcCf/gTN+eoutDMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784505780, "uuid": "79101a97-d4ff-4dcf-aa56-05812a11b291", "value": 61204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784505780, "uuid": "49db05f9-8073-4398-8cba-f5b298a419ce", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505780, "uuid": "6706a925-7a95-498e-8f70-9164b823e7ba", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5060176a-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784525083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525083, "uuid": "9c45262e-f2a2-4340-9bf6-65d905a5d524", "comment": "Malware payload", "value": "7b548a4ae042af0038c5f08daaf66ac4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525083, "uuid": "e51ec3a4-3b33-4303-aa30-c0512f3540f2", "comment": "Malware payload", "value": "1a14e1a3aa5e58e9183fb0373859c646bc0648501d4b817628665146922bc2b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525083, "uuid": "9d13c61f-ddb3-45cd-9630-4362483ed2fc", "comment": "Malware payload", "value": "13bdbce578065dcc1990edfb69c9853c493298af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525083, "uuid": "280c1487-8e5d-4496-a3f7-4b7a77f235c1", "comment": "Malware payload", "value": "18c3deda98ffc9d683e2c6636e6b4baa9d6494b8417e3d60ae2f2afcc9d2b4f92a7a6bf5db27a35b977550b4453fffb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525083, "uuid": "a9271d22-6bd6-4069-9105-409cf4c3ba05", "value": "T128D3F702770D0E43D1633DF0377B2BE0939BFE5229B4A680752EBEC992719B22545ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525083, "uuid": "2d8b0bed-db00-45a3-a763-9d7a846402b9", "value": "1536:xFdQC+QQdqCHYOnxIPa3An8FxFH0Xi/4XaOZ/A4VvAcV5E3qpS5hxBpqYgDPkK:bdoqTOnxH37BH0XG4XahHcacPkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525083, "uuid": "41980c9f-18c3-4090-b29f-784303e974bd", "value": 135072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525083, "uuid": "76126b7c-c388-4bbe-8c98-28d558ed9d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525083, "uuid": "faf3a422-9a82-49df-99f2-13e66c79f77d", "value": "eclipse.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87427039-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784530329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530329, "uuid": "e5083447-faac-44cf-a2bf-8bc57db53dc6", "comment": "Malware payload (Efimer)", "value": "35e1fb7312299ff4050f6f12f5b192b0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530329, "uuid": "50900900-e995-48e2-a81e-67e1f6483cdb", "comment": "Malware payload (Efimer)", "value": "1b9a6dbf3e43cb6d916e774b90125fa161910f9908a3f8eb7c970a985a73fb27", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530329, "uuid": "c96cd583-ec2f-4be4-bc0c-1e5d006df1ff", "comment": "Malware payload (Efimer)", "value": "031f814a436b4ed57fae8fbc89ddbc5751fb3bdc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530329, "uuid": "7bb705dd-69e3-4364-a9d9-da3127ec286d", "comment": "Malware payload (Efimer)", "value": "ba3a5292b68d05fde64aa2fa89996277e5cdd90179695b501461d4dd7311f1b44486695cd81e7a574b227d9e8e52054b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530329, "uuid": "ecd20dd8-5cab-4362-ad76-0e4a9a9be84b", "value": "T10CE6331876E011FEDBB3907D6EA257E9D1B474770733C9CB4B6486846D2B2E0CA38762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530329, "uuid": "ae71fc68-1c92-4e8b-9328-9221d963abf9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530329, "uuid": "d22c5a63-c290-4490-9495-fa5547e33289", "value": "393216:6JHlbBhqCyOFhVp4UXLbcHkXMCHWUjXecuI3/PGTAI:6JFBhdyOr4U7oEXMb8XTH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530329, "uuid": "cbf1b7dc-fe7e-4640-8d34-4b4488785423", "value": 14327023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530329, "uuid": "49558a2c-0813-4327-8c38-48f50a99a05b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530329, "uuid": "e5482435-829d-4038-91ed-00ee692b7fd6", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb26bd2-840d-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784532918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532918, "uuid": "788c5c69-6742-4ab8-abb9-a9f22ed9d35e", "comment": "Malware payload", "value": "bbf7da563ac101d393b7f871681468e2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532918, "uuid": "f7159483-d288-41d9-911a-39a84c5fe746", "comment": "Malware payload", "value": "1d5c3b46efd61ff506fb52d99d015129d33b3a4aafa89c96953e7b84ac195158", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532918, "uuid": "e9de4522-80e9-45d0-8b41-110ff29d38c8", "comment": "Malware payload", "value": "e7826599560e4f0f2f9461b4b4c0f82caab73dbb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532918, "uuid": "e8eae706-e96a-4c60-ae62-b4b2c7250445", "comment": "Malware payload", "value": "eef9e6fb61e8098cf39275662be7b804e50094361267429d2e819de63f03e5d58ea04243048779ce145f7229d4830d64", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532918, "uuid": "be944f5a-f146-4492-baf8-828d926a287d", "value": "T18AD42360B9C70EE787EC25F3BE495AB2794782EDCCA1930040DCF4AA5657580FB6CE94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532918, "uuid": "2af7b94b-2283-460b-a7d9-94bfb7740611", "value": "12288:mFiXfaaOZ26P7sLHKh+87Q8muY5kW0nloGdO80gpcfAypoBOP0WW+A:m+aa6uhmlmXkLdzcfA1+0WWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784532918, "uuid": "c54fe6b1-c4d9-46d0-81a1-f8f1cb288dcc", "value": 639654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784532918, "uuid": "547d321b-82c4-4094-8c16-3677d7b6fdb6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532918, "uuid": "62b6db83-020f-4093-837e-a10c84ab6a10", "value": "ComprobanteXdeXpago.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbefeb26-840d-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784533021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533021, "uuid": "7f8cb6d0-a809-40ef-b944-53001f37e986", "comment": "Malware payload", "value": "fe245cf57be8b3daf8cdb3882de99f35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lazykoala", "colour": "#533BB4", "exportable": true, "hide_tag": false }, { "name": "lazystealer", "colour": "#A8160E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533021, "uuid": "0cc4a55e-1fcc-44f7-a492-7e572df99e24", "comment": "Malware payload", "value": "1db3d0ac68515b5c9876634605ba8492ba558f7df435bff2b20a74239107f3ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lazykoala", "colour": "#533BB4", "exportable": true, "hide_tag": false }, { "name": "lazystealer", "colour": "#A8160E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533021, "uuid": "9369493f-1b47-4918-a39b-e8778234d4bc", "comment": "Malware payload", "value": "40789ef406772e52a0dfc86509cc7617fa8b54a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lazykoala", "colour": "#533BB4", "exportable": true, "hide_tag": false }, { "name": "lazystealer", "colour": "#A8160E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533021, "uuid": "d406e63f-f485-4731-aeb4-b62cf356979d", "comment": "Malware payload", "value": "2eea6f657f1fb6b9a3b26c5da894a025a4da3f9e8ad23950bb17eb35fba1d49c645061e906112267748fbd39f3850ef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lazykoala", "colour": "#533BB4", "exportable": true, "hide_tag": false }, { "name": "lazystealer", "colour": "#A8160E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533021, "uuid": "d635bf6d-bd6b-4b68-a11d-c1af0b6bc3a0", "value": "T15B963304530104DAECB7963D65A1CE14D9B1B9A60FE0C3DF4BB462790FA7EE6B879E40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533021, "uuid": "78cb2150-1e89-4ccf-8278-f8ddb3b13e3b", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533021, "uuid": "8a9cf9af-97cd-40b8-8e8d-b14487d5e955", "value": "196608:dAdzUjpRvXeIXf5GY9onJ5hrZERoyiU8AdZYJERMEzsDyrT6lbL:yoVRvnv5X9c5hlER0AdZYy+0tra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533021, "uuid": "80647e87-500d-4c7d-95b7-05d5ddfe31f7", "value": 8949296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533021, "uuid": "b41a2eb2-ba34-46b5-839e-b9ee67ab808f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533021, "uuid": "c34ac594-94cf-477d-933a-d9961c510b28", "value": "1db3d0ac68515b5c9876634605ba8492ba558f7df435bff2b20a74239107f3ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281eb888-8438-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784551215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551215, "uuid": "9d74f5e9-5da1-448a-a2d8-2d2cef483553", "comment": "Malware payload", "value": "6aa665d2f33f03a549c14edec772cf2c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551215, "uuid": "e1781fb5-ea95-4742-8ea4-ce905de98a21", "comment": "Malware payload", "value": "1e99972b1d84b131eb55a6b49f64871c5c0c6a1bb2a099a84313001b69dc53e8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551215, "uuid": "e5746741-733e-4ead-9e6d-f7b1817398d6", "comment": "Malware payload", "value": "81fec7d1b670cc15cb88b072fd110588d7018e62", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551215, "uuid": "1280f001-889d-4fec-8b51-13a42a80022b", "comment": "Malware payload", "value": "1a6925a5fc03111da4115226792aaa2b419ee47b67a3dc065186fdba43c35a1fccd3f7fe05c8e2afe65d6cfea58b1369", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551215, "uuid": "3fd44114-e435-45ad-9889-b02fa970ba25", "value": "T1D6E5ADC6FBC8A96AC0F76332C93556A245474C268B43DF836D54363C18BBAD44F4AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551215, "uuid": "ecae77ee-4ec5-40b6-9c5a-2de61f2d5ed3", "value": "49152:erIm83kLn0uBDBogUzya12VAiijEVCXZj4g2cc5gbk3oTwryVrl2zak2tkg/Dafc:YskvVohn121VVOmoTwryeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784551215, "uuid": "736b41d0-8aca-4b67-9c47-16bb2f6b386c", "value": 3273119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784551215, "uuid": "3e7c6ade-93ab-4638-be85-f61509c5d9f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551215, "uuid": "2551accb-e4b2-431a-895f-bc8798a5d0d5", "value": "unicredit.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1292e863-8428-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784544307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544307, "uuid": "3cca2689-a936-413e-9d20-de7cc759289b", "comment": "Malware payload (RemcosRAT)", "value": "ea0306b65185ab3f4d71c6e6dbb9437a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544307, "uuid": "381c87c6-117e-4c64-abfa-c2d274adc99e", "comment": "Malware payload (RemcosRAT)", "value": "1ed6290b13212d260aeeed891a79f1136a2d0889d87b483fe297942766267f1c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544307, "uuid": "a5bbc367-1ff6-4416-bd82-d4b0a6146850", "comment": "Malware payload (RemcosRAT)", "value": "fbf40ddae09cca05546604e7d684ab320ddc103a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544307, "uuid": "65f40582-4145-4dd0-b569-598ffda146c1", "comment": "Malware payload (RemcosRAT)", "value": "5aa6ee0c04a0807075cf39038a518b52ea1c10d216d24ab8524ae4b57872c1b893403421169c63c5b5812f0f149a59fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544307, "uuid": "5ea7f698-63c3-473b-acbc-efe91d5fe112", "value": "T1E5362AB2728E0B0A448CBFA1A51E5A228F1FCD2466C3B1D4A3D74AD4625EC5F3155F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544307, "uuid": "0ec3bf43-30e8-4014-ad94-68f74f7bc67a", "value": "24576:3U0e2/3WRIKv0tZ4BUT6mGp1cikoaSKElvXbrkikg3koCV4Er4vH+12z6m0vaDpM:PepIm/226m0KLjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784544307, "uuid": "f3b7ba17-6589-40d7-b788-3b63c9e1b457", "value": 5007663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784544307, "uuid": "ab1274a1-3829-4014-adec-0c0fb95c864d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544307, "uuid": "2103fdf0-cc49-4e25-8fd0-6491b958b4ca", "value": "PS56356555555.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed30d789-846b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784573450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573450, "uuid": "56dc5eac-d8c6-45fc-b11f-098dfd986dea", "comment": "Malware payload", "value": "5f20e45252e2843506ff0cde903fa363", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573450, "uuid": "8bf7605a-dffa-4ae8-a314-67cccc693086", "comment": "Malware payload", "value": "1ed821fcc96cd12b94a7d4ab486d718416164e0ef8b607821b02b34c38f02674", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573450, "uuid": "06e04b36-8776-4586-b410-0fa2cca22b49", "comment": "Malware payload", "value": "e988ca8afd243496d05d78d3843912bf60e7e6fd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573450, "uuid": "7176b457-4992-4fe8-96c8-a05c5e552ca6", "comment": "Malware payload", "value": "f9ed05a7865b1d798bffa6e926e5066bb4b3fd0964120447834b863a754e38f6c72912b7c0a8701896b395bab732cbc9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573450, "uuid": "0201e800-53b6-48de-b728-b5eafc630e28", "value": "T149D633C4B5709AEE37C6A7413FE529E9F2A001613DD581C3A690350AD63BADFCEDE016", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573450, "uuid": "a58a9d8f-450d-4d8a-b328-f078bf4bc528", "value": "196608:hYIN/WRt9fPdN5v/CiN+pNGrDYOxlu2qy8fmaKFOuXuLBZ4/u02LnXeOOmhhlI9s:h//QvfPdDSN7GrD6Rl2kZLr9EFemw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784573450, "uuid": "2278d924-05c1-4411-b8d0-770fd04935a3", "value": 12670627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784573450, "uuid": "9629483d-e723-4706-9628-e215eb82a112", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573450, "uuid": "64f9b88a-7771-45cd-a387-5b2bc7acd217", "value": "ISKH_7565_Naznachenie_doshnost.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997212f1-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784534225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534225, "uuid": "89763ee4-ad91-476f-a597-efdf2c8feca7", "comment": "Malware payload (AgentTesla)", "value": "d8d19575c1de6c091ebf0624596478fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534225, "uuid": "3a1fcf52-6781-4ae0-a827-6350ab25ab36", "comment": "Malware payload (AgentTesla)", "value": "2112d749000ec32a1eeb719eb1e0daee69cda7946eab3049f5d2fd83bac566c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534225, "uuid": "eec0444b-6450-4a5f-bb8f-14d782ec9559", "comment": "Malware payload (AgentTesla)", "value": "22d0daad3abfb17c90862ac3fd80746738c9074e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534225, "uuid": "4b2f1e17-885d-49cb-99ad-eb5c4ebb00c0", "comment": "Malware payload (AgentTesla)", "value": "2093a281220b28b153c8cdc94acb68dc81ac5f47fbf79cb98294d9171adfec35af737d617301468f9a1ca4f6889999ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534225, "uuid": "448d055e-6c11-4871-a232-49a8fd5a74c6", "value": "T1753512285A89C811D5EE5B7950A0F37D13F2AE48E420C71A8FECAEDB3D67B015D18B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534225, "uuid": "8b05eb5e-ef4d-45f8-810f-96de6d010b09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534225, "uuid": "0da6ca4e-3297-4d7c-af41-334ac3d1e234", "value": "24576:vCT93VZbQs9fP6p4g8MFnKw8hvuB64pILCbUse7NQ/aGuJK0B0qx8EXb:ap3Vb9f5Ron+hvunCLKUsQNQ/aTJK0B/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534225, "uuid": "26ce4d47-6c0c-4189-bbe1-a88543e3c5c6", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534225, "uuid": "5fc1ea7e-d4d4-449c-943e-a71db066bb67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534225, "uuid": "5a424294-5ca1-4173-a099-5fc6cb083cc7", "value": "Hesap_Hareketleri_08-07-2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d07dfc-8420-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784540878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540878, "uuid": "6d1ac9aa-24ec-4ce7-a47a-0422dbaffce5", "comment": "Malware payload (Prometei)", "value": "f0e8a91c95a6020df987b1383258c6bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540878, "uuid": "19619cd5-d8d8-4599-85ab-a0a77055d618", "comment": "Malware payload (Prometei)", "value": "2134c368a639c7525a6c98d0b5351e50757db7a59a69de707dd390578675a17c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540878, "uuid": "c15f1f05-4407-4234-989e-08da39f93e52", "comment": "Malware payload (Prometei)", "value": "37e1a07d5bf2a61174807ca1c62e0e929c5fa5eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540878, "uuid": "da3916d9-84df-4b2a-ab65-b291253a4b5e", "comment": "Malware payload (Prometei)", "value": "bbafb81f8633da18eaa8687a0cecc273a136ee0ec5e0651ea00a4626cb5c10503d581f0af5832285ae0da6d024820aab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540878, "uuid": "8f483033-06c1-4fc1-9597-6b3ab042bdda", "value": "T190A423B4F9219E9F6DD76DB91B24831DE182C172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540878, "uuid": "e2640f7a-22d9-4394-b161-cb11f1a65d77", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd0:Fs6pyCC/Ya2hpi6T6N4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784540878, "uuid": "917d8462-0c46-454c-92c4-72de9a68cac9", "value": 449083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784540878, "uuid": "378f2ff0-1959-4d49-80f3-2ac0d5eeecb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540878, "uuid": "c3f0724c-bf88-4d0d-aea9-8f88e4b94694", "value": "2134c368a639c7525a6c98d0b5351e50757db7a59a69de707dd390578675a17c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fe4fcf-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574587, "uuid": "dbec4b88-968d-4c74-9203-9723a8e24129", "comment": "Malware payload (Mirai)", "value": "87ddef92060c0219eb9ba4bfec9f890f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574587, "uuid": "a648c130-c5a2-4f9f-b888-7570ffc84f90", "comment": "Malware payload (Mirai)", "value": "22a7ebeb0c7f6c23eb2496577273605c26419dbadf245ed4ee4e1cb056ae7cb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574587, "uuid": "4722898c-cbc1-4926-b3cf-6bac75520321", "comment": "Malware payload (Mirai)", "value": "14c21aee4cc3c1defd595e414baf903c1215ba82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574587, "uuid": "89c6834f-3cbb-4356-b579-665ed45323a3", "comment": "Malware payload (Mirai)", "value": "8b40ed0f96d68439e75916d1124f3c497f8a463fef0473ec604eeeaae87740f1307f6cfe17d52af8f5f12d1672c38b61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574587, "uuid": "232b4291-359d-4144-81e8-145ea4bfca0d", "value": "T1A843023216FB022BD672EA7434F4F6C29B8ECED8D3F5D222552C9914B9EB1C019EC615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574587, "uuid": "5c556aef-4943-40b3-81f9-3e31641dda46", "value": "768:t8Og9ic3f2b69GSNoWYMrLxgL+lOPPS4EydTaQa+VUDCxcZyj9fXFHGzKv4BRh1F:t8Ogbc6hK2/xgBSYdT5aHqcZyj11wF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574587, "uuid": "e16b1635-08b3-4135-bea5-c9ff4fef26ce", "value": 56268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574587, "uuid": "074558d5-dd8e-4d03-8ddc-9f9c4bd7a509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574587, "uuid": "80b2698c-98a2-4502-90e6-3d391b15721f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be9ca83-8438-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784551382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551382, "uuid": "d73fe60e-ec6f-41fb-9e3a-38680a2c3659", "comment": "Malware payload (Mirai)", "value": "c3f0e8d6fc3ef671066ad644bf964d5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551382, "uuid": "135c8707-7160-4fa1-98f3-d914aa56a40d", "comment": "Malware payload (Mirai)", "value": "2460d7ca1260deede7ac70a8a7e9f326f2c68271ebc617cfc60d4526ba21a3c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551382, "uuid": "6bf3f249-ff8b-4ad5-ab94-690c490bb488", "comment": "Malware payload (Mirai)", "value": "f958a284f76addd9fd4031db18da435216fa966b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551382, "uuid": "110145d1-b983-42e7-ae85-55edc87b41fc", "comment": "Malware payload (Mirai)", "value": "bd415ecc3ca87cbd378a43d3d080f7f19afee45cbc194ed72b55290c8f770a90ddaae50577915e77344a08598e2a7963", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551382, "uuid": "9ea3b50e-7f1f-4009-a9be-bb59bf64408b", "value": "T10704080AAF601EF7D86FCC3B42E94B0625CC655722A43B757534E928FA4A54F0AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551382, "uuid": "3d525cf8-ca9e-43f4-985e-4fc10512c896", "value": "3072:ky5WiCraOX5pANI+5AD8BRuxEpq33rIW38XnenOanbX:l580j5AD0RuG2bIQ8XnEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784551382, "uuid": "92cdff3a-6797-4ac0-9aea-b4656c6abda0", "value": 180272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784551382, "uuid": "50970b1a-825c-4fe3-9de5-cba01334d133", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551382, "uuid": "52b83d65-18a7-4b60-a51e-9aa14d666435", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcf999c-83d1-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784507332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507332, "uuid": "3104aca0-7339-43d1-a7ea-950600f12228", "comment": "Malware payload (Mirai)", "value": "1b9a28e8ed3df1e0a23bde802df2408e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507332, "uuid": "5721e698-fa77-45ef-9623-5cbf391c382f", "comment": "Malware payload (Mirai)", "value": "24d8adc83594c77c97fe59a84db8ffda1fbe13faefb495e2075b1feb80018bef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507332, "uuid": "21ee6d6f-1447-493b-84be-866a3acd2d00", "comment": "Malware payload (Mirai)", "value": "2520428f59adb8b15277f83036459c94cf14ac96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507332, "uuid": "e71ee798-a914-4b5f-bdad-eb0b38c287a8", "comment": "Malware payload (Mirai)", "value": "8b1c2e758e654d969dceddbc4e86711816139581a6d02e578a6e3a578bb6f88d414ee2f736113791de0d565e879b70da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507332, "uuid": "054dde6d-2265-4ba1-8711-ff9a5df1584d", "value": "T145747ED3FC01E97EF86FD732C8134E04B531E36154821A3A21A3B779A92B15A5D73E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507332, "uuid": "7909495d-d3df-42c0-a6b3-0a9813dd06ef", "value": "6144:AtGd8qf4fkbL8Mm7HfGVDMvW/hDvBo1z1hiFs1ZshyMhD+MS84hf47LEnkT:A8gD7navBo1z1hiFs1Q4LnkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784507332, "uuid": "2ce4c390-e4b4-4396-9c87-c73008bc2b0e", "value": 348140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784507332, "uuid": "bcb15016-843b-4394-99c1-943b553c589a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507332, "uuid": "6e7afc5c-efb9-473b-ae6b-819216b2c3a9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b336d461-844b-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784559608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784559608, "uuid": "7e3f5840-41b6-487e-8db3-4a0bdd4a5f4e", "comment": "Malware payload (njrat)", "value": "76628da19b4c964cf5186b03c2fe34d9", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784559608, "uuid": "4369af22-e4cd-40b9-98f5-0e1142261dd0", "comment": "Malware payload (njrat)", "value": "2624abf75eb9ebb06126954d914beaac6ea34f55f8307d6099f9f07efad27a13", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784559608, "uuid": "49cb6a95-9d88-44a9-b540-465b2550dff3", "comment": "Malware payload (njrat)", "value": "5cf70a02f8d3b7acc87961ab1d061f6e350b25ca", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784559608, "uuid": "a675dd20-7d9f-425e-9c05-33949cf4c96e", "comment": "Malware payload (njrat)", "value": "380e0524fef8b7b3ba4adf6eea39e49213bcbd0788c43405d1709431af7f9e37b0a21d6dc3ac2da7ce386cab39e3c4e5", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784559608, "uuid": "cecc241d-2242-4349-be4e-2fdc117fc572", "value": "T13A3592C8F0453EB0AE653BDD487601EFB8EC9F49111049BEE47C89E86F22761D0BA657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784559608, "uuid": "0c6a8631-5d22-42fe-b591-525e614ccae5", "value": "1536:PfsiqIKhZk81rk/hZ1E1aGbY1uMBB01YaGbk1OkhZqhZJY1uPiqIKhZk816G1tk+:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784559608, "uuid": "db8de3fe-9ad1-47d1-be6b-a50e74d17724", "value": 1149778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784559608, "uuid": "2a30b344-5db1-40de-8f68-5e323861973f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784559608, "uuid": "308fd4be-929a-4d89-b1ae-6feccc139c08", "value": "z82INVOICEPAYMENTS-23JULY2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb442fe4-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509398, "uuid": "5389a411-c02a-4b02-a3f8-aae342617c06", "comment": "Malware payload (Mirai)", "value": "df1cd12eb28a9b39db6a36a683881c06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509398, "uuid": "642c6225-2a1e-49cc-a33d-b02d3f65054e", "comment": "Malware payload (Mirai)", "value": "26af57f0a8259e9d19a8239f6d681bb0d99e9c643ad21336e967477f66ccda89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509398, "uuid": "c0b9ef43-d7af-4ede-abdb-2f6432ffd68c", "comment": "Malware payload (Mirai)", "value": "bf638d9d56f290bb57151ef49666f585342ed9ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509398, "uuid": "f9b64f86-3146-43dc-8b7f-61b56f5db240", "comment": "Malware payload (Mirai)", "value": "07ec695bc04bf8d6a34c04d35c35029b0ebf30c304b4c42cfa67162f8cc2b1edf82c4aa4323b2b01aa9127a411db88ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509398, "uuid": "b2ffa714-2d1c-436a-a7bb-e61ae6fd74bb", "value": "T1FB13F18E72780E52EF7C787C849E7AC510908E4BEF914D92FBC2232E66C5F11B6185C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509398, "uuid": "9a0bea58-fd7b-4e18-bea2-44a65d6485c3", "value": "768:wzDT+5mfT/P0B4e92Q5m99YrBLuqKC7iA67rquN/mL4OlgfnbcuyD7UHQRjH/:wa5E2xDG9yhJ70H/QT0nouy8HyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509398, "uuid": "40da212d-366a-4ade-8476-64eb88270fd5", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509398, "uuid": "857480c2-17b2-4082-83ae-d16b11eeb0d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509398, "uuid": "dc5ccfb5-071d-4fbe-acd1-56cd6792f279", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e102ed3b-8415-11f1-be1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784536492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536492, "uuid": "607c1f5d-2df3-437f-94d4-2a45a6fa9a5f", "comment": "Malware payload (AsyncRAT)", "value": "44ddc80c714f91959bcaa1aeb3cfe1d5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536492, "uuid": "6c864687-e770-49ec-b0a2-06901bc253dc", "comment": "Malware payload (AsyncRAT)", "value": "26fc8807ce9a5e6dc534c237d84c2ac7491755532a2078878bc8fb1695fcb2eb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536492, "uuid": "0130332f-b788-4fed-b99b-a87c6f5f9a69", "comment": "Malware payload (AsyncRAT)", "value": "7a5ce656b36a081d0f93d5add93a9c8ddc329abf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536492, "uuid": "685dbf92-1256-4fc2-a5af-0241def9e37d", "comment": "Malware payload (AsyncRAT)", "value": "1aeba0a4d08e2f2e3cc7a187ed68d5f7034ff45a4123e9140c58abc180ec704c6a674d653933ad26aad2c52747ac13cd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536492, "uuid": "57d1e6f0-af13-4e55-b7b2-a146e94fe2a7", "value": "T1FB2412A07769D453E7C382730875A77A2FF9A1BA66249F076F023E0CBD92782550F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536492, "uuid": "d847b873-a912-4807-b1ae-4d703a7b462f", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536492, "uuid": "d5e9118d-dae5-4216-a568-7b5655fc5caf", "value": "6144:LT4DtAX5NIc71RWI89tgqNw2Tn1LJ3kcMGuzIz39zl:LT35/z89lJCGl31l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784536492, "uuid": "e0a474e4-b756-4721-bd23-cf726674f420", "value": 224224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784536492, "uuid": "11ceb0e5-16c3-466c-a2e5-62ff6e100f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536492, "uuid": "7501b07d-0bab-40f6-b1e2-3aa440b17a83", "value": "Dialysepatienter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac0f00e-83cf-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784506363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506363, "uuid": "b4b5811c-d202-46cd-90e5-7c6c90455df8", "comment": "Malware payload", "value": "026849d7f28fa44078829e23c8908d84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506363, "uuid": "a7eba326-d57e-4e84-8700-1e4f245826ae", "comment": "Malware payload", "value": "276fdef74ff71efaeb345c04a3ecfbeb2e99ad97584f4eba24e9936f0de6bd60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506363, "uuid": "e1e3a3f4-2505-4338-8052-cb73b1bccbbf", "comment": "Malware payload", "value": "85c3bb96d147f66ed1747d9dbf59e6f83d1148e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506363, "uuid": "edd92706-d29c-4764-b14e-5ac6189efafb", "comment": "Malware payload", "value": "268b1d0b06d79262931064a9da4bf0097acc1acc124bacdf0104adaf12fbef36d9713f360f06587c2a0ebb9b2ee00747", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506363, "uuid": "475d5b7c-c104-4a7d-ba08-a18b7a19cc84", "value": "T1DDC312A313CE7728C2FD8E3BDA854B45A24E559A97AFCE2F123D5231D407B62803564F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506363, "uuid": "f55e948a-0b64-4853-8d2d-64493cf9b353", "value": "3072:uTcgFiozRvfpYBlkHeXbLflWgztSv+6hc:scgtvRYBZXbIgzt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784506363, "uuid": "1e87fbc2-e591-4a94-b050-8044d75f640f", "value": 123304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784506363, "uuid": "938358f7-c5c4-4c1d-92c6-6748e56e77e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506363, "uuid": "c0c12f83-0275-4421-aa7f-ad192a1e4424", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acff576-8402-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784528053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528053, "uuid": "20e05c63-5f6d-4714-8ffa-cf682469391d", "comment": "Malware payload", "value": "fc41fe323d02fcd1478ac3936cc0379a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528053, "uuid": "0fc86bf7-89da-4e75-b12c-1e498d4fb97c", "comment": "Malware payload", "value": "29547e914112958a04fc47b20f25e91a4326f9e71d9ca4aa02f3d81e5cf12da7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528053, "uuid": "40c9dd93-ce04-4f6c-b955-bb47c14e204b", "comment": "Malware payload", "value": "dd30d1dc747b928c801479e544b47bd5ce234d27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528053, "uuid": "e7a27c7f-f164-4b4d-88a5-76acef6ffb28", "comment": "Malware payload", "value": "b39f270ef6647b8179bfeff8593d59ace89b0fbf46106bd199acfd79836164074e395d30fbd592464b4b5c0e81ed34a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528053, "uuid": "ce19a02e-d618-44b6-9367-8f18ef9c4103", "value": "T16AC31293671B8E8AF776FEA2AEAD60590347501136F6FAF38203DD024DD11AA5801F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528053, "uuid": "8fa8afe8-7b51-4aab-864b-ba6c2da2f6b0", "value": "3072:NUaVgfQ5DwxJWxIAR9tTq+53JyvDMbgMj5YkrFts6E4u+qgw2us:NUuGun3p55VgMj5n/Is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784528053, "uuid": "14f7b44e-f6ab-484c-8bbe-8cd3951c156f", "value": 119636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784528053, "uuid": "af67f4c5-820d-4dae-90c1-1ed684f7d76a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528053, "uuid": "f996e8ab-e8bd-4002-9470-666334044fad", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78d10ee-8433-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1784549388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549388, "uuid": "142453f0-42aa-43b4-aa08-24e92bcc2362", "comment": "Malware payload (Phorpiex)", "value": "b717c08d93438b18dcdbc13952e0ed33", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549388, "uuid": "e2da4ec1-3583-49af-83e3-9192d77a3125", "comment": "Malware payload (Phorpiex)", "value": "29911dea1c2e80d6d21571038afeccad47535e841e03091824a0996e94631117", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549388, "uuid": "0dfc6432-4803-4005-8518-51387ca71315", "comment": "Malware payload (Phorpiex)", "value": "26889175043d6e4b5bb46194467a7530aad54ff5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549388, "uuid": "81b97bd0-79cf-4cdb-9bc2-9104f4c3ec49", "comment": "Malware payload (Phorpiex)", "value": "2f91305148bc82a26cfb19847b756d7e498c1ede25d71961f6da012c6bb95159645604d4dc1bb53a3c892b9b334dde01", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549388, "uuid": "d51910f1-c353-492b-aff2-2870e8167876", "value": "T1DA825C0FB9424726C0E110B49676863BDA78687233C854DFFB944AED0A686D2FC3355F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549388, "uuid": "f6e33921-d9ce-4856-8ef1-e2c0d6ec55b4", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549388, "uuid": "892d5765-1571-4cc3-8709-07318cea2476", "value": "192:gaISCngTBvqQ1jV6lXwIXZ5qh4le6qo/fKUSiu9zw+gj5tBOgbOBqmEdBTFWEo/j:IIqQlV6lOh40uu9JgFtfUqXav8U9cAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784549388, "uuid": "fc02d9ad-33a0-46f2-acac-4a447e54d771", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784549388, "uuid": "f08e5716-508f-4429-9b3c-50223c0e8221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549388, "uuid": "7ebecdc7-f7ef-4971-995a-635dc5985506", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb61c043-8426-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784543838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543838, "uuid": "d85d3519-cc58-475d-b807-310e99c6e911", "comment": "Malware payload", "value": "57817cccfd32939039a2b2756440fa9e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543838, "uuid": "04dd980d-cd1a-4145-ae4d-0634b92867bb", "comment": "Malware payload", "value": "29c4b7c79b4ce38c539388dabcf85ae257981cd735c6a1abcb293c31f14ca392", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543838, "uuid": "d0b8a6d7-54cb-4fa1-877e-266335be7c71", "comment": "Malware payload", "value": "aad2b8f2a48909babf34acb3ad707b795bd91760", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543838, "uuid": "236e8588-66ac-48ef-a785-609d762ba01c", "comment": "Malware payload", "value": "25040dee3cbb05eb2c3d6628f6a068d140c6265d8b98d30141ba42b3b78ca35041f1c4f056210cca696545ae239cff61", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784543838, "uuid": "80d0818f-07cb-441b-9026-bcd477b68555", "value": "T1612733A66C226E83CA6126BB23531342AF310DB33B1187512D79F92D1CBD1F95B5D38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784543838, "uuid": "db39c912-e197-45cc-a762-b16fbcd677c6", "value": "393216:vbcQi4xAQn6SbS3glZQv87up64GCAKUd+Cu3et11Gxat4niY:vjnGQn62pO06JA7dRIeuiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784543838, "uuid": "eaf9509c-7060-48a1-b619-21da958e8b56", "value": 20361216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784543838, "uuid": "8417945e-8a51-44ba-b8e9-04c6e224508f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784543838, "uuid": "88a0bbfe-e747-4e03-b3bc-ddee51998971", "value": "Game_win1.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99d1166-840f-11f1-be1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784533930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533930, "uuid": "86c6647b-1cff-4db5-bc90-894db42f6add", "comment": "Malware payload (Efimer)", "value": "c5f22d73858f05529aa1cd2818bd9e2f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533930, "uuid": "4ea5c116-8def-4857-b9c4-55144fe0fb9d", "comment": "Malware payload (Efimer)", "value": "2bcb3d9f4ac0f874aa3bbe4306027f3695006b5087f2c5ad6d01c321dc4fdd00", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533930, "uuid": "f2c96d52-1e61-4f5f-b5ae-6cc9b7517819", "comment": "Malware payload (Efimer)", "value": "48d67c6148914c0bc853a3c3a87631ae3fd68b32", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533930, "uuid": "48d6e11b-1bea-449b-813f-31e76d48eb9f", "comment": "Malware payload (Efimer)", "value": "065541464e83c3885390fc0d8262f897577fa21a35cbaee59d71f47ac2760986cae616389f52a49e60830af5a4eb025f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533930, "uuid": "3329b03b-8757-415c-b0ae-36590f1820b3", "value": "T104E63358AAD021FEE5739138DEF209A6E0B4B05507B2C5D75B6847E4AE172F24C3EB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533930, "uuid": "d8fe052d-fc10-44e0-9e6c-b6250b144617", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533930, "uuid": "8d703dbe-2865-4f04-9799-a734774db149", "value": "393216:uCI5BcSmXCYxSctWPUWYbXMCHWUjXzcuI3/PGTAI:uCqB9mSYpUwXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533930, "uuid": "88d460c9-4cc6-4b60-81ec-f9a4dd9c4190", "value": 14309932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533930, "uuid": "ae159581-8a76-4624-a2d0-a64724c9af79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533930, "uuid": "102b6782-5470-4374-81ed-435fe04d3bb4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f736e78c-8452-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784562729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562729, "uuid": "32c731c8-54ca-42f3-b984-d8b2015902f9", "comment": "Malware payload (Efimer)", "value": "fe691c82407f7bfaf3ffe07f2186fb28", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562729, "uuid": "c55708c9-ae5e-4ae8-92f8-62108088cad7", "comment": "Malware payload (Efimer)", "value": "2c8bc292d127ec5fb5da2a9c8cbb8e4ec911f6b62437cb5f3a082ac196dc5784", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562729, "uuid": "4f59dd3d-385b-4972-81a4-328c574a8c8e", "comment": "Malware payload (Efimer)", "value": "30b55823efc60e74b0de80cabb8cf22384f738fd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562729, "uuid": "a41f9a30-771b-451a-847e-0f1ba46f380e", "comment": "Malware payload (Efimer)", "value": "268c018d60c47d1f852b00759e94ef76342504a64e57c892978b617069ab21d7444787676db8d3638dafc94d5429fafd", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784562729, "uuid": "dd94c007-afe5-4fcd-bbe7-7ed08b7a0f0b", "value": "T136E633846AD013CFEB73413DEEE24685E998B4E52B71CA4B07A4A3563F232D0C97D617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784562729, "uuid": "8cd35d06-5cb2-44ab-89ec-9284c09f19a8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784562729, "uuid": "45933fda-f343-4b69-8163-60e3f9afc0b9", "value": "393216:fuX9PHzbINtHIhcXMCHWUjXEcuI3/PGTAI:fuBHzOFIhcXMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784562729, "uuid": "7f47d070-1980-48fd-81da-ef1924195bbb", "value": 14325126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784562729, "uuid": "b65b37b4-b088-4ef4-af4a-28df9decfa1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784562729, "uuid": "5066a423-a267-460e-8e0b-bb8e374a24ac", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5901917-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509388, "uuid": "77f3418b-0da6-4d88-bf71-781044958f9f", "comment": "Malware payload (Mirai)", "value": "a51f416d457be70e20e83557b74e8d11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509388, "uuid": "93a384e6-3861-42d3-a41d-cfbdeb4ff651", "comment": "Malware payload (Mirai)", "value": "2ca55a0c2308734109690550078dfe7281e40755fb203d077e3b68f3115f204d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509388, "uuid": "148bceef-6c50-4ccf-8296-dd8106984cad", "comment": "Malware payload (Mirai)", "value": "04419f176c860cdb197be9ced6ec5c188a1b972f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509388, "uuid": "72252a2a-035a-4786-b1af-e8548c5c177e", "comment": "Malware payload (Mirai)", "value": "ae7502044534677a1278b6eead48b097b60d1a33ddae50fabdbf44e94edc2557774781f1276c3d4f4cf7de6becc5f4d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509388, "uuid": "73ab480e-9a15-449d-8743-7426d7f5b82e", "value": "T1C4B2E1B4730A2571D8B0083A7A3C4146768702F5E5EB5B3F2421863DDEAE607EABC7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509388, "uuid": "6a31eee2-6cf0-499a-9f07-d77ecf5096ca", "value": "768:fG4rcUl3p9byh2Uy+2XpOhD4oRCOQs3UozMgV:NrPj3o8kFzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509388, "uuid": "3c62b480-0f61-458a-8f09-3f3c3ad025ae", "value": 25104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509388, "uuid": "a6bffa57-80b4-4171-87ce-2299d8f53cab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509388, "uuid": "a2fb323c-6691-441f-9e92-17818eee717a", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cf20d0-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784534244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534244, "uuid": "c0ec529b-5164-4370-b7b2-cdc294ac8c98", "comment": "Malware payload (RemcosRAT)", "value": "8465b5392ea382ceec662c25ea7acc34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534244, "uuid": "4b1c2290-9e82-4ed9-a715-c3d418b30c71", "comment": "Malware payload (RemcosRAT)", "value": "2d1a5a0c9b43b6dbff32bd3b66d1a96c0d36773f5b7b546fcb9da93580f9246a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534244, "uuid": "49f56f27-a583-4360-835e-95907d451da0", "comment": "Malware payload (RemcosRAT)", "value": "50d5e712edfc416e508aaf221110d6b4a3df93e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534244, "uuid": "e38c96b1-c0a5-4c7b-a439-61f8d9703be7", "comment": "Malware payload (RemcosRAT)", "value": "3bf674bbaceac55e76c9b602e26bf9326d2dae82c65100558003c0aad1c6639d1dd0db1202fa5d71068b8d2594951420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534244, "uuid": "f1e1142e-5bb4-431b-9b52-564db284bf54", "value": "T175552398AB4ACE02D5C317B66920FB3D53B1AC8CA510E717C6FEAEC33C9E7466D08515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534244, "uuid": "18a4ae96-41be-4603-8209-6b6cb04164df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534244, "uuid": "f6ca5dbe-8c1d-47e2-8f31-4f912d47b497", "value": "24576:lCUTC5v+D48Rcm9blKcXnLQlKyZ1jnrZF0kdg19Rzd:lCUTC9+k69BbnL6KyZ1BF0kO9Rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534244, "uuid": "618d863f-bc07-4308-a142-f961c63a15d4", "value": 1282560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534244, "uuid": "9e2f0b0e-d501-4aa4-b948-2a6faef62625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534244, "uuid": "f7d8642a-8bc4-4808-9e08-0cd6b9da8c80", "value": "PO.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f92fc9-846c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784573807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573807, "uuid": "2e5066e2-730e-4d4a-8d7c-8fc4b6e06ab8", "comment": "Malware payload (Mirai)", "value": "b73dc03ba61bb03863b7a2a86e6c813f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573807, "uuid": "79f3c4d2-77ec-4830-8bf7-776c699301e2", "comment": "Malware payload (Mirai)", "value": "2d64a40c919e5de4668a5bed56d6d0f081e11250a53e0b3880318b9166e3684e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573807, "uuid": "76dc7cb9-1a52-4f06-97d3-7e75e516efa5", "comment": "Malware payload (Mirai)", "value": "f705813366596dc7b09bcface177b052567cf6bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573807, "uuid": "431b2676-a01e-4750-978c-438cb307dfd7", "comment": "Malware payload (Mirai)", "value": "9804c59d651031e3f17b382e41d742bec7ab0b2dc1259c0d0cdc8a3e73d0ca7f43311e9b2713ffa7040137cbe3b227e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573807, "uuid": "142122c8-00a9-4bff-b93e-990a4f17666b", "value": "T116E36B59F95BC0F0E6D340F1062BEBAA963B99116233F1B5FF563A61FCB1311248626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573807, "uuid": "c9eb0608-d3e6-44eb-ad45-d0e04fe5ff63", "value": "3072:mMe7NJ8TcP/RQwxybL1ed4kmNnZawDw5oRWIw4QXh+:Te7NJ8TcPZQyyvOm53+oRK4+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784573807, "uuid": "bd23c28b-ede8-4234-b1b9-60de0dd99297", "value": 148860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784573807, "uuid": "e2a067d2-513b-4264-82b7-6adfc89aa695", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573807, "uuid": "9393501e-a81b-45c9-940a-64b84970b451", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa03c93-8472-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784576452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576452, "uuid": "ec0e76c1-7f30-41b5-a1b5-f760636bc86d", "comment": "Malware payload (Mirai)", "value": "48b67fb47a5245406898fd2cbe83e9b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576452, "uuid": "3a01fa26-66c1-4ede-b817-d8d51d7e6d59", "comment": "Malware payload (Mirai)", "value": "2e086924a7835d4679749992f6b684ccf2fa5ab7f33fa69201b22ccf1f98571c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576452, "uuid": "aa903b5b-add5-4d09-8d36-046112cf1e09", "comment": "Malware payload (Mirai)", "value": "d14830aa6f1ee3419d170f2054dfba493d141e77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576452, "uuid": "827a4246-1c70-4369-801d-2bca6d8cc984", "comment": "Malware payload (Mirai)", "value": "4a12752b00865030c6dbf67a7d12265707fa9d255cb9ea3fd15f8d2b3d9ba7b82489bdcdb029f18871da3f7e50ccb329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576452, "uuid": "325afeb1-a18f-48eb-9745-6ef70e4254ce", "value": "T163D3C609BB611FFBD8AFCC3706F91705288D595722A97B3AB530D818F64B24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576452, "uuid": "29709a60-a563-4170-b3fd-df0e759d178f", "value": "3072:fYlmEdw0bmz0JpUDESDCE83UjiMXpHyMRvs3B:fYUEdw0bmz0JpCE6CEwUjXXpHy93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784576452, "uuid": "b641922b-9f85-4d4b-9e80-5ed19b2a7b67", "value": 142340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784576452, "uuid": "8e206660-dc21-4c3a-95e1-75e7ef215af2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576452, "uuid": "79a46132-12dc-4c5a-8551-f2dc1720c19e", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef035e1-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784530369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530369, "uuid": "141217e5-d8de-4cb3-862e-52e3d2ace6c2", "comment": "Malware payload (RemcosRAT)", "value": "7e824a137ffb28c90f5cc45761a3152c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530369, "uuid": "fe531893-a010-4020-a2f7-4e5a3ff49d7a", "comment": "Malware payload (RemcosRAT)", "value": "2ef0cd51e4737c2ff0deceff37d92a3d98ffaf47ac232b1e0292cc3d283fb13e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530369, "uuid": "f06427ec-7315-4c33-9cf5-9d0a6eb75318", "comment": "Malware payload (RemcosRAT)", "value": "bb6cf1a8a3b1821d9de6759cd43bda0bcd2e12c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530369, "uuid": "7119bb72-6c97-4edd-86b7-df4bc38b4cb0", "comment": "Malware payload (RemcosRAT)", "value": "c47a215849ec1ceeb9a30a38a4e4b3706ca02afdcb5ebe6d4c275e18957b8cfe06b0da581e9385178ff38f6a678b276f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530369, "uuid": "c5ffc182-fccf-4b56-9922-4cd2550e4145", "value": "T1B6859E4EB2CFFED5329B7FD9B60C870DAC10C13A24A332567A8A66E19DC1561F521D32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530369, "uuid": "69c0d2df-ef1c-4ca2-82fd-759e147bdf8a", "value": "192:uresytViMaWp5f1v1Yr11zEH7QBhS2PImRhdAePq+x82YKFm8BjbbPW:+y6MZr7H7sjI8ShKFhvbPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530369, "uuid": "ec4d417a-204e-46aa-956a-b6f97622dab6", "value": 1742152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530369, "uuid": "fec95bc7-ffb7-4ed5-8844-060dfa4a7e77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530369, "uuid": "d74e5c94-f594-4649-afcf-04fe66afcd2e", "value": "FedEx_873238334071.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4036866-840a-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784531773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531773, "uuid": "73aebe73-7929-4f9d-bac1-4118bb423dd2", "comment": "Malware payload (AgentTesla)", "value": "64722d099993abdb6ab8ed7a233e8501", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531773, "uuid": "1285ad32-6c14-41a9-95a5-e9599f67c23f", "comment": "Malware payload (AgentTesla)", "value": "2f629fe23ca77f503da68de0825c9b8a957f795b0f0cd16eec5acbb555520109", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531773, "uuid": "c748ad68-9558-4429-bc58-26f9931052fd", "comment": "Malware payload (AgentTesla)", "value": "d5a8e722bf2e1b21844d2836ac4741b3cfba0924", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531773, "uuid": "5727048e-36c5-49ab-beff-53ce29325651", "comment": "Malware payload (AgentTesla)", "value": "314c2b5c1e157e511e9d6406c1d3b7bcb5e49bd9229791c6ab8003ce53ea545f18a5fe3542b3d6756c2cec71d110e35a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531773, "uuid": "516e7800-2cb5-4c86-95b9-3084106edade", "value": "T176C3424466C1E89843D79B7F3A1BB1D6F56A0ECDE544480EE294F8D0E0B4607FAE5AF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531773, "uuid": "ddb4a0c2-414e-4a23-bce0-0805cf39d514", "value": "1536:9cjU+xu8+nI+zmqtIQs6BD7/ieUmcTCvzz8n3brH177o+j9hwtIaZC:SjUyBq+QbBv/SmcTl3bB77zxkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531773, "uuid": "f1416298-7136-492f-9188-f0bc6f0158a2", "value": 118389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531773, "uuid": "773194b3-f55a-4b84-b0e8-cd16d315f83a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531773, "uuid": "9be84382-ff59-4918-8e7c-33ef3dd4971f", "value": "Payment-Swift-TTref17072638.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c2ad11-83d2-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784507692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507692, "uuid": "2bfce491-dab6-46a0-b864-e7e933485986", "comment": "Malware payload", "value": "e23c91606d1f4a7922c389e5eea5e6a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507692, "uuid": "9e2981ac-215f-4bfb-b890-332fccad0d9f", "comment": "Malware payload", "value": "310181ccdbc4129d5a8052af9101013df6e8e2871c6c42b6e86ef5a7f162caa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507692, "uuid": "91e38a0a-684c-4817-af1c-5281b5096411", "comment": "Malware payload", "value": "8e7eba648538c931df72df5efe7787fe4960b90a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507692, "uuid": "e69b646f-79ba-4ddb-87a7-cd1e1c499547", "comment": "Malware payload", "value": "2dbed6cfc6c0f9e49f22d3c29fd639ed8425fe23a93ec8684fb7c3ceac0562870c2a6e41c86ff48742a05167c45bdf6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507692, "uuid": "a725fad0-7816-40b3-bbc6-1c8ac9614e34", "value": "T1F5B312B936509C75C77F3B3648BD2E55E60310299E34B2128B099FFB70C472A6D84EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507692, "uuid": "d14d484f-9af1-4eef-b112-a7b64fc0e82a", "value": "1536:wesFVmGAl2CE0vGBUxcnUrG93W7n580g4uOr3LVzMCFGFv82O+kI55sWZW6SnCJB:0T//BUxcnUk8n58NM6CkEcKCuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784507692, "uuid": "ddbadcf5-1f78-4cd8-8c2c-2c67f0ba18fd", "value": 112616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784507692, "uuid": "9304c875-ba7e-4fa5-bffc-02b081068f4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507692, "uuid": "00c18b53-c55a-4f93-b69f-2fb4e7151f15", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c00881-83cf-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784506142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506142, "uuid": "b6ebb572-50d2-4ce6-a6b1-cdce8728fc94", "comment": "Malware payload (Mirai)", "value": "0939e435cb0dc86c29b2b5b2278c5ba1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506142, "uuid": "46afb043-e819-46d5-856a-60b67adb01a4", "comment": "Malware payload (Mirai)", "value": "310c6c65766a41fda319acbc604fd200741c31d6151341e49e3d84f076860005", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506142, "uuid": "f315f439-1600-4ef8-a6ff-ca8d809f3f8b", "comment": "Malware payload (Mirai)", "value": "c95126a0f886abdd5b620743356c2aa75bf5b639", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506142, "uuid": "7fb73d0b-092b-425c-ac5f-34b65083de7d", "comment": "Malware payload (Mirai)", "value": "a15dbaefbaba9e23793c1983c08a58720a41de38d84ffe80857b11c45ffbf3d318018926884efdcfbf2f6bd5fa582f93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506142, "uuid": "fa194acf-3ee9-4e81-aff0-476cbbff7286", "value": "T13DC312D092891506D2D47173BF3946E2336998BD84F7E1237E01BF25B5C2A1206DA7F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506142, "uuid": "955b4368-d4c4-4299-a875-7432cd5e082a", "value": "3072:7KK0Ojvju1uMfbLN6ottthd7oMkZbQI7e3OCMyT6gdk9p:7AwMzLNtnhd7oM60I7e6yTdk9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784506142, "uuid": "48165858-cb33-4c2d-b666-ccf4a0aa9081", "value": 121316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784506142, "uuid": "afb69b01-24a8-4f6b-b404-2e7a180fd223", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506142, "uuid": "f02bea2b-eb68-4ab3-89f5-5957c7615b7e", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1937f44-8412-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784535098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535098, "uuid": "9ba22c8c-cfe3-4a0e-8555-f7b4be8038d8", "comment": "Malware payload", "value": "d615566de206bdb5038305c013d79b99", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535098, "uuid": "d91676e2-24ec-4af0-8d44-5e216cf6c617", "comment": "Malware payload", "value": "31f8528292ee5523af30bd4de7a8554a8f055e5b3801a1435446d3d932ecefa7", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535098, "uuid": "804f4710-9b9f-4826-9a67-cb714f441e25", "comment": "Malware payload", "value": "b5ec296991942ce5c7d527e4e709d1fe65dca837", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535098, "uuid": "ba0c0ef3-f732-4700-ab2d-5770625634c4", "comment": "Malware payload", "value": "fd01594fda22e67a5d4798123758bb91c081f345cd40a3b2742baaef56a06c4907fc5d6b36973a079e0b44adbccd7e50", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535098, "uuid": "5729c188-42f6-4723-bf45-7df7b11edcef", "value": "T1DBD60133A1ED21FBE06A4739457792154E367F316C138D1E96F438E8DB35FA0293AA06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535098, "uuid": "3345e91a-851a-4e98-82f3-a8b6ddaf41e3", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535098, "uuid": "66617c4e-6f32-4943-8348-9ba3ca6d5397", "value": "196608:VXzqrzAJckwr6F+Y9XJj8k6+BZC9sRVxN0md:VjOzMcmFVT9n68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784535098, "uuid": "8481477e-0ad2-4a44-bc1f-aafffc212a8d", "value": 13849886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784535098, "uuid": "78a56d31-197c-4069-96e9-48195234bfdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535098, "uuid": "78bd1833-6005-437a-9801-f7bdb98e302b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f206e75-8414-11f1-be1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784535711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535711, "uuid": "5d321742-42bc-44b9-bf99-5284ea27461f", "comment": "Malware payload (PhantomStealer)", "value": "e14ec518b3e9768fd51d95f13c60dea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535711, "uuid": "934cc786-07dc-470e-991a-35e61151f77b", "comment": "Malware payload (PhantomStealer)", "value": "330f79845eb9694405707e1b2ef8621e8673920b3da8ccb3a4136418b7404254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535711, "uuid": "df004cd8-fd7d-49c4-9f6d-0c3351641979", "comment": "Malware payload (PhantomStealer)", "value": "e162d5f789a9cba57f46da154fabdde31a72683b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535711, "uuid": "0515f030-a8be-4fc8-a4ad-456740840688", "comment": "Malware payload (PhantomStealer)", "value": "6249f61891b24dc89d40fb7f8c65378017eed8f54e58029b113f32bd39d81a64a53d251b6b10e5db1cbb50844c634953", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535711, "uuid": "9c6bec39-db4b-42df-a642-864e67b4db44", "value": "T13D06BF06E7C409D5E46AD630CA6B8732DAF1B85E5B31C38F1554C72A1D33AB18F6B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535711, "uuid": "51a407d1-f823-47ac-8911-fade3baf325b", "value": "f469ac0906218570f79c54d1b58dc057", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535711, "uuid": "ddd6de74-60e5-4bc1-aef3-dc2b44d77f8f", "value": "49152:x127U7PMTPufTH2E3wrt6jZOiEVJJZ3vEiD4XTXxLcgF6UlFB+ZHAhn0WiGjho1H:GScDqX5F8Zgh0VGEDIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784535711, "uuid": "7b3d60bf-dfe0-4083-be9e-3c8f92b54f3e", "value": 3922432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784535711, "uuid": "a2e7a481-7e18-429c-8514-092f3a196800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535711, "uuid": "08888f77-8ecd-4daf-9b76-b48889834d2b", "value": "Indent No. MI26 196pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f035d2ec-83db-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784511607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511607, "uuid": "b2de2274-3a73-494f-9b64-1de69bc5c466", "comment": "Malware payload (Mirai)", "value": "802e8368a506edcd3a33cb34fcaa6669", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511607, "uuid": "ca39342e-f90e-4a28-b6fb-3d255749219e", "comment": "Malware payload (Mirai)", "value": "338b19ba5a4d15cca22d48c02c298064164d9db9654e7473880d12211f3cd185", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511607, "uuid": "56ea5422-0d74-4dcf-bbdd-00c3bc3ef861", "comment": "Malware payload (Mirai)", "value": "d7985db46d4d569df9252f0fef74820f7d9276d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511607, "uuid": "29f2aaf7-4f18-46af-9523-1f82cea235d6", "comment": "Malware payload (Mirai)", "value": "3316ef8ed3a1eb6b473c60ed90aa78262278b735b725fb330398f729231da44e0dc3dcf9d3d1ecd116790894ef588977", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511607, "uuid": "e1971ff7-946f-4970-bdb7-5e6ae3718364", "value": "T195B36C22B879192BC9E4643611F35376F1F6438B20A88B1E7D710E8DBF246D036977B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511607, "uuid": "dec59e22-fec1-4ee2-89f5-c2fb32b698f0", "value": "1536:k2vLmFZ6+KHRCXkbeE9GK14elk/GxwKh0KB4tIgo95VOBPEFgCtyPn1:7NIK9l+Pr5ugoPYBPn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784511607, "uuid": "d4868a6b-c6c2-4f04-97ca-a93f0fa36cf9", "value": 113284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784511607, "uuid": "8fe7fcfe-0faf-48ff-9b03-e03ce9313af0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511607, "uuid": "afeb1f5e-c84a-45bb-a6ea-c2260d810cb0", "value": "ohshit.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba4bd3e-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574601, "uuid": "60ecaf73-df6d-4c95-878e-51ebc6ff416c", "comment": "Malware payload (Mirai)", "value": "3018ea97747ea4dbb9c8dec2b025788e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574601, "uuid": "3f5c43f0-d9ea-4cdd-9364-7de7d574218d", "comment": "Malware payload (Mirai)", "value": "3415243d11351b8d298fb5bb31e0143208e2de5163f4d0f7baa24bfae61c02e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574601, "uuid": "f6f3d709-3b1b-41cb-9535-90ec34aeaec8", "comment": "Malware payload (Mirai)", "value": "9d73044dc6183ffe6617cf887dac1ae9a7d32a9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574601, "uuid": "5c996c96-65c4-48f5-b0c1-3d640132a65c", "comment": "Malware payload (Mirai)", "value": "b1158260d80457544c96faec7bc08384a9f2fa2fe4e00bcd1fb66cc6fc6a787f91c4fd1b6ff704971d73d4cf131387d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574601, "uuid": "a3cc52e3-10bd-4300-9563-dee08210571f", "value": "T1ED8312978FAF9BCAE44986F01FC84E9B3597A8622E38158107BF4D371DA9C14E13846C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574601, "uuid": "b1fac563-772e-4de0-bfb3-60bdbc34bc25", "value": "1536:Hqu+54vTtJaJKxgh9AIRqJzJBDFX2x+zY8WNY4VMFsiRmA7cSYeQR:Hs54vn+KxS9AlzJBsNfqlmecSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574601, "uuid": "34626692-4568-4a13-8ec1-d408af8cddeb", "value": 86328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574601, "uuid": "6e261d99-7226-4796-b295-5612547c562c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574601, "uuid": "1450acfe-64d0-4653-8baf-bc354ec97f43", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba4386e-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784530444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530444, "uuid": "924711ec-4363-4beb-9ac5-37ded79bb918", "comment": "Malware payload (AgentTesla)", "value": "514e6a12f9f2f33235e1213773a9a3bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530444, "uuid": "043ba258-ab21-4153-8ee1-4ab2a32d9e68", "comment": "Malware payload (AgentTesla)", "value": "341c6f83ffbe109aa8de4efcdcc19acc1081e70a2415e78ee464a177333a83c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530444, "uuid": "4596eef1-6bb4-4ef7-a779-e6695c60f4eb", "comment": "Malware payload (AgentTesla)", "value": "03ccdbb5303c896bd66673c309dc15361fee9fcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530444, "uuid": "7f329c33-8e40-4198-8f4a-c7dff494f5d3", "comment": "Malware payload (AgentTesla)", "value": "220c03c199a41c1061830daa17797fc3d05ebb524d0cebc0c447e70440b469518faf1237fb83ccedac975f0937ec47e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530444, "uuid": "0283aa4b-4492-4805-a791-8bd0af541753", "value": "T10C06E8515AF4A1933321D7ED636DFEB8E00F4903681A8A54758EDA38681EE49F3D03E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530444, "uuid": "55006ca9-3a95-43ac-9502-9d3435d40804", "value": "98304:HUvJUyPlIGgUfX5qk0CGjU3hGPZNv8wOUBOHwIcqCcw5fSbHnH1qJjZWx+DKy97u:HUvJUyPlIGgUfX5qk0CGjU3hGPZNv8wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530444, "uuid": "bd0717aa-1052-486f-a915-db815180df60", "value": 3712221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530444, "uuid": "ca2c2268-242d-458d-af31-366e7385c04c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530444, "uuid": "d0ba8a95-aff5-475a-a23a-a9148d09e5dc", "value": "Scan0011.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ba72e6-840a-11f1-be1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784531454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531454, "uuid": "b5f4b3a2-7f02-4123-9e62-c7c906cd2b7d", "comment": "Malware payload (XWorm)", "value": "c9c5b780c2162e732b0e69b9164b49cd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531454, "uuid": "e79cef48-e4d3-43cb-9fa7-14f08840db26", "comment": "Malware payload (XWorm)", "value": "3491d7703b8b7932df9e33bddc446c3037ecfd288557320d3f23934c78370094", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531454, "uuid": "02aea8ed-4ae5-4d84-9287-64e49eb2b1be", "comment": "Malware payload (XWorm)", "value": "6e986afe29bb02769f99225a4b6ccee7c685dc22", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531454, "uuid": "66fbff23-ad55-4bf6-ba22-5355efc873da", "comment": "Malware payload (XWorm)", "value": "249666ba956e0e4c75f86727d383d0d92d1b20475ec88bb93e3a97e820fc43b2954be81bb4cf9c5feb2fbc8e8cc0f778", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531454, "uuid": "4d7f3f34-9ac2-45f9-9334-8283eaf29268", "value": "T1712555F53B4D048AE7D69822EC6AE90A5DEC2CF55DAD12C22BCFD0CA9035191FE746C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531454, "uuid": "b64bfa38-3edb-42fb-8a49-c593a48115c0", "value": "192:Yeq4oBdW2Vx1rD6cpBvXH1HcyRuStwfGEtNz+CG2/I0pE8:p+1rD7PXH1HcyRXtwfbrzvM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531454, "uuid": "821880fc-2895-4509-bbb6-301af9c19abf", "value": 1044469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531454, "uuid": "065963ba-3bcd-4f38-8dcc-5ff8802dad2c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531454, "uuid": "9e9d16a3-a34c-4f04-ba48-495a28f0de6f", "value": "Cotizaci\u00f3n.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cf6807-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784531236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531236, "uuid": "db10c9b3-3458-4c6c-998b-8f06def2f32c", "comment": "Malware payload (RemcosRAT)", "value": "93c966ce42b94fd4c2190a5d959a4858", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531236, "uuid": "c93589a1-ff44-4f8a-848a-596dfb8650a2", "comment": "Malware payload (RemcosRAT)", "value": "3525a7cbd7cb16e3f5763a10a0e35a51cf237f88dc8633ccad0c881378610363", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531236, "uuid": "f9489c39-a898-4354-b57c-dfc41ffa0104", "comment": "Malware payload (RemcosRAT)", "value": "51d696460495f11276d7148a1872bab304080c40", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531236, "uuid": "d94dc73f-07ef-4f08-a974-ed2bb3a29ade", "comment": "Malware payload (RemcosRAT)", "value": "ee68915c6492203ee34535d89a87db13f8088385388886a89c73b51ce169a7df5554f9c86562a548613c8bfd9cb139ca", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531236, "uuid": "ef863b12-7d84-4782-9111-4f00ffcc8455", "value": "T12D941D38ADFE402AB173EF558BD47497EA1FBA63371E98191092034A4713942EDD273E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531236, "uuid": "17ff79f8-eb77-4fef-9b74-49f71e2b64ab", "value": "12288:bti6XVJJB/KoC2iOXDpwoNEXgFINImr+AgrfKVTqBYDEPr:ZC2TjNEd/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531236, "uuid": "48467666-06bc-424f-9ac5-2ab2af286ea9", "value": 446912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531236, "uuid": "2e0ca5ce-1574-4e5e-b7ec-81431f3f6d30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531236, "uuid": "8294c54a-0143-4071-9ff2-285968f3c06f", "value": "Havale Dekontu 29,480,25 Euro Referans no. TT 810-363295460.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39b3b17-8437-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784551073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551073, "uuid": "ba58d347-3989-4ccf-88aa-e7b51685bd1a", "comment": "Malware payload (RemcosRAT)", "value": "4713cea293132831a83cdb6ecf9d7637", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551073, "uuid": "97eb0f62-1d4e-4afd-94e2-ad12f1e08fc2", "comment": "Malware payload (RemcosRAT)", "value": "356106324c797ba967a2a8cde2156e866fe008332046747866efa82a99e62083", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551073, "uuid": "924b0c22-18db-412b-a8ff-18de4279a508", "comment": "Malware payload (RemcosRAT)", "value": "7e6fc1213ce2ca016d2d577d09a0c91d9f47a533", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551073, "uuid": "c7a9807a-6aa9-4645-83b6-e4c13c82fca9", "comment": "Malware payload (RemcosRAT)", "value": "9d94fb6f8bdca1f70d00616a7b0dbec15ecec746de93e862081a462f5a7629a66d2ab3e6f36cc0cf5bc9e76b66c433f2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551073, "uuid": "aedee0a1-d483-44be-b9f5-b15d1a3e18bd", "value": "T1DE2551149CCF243AEA6D214B198DFD00649A2F01CDFFBC7B66B02E1246526F46DD26DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551073, "uuid": "bfd3350f-8bcd-4544-839c-14a96fc72007", "value": "384:Sa5xWnGmS7P5BmxnJeHc6/wpGxOhSFppQV8+Vw:So", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784551073, "uuid": "388f3d28-24d1-4f64-ad2b-67194c7e4eaf", "value": 1026950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784551073, "uuid": "b3796f8d-3fde-4e68-b151-220c8a34f2f9", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551073, "uuid": "3845e908-18b1-46a1-9e6a-5ad951b806b4", "value": "inquiry (API-07-26).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79948fcc-8443-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784556076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784556076, "uuid": "064b45f0-42a6-422f-b01c-94a4990ed58f", "comment": "Malware payload", "value": "43b0bd2b35e3e235c1cb0f585b2a8411", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784556076, "uuid": "ebc17394-c39a-413d-87e5-3817b3f603ce", "comment": "Malware payload", "value": "366000d889c91ca66b3c0f55b6b2f5670a610c764ea516cf31f2aafad67f4171", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784556076, "uuid": "36ede825-0c17-45db-a578-2c7c9c38a60d", "comment": "Malware payload", "value": "a0b6b3eb10a455ee9d03b60150ec4a931b34f170", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784556076, "uuid": "762c20db-df62-4347-b479-f91545e0acdd", "comment": "Malware payload", "value": "06384d7fdd2676fd113248a14c55b1f152c0d36c2e547739574553ddfe55937e0a1add7b3874ec1b3be1d5c195b46368", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784556076, "uuid": "83beb49b-c567-4b2a-b0d2-7f13ee775d05", "value": "T1C2236C651A857C14AE99C4371D7E2F0CB9AD43E6320452EE7FCB3CF28C8AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784556076, "uuid": "e90bffe5-811f-48b9-bc44-c1f2ea087580", "value": "768:fVEJVIhtMp9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:9EJ2Micr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784556076, "uuid": "326047d3-1b19-4be8-844f-3f6fd6bd4da9", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784556076, "uuid": "80686c0f-a251-47f7-844e-de5520dedfa7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784556076, "uuid": "9f378ab8-e7fe-4eb6-b41a-9f7c0806a2ef", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a49ac6-840a-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784531643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531643, "uuid": "c7e245c9-5e2c-48d5-ad02-ee3f641d514a", "comment": "Malware payload (RemcosRAT)", "value": "2f75d1d34f4100bc62b4e78bd92efd19", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531643, "uuid": "a726499c-42e2-4902-b80b-1fcaf785630b", "comment": "Malware payload (RemcosRAT)", "value": "3679b32946aa28717b152457a56b2c7f101daf672b94794689b7874241026a81", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531643, "uuid": "bc960bda-e2ca-4eee-aee1-c6c1698d918c", "comment": "Malware payload (RemcosRAT)", "value": "8590ce2c15b07c78eaec2b3be7210836faa0af0e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531643, "uuid": "9c178398-b056-4b2d-9eba-68bc1b97aa6c", "comment": "Malware payload (RemcosRAT)", "value": "54ffcd75331fdda771136ea9769dd385ea561952aef133e62cc8be9169ee150b6bbb40b03395b45299b02352146a71fd", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531643, "uuid": "b5411941-f9ab-47fc-9445-a4e31fba6c77", "value": "T18E133B23EED0093B0987479EEA780B6689F8C52541327DFCF9EC771E900364C9B7A659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531643, "uuid": "f4612bd9-4817-47f8-a14b-53e3c89a71b7", "value": "768:xQBlIJjVBpM5gpRqrFMK91vQky+vyOslF/Ysu3knN7GtPURUbFRBf4NoxmHFM374:xQBlyrS60Ogk6cSx9mGAeVrE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531643, "uuid": "37c2b055-60be-40df-a293-15f05533bd9e", "value": 44452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531643, "uuid": "3b483a3e-d5f5-40c6-9389-7bfc01b7414d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531643, "uuid": "2ff8398c-34c6-4aef-a1e3-c06162dd8d7e", "value": "HSBC-597026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4297444a-83d9-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784510457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510457, "uuid": "32c43677-fd02-44f6-aa01-e4b6a4306ce7", "comment": "Malware payload (Mirai)", "value": "6b54011777c19da0cf0a7ce339509f41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510457, "uuid": "89edfe4d-0b8b-4dc7-b1c3-5e5ddb0e8013", "comment": "Malware payload (Mirai)", "value": "388a9e43f9baec112abc28f1e058072e5ee847b0331388896f71517b832aff0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510457, "uuid": "e74a69cb-0405-492f-98e7-c6a00cc5f257", "comment": "Malware payload (Mirai)", "value": "17adac1dfb4f70e5a5c735f4285825dc77fbd6d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510457, "uuid": "4d4d7ebe-29e9-4611-a21c-db19991f5042", "comment": "Malware payload (Mirai)", "value": "ffdfa27a13e4fb65a3b0c46f69f2823f2f94d6cc9d1e50e91bc46e919f38271a3fa71ffe9b41ca864a401851d1067865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510457, "uuid": "ed0fba40-fe00-4bc3-9666-899752ab9346", "value": "T191834B02B3480D43D1671DF02A3F37E5D3AFD59121F4BA89664E9B4A41B6EF2254AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510457, "uuid": "5ffaa5a0-638f-43c1-842a-942989e47f90", "value": "1536:P1UIP6P3LziR4NNcpoO9cFr+QmqOYq39Eb0O:P1U3c441cFHmHU0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784510457, "uuid": "5b384f74-5e64-4aed-844f-490698065c20", "value": 87728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784510457, "uuid": "2cbb0c01-f6ef-4519-8f82-c81ba78fb82e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510457, "uuid": "9b18e991-0b7d-4532-bfca-0d254e5564d0", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae5f136-845b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784566332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784566332, "uuid": "0d8985f7-ea90-4ffa-84da-ed257973fdc4", "comment": "Malware payload", "value": "e5d1adc01b9b1ca525909358a97bfa3a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784566332, "uuid": "357459c5-ab77-4168-969f-5013dccf7c20", "comment": "Malware payload", "value": "39ec954d66b2484f72787a62cc472fc1c8cf95042c2dae1e045f972731ee51e2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784566332, "uuid": "5ea78c81-b737-411a-a76d-055066b156c9", "comment": "Malware payload", "value": "2bc6800a208b92cd5629f0f64505871b33f62f2d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784566332, "uuid": "7e36cdd1-2349-4441-9c53-1ea330b34dfe", "comment": "Malware payload", "value": "1e1e3c1fe1dc5b2b269a0bc36148cd465fdb1edd112f6f8b74a8a757cb96cd20945067fb970fe36bb554f160a3a5e961", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784566332, "uuid": "af5172ad-ae46-4d96-b783-10f3880004ac", "value": "T1E1E63358BAD052FEC573513DDEE241A5D9ACB83317B2C49F1B8882A5BE131E44E3DA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784566332, "uuid": "dd71d918-dee7-4c7c-9f97-cef06d902476", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784566332, "uuid": "ebe044b9-ad25-4974-895d-a52f802c2ae3", "value": "393216:5gZeGLJxrKEvTb+DRRXMCHWUjXecuI3/PGTAI:5gzjrKyTbQRXMb8XTH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784566332, "uuid": "c5fa0446-e65c-44fa-b794-3eab6c01894d", "value": 14305279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784566332, "uuid": "f631c1b6-51ee-45da-b5d4-9051e1efdcdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784566332, "uuid": "74e00d07-cc7c-4ebd-8f28-f9fa90c4d3cd", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ab37f5-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574590, "uuid": "906cb431-e8e0-4b67-9114-23aaf400c9b1", "comment": "Malware payload (Mirai)", "value": "ce749eec1745b682390377d5224f43c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574590, "uuid": "dda1f060-dcda-4d3f-9fd7-2e880ebec508", "comment": "Malware payload (Mirai)", "value": "3a05329692c88c6e0fb3b8de9e8e07d601ba16d2582cb49d732256ab30ed230b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574590, "uuid": "88e433d3-0dc4-4692-b625-a883fc7be1cf", "comment": "Malware payload (Mirai)", "value": "a875c45f944593d409faedf026ec781499b17be0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574590, "uuid": "dbff3058-efa5-40a2-bad2-c4d2761bd626", "comment": "Malware payload (Mirai)", "value": "5ba1c94ca3d7f74f568c92c839248a071b91b266acfe4d9b0aeaa99e536d7474e4b5be7582e9883674ee840f57d4ef8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574590, "uuid": "979a686b-07a1-4f22-906e-641bcb1055e0", "value": "T17473F685B942DA17C3C117BBFA5F028D3715BBD8E2DE3213DC256F9433CA99A0C1A256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574590, "uuid": "9d9519dc-b955-4325-ae9b-c662ea28778b", "value": "1536:pcWVLEPgEDM7Ut5EN1FtbgD5cvSEy6vG0QcJIUimy:pcWVAPgEDM7OE3vwEXvG03JIey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574590, "uuid": "1c4e439b-039f-46e6-a45d-d633cbf161fc", "value": 76612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574590, "uuid": "037fd8df-35c5-43b5-9d71-0df01b9bcce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574590, "uuid": "e6c58e26-9055-4086-8bed-7703905ebb5f", "value": "nullnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289547ba-8465-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784570543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784570543, "uuid": "0a4e02a0-75ca-4d29-b03c-febebe3760be", "comment": "Malware payload (Mirai)", "value": "999ea3a155d92da8f33b3841ed60ff20", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784570543, "uuid": "95a5cc77-a0bb-4ae3-8b91-cfa41bbbb218", "comment": "Malware payload (Mirai)", "value": "3aa1c4520ba133e1ed4c4da2a6001e24a49eb0a77d5596b38db4f2d5c5aa00b6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784570543, "uuid": "00179137-c750-4d31-bd93-f8185c249915", "comment": "Malware payload (Mirai)", "value": "8225874ca5ab28d666f17d2ecc836af6dfc15680", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784570543, "uuid": "f0e6d3ec-1783-483d-8937-317e646be6a8", "comment": "Malware payload (Mirai)", "value": "46fe0b3c5d344d305c5c302f5d983b545000897e49000d39e6eacd842be5fa456db3a9f7aede8d259c9353434af8c832", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784570543, "uuid": "bbd943d5-c669-4b66-9e7e-e5f7919855fc", "value": "T18A314184053489DEDD47CE88F7A681D0DE091697FDC37A1EE98A095AE418A78F4DFAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784570543, "uuid": "a99fe372-3614-471e-b2dc-239f63f8a1ab", "value": "48:kUFzMG6qLteAxTaxbO1nhgXkcwoMdJTBkq:zFzMGTLteAxTaxbO1nhgXkcwoMdJTBkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784570543, "uuid": "5074d409-b360-4f8c-8d54-1b56a1e1b651", "value": 1638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784570543, "uuid": "b85be132-ebb6-4062-956d-35ac21254dba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784570543, "uuid": "8b501d37-46a6-48dd-8e48-77a8d22d3d01", "value": "callaputa.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c15a80-83dd-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784512120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512120, "uuid": "df63911a-e122-49d6-b823-c047e80048a7", "comment": "Malware payload (Mirai)", "value": "6ec9908086bfe5344e03908ddc7a27a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512120, "uuid": "edf81141-d7af-40d0-931f-4774cf006bb1", "comment": "Malware payload (Mirai)", "value": "3bc7efeed4bbebc6a515be55736e6726dd3873553b00e70af513f8ab05761422", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512120, "uuid": "4edd2986-bc1f-4e19-ab81-1e3d68825b90", "comment": "Malware payload (Mirai)", "value": "fd3493cc67e88d67ca01bf22d1b1c283e3f654fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512120, "uuid": "b1ebdd18-1a3f-4fad-8dba-726a4ff3c823", "comment": "Malware payload (Mirai)", "value": "dea9c70b6765d1562787f1e6f904be7d148e32bad48ffe595bdf797979aa805d3c8ab6f8d5d1f9d313523b1800405204", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512120, "uuid": "ae9a782b-4d29-4d5f-8deb-d39b2d41d8ee", "value": "T103B34C45FD819662C6C7177AFB5E628D332363A4D3DA32039E285F21338B59B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512120, "uuid": "d28af805-7c91-4818-8ead-8f347a407917", "value": "3072:Q3YMO1a6Tmt1OE7UpJHuW4vwCdQEkfykjYFld8B:Q3RO1a6TmLOE7CduW4vZdQEkf7jgld8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784512120, "uuid": "3dcb9264-f548-409c-b838-a8f0288a307b", "value": 112104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784512120, "uuid": "bfc3b47f-f43b-423c-9d08-faf065667f3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512120, "uuid": "541badad-149f-44a7-a2f9-8b30f4b7c389", "value": "ohshit.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cb11a7-8428-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1784544384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544384, "uuid": "865e0d52-9d9a-4441-9e01-1ef10db41865", "comment": "Malware payload (SnakeKeylogger)", "value": "34066e13ff5ec6a58f1ddcf34dc9e141", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544384, "uuid": "c01bf98f-a10e-4658-b33c-2bac1ea29f19", "comment": "Malware payload (SnakeKeylogger)", "value": "3c0e37848febb8c1ebb97ae21652d15ba3ef6be1143aff84884b8bf22bd5de87", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544384, "uuid": "7f50bdaf-6fbb-4ca9-ab01-ca5590c477ce", "comment": "Malware payload (SnakeKeylogger)", "value": "6431218f819bfc465f218e4233b2300c14840094", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544384, "uuid": "8cd279d8-1bfd-411a-9df8-f858627d810d", "comment": "Malware payload (SnakeKeylogger)", "value": "8828a173820eacaff58adb636705ab5b494a75004465dc2c691571d9dc6402b77d9c87ed1f6d617f5021405a49070bc0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544384, "uuid": "7677b7ac-71e2-4689-a7f6-efc4f77a3086", "value": "T116337A6DE5B87992A3762A952C0A9CBCC4C9A76197D1301974EFDC408FF11231A23EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544384, "uuid": "d4da2477-b05a-4617-9d24-96fc7dd1c992", "value": "96:X2MhdZVD0rjmvi2c7mJxYiohH6cx1Bxlnny0nX/kd0QJ4nCPR:5nLYjSUAQnnjn8dN4ngR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784544384, "uuid": "afb1097c-ca5e-4829-958f-9ece8c67586d", "value": 50857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784544384, "uuid": "06730f5a-4459-4fae-a14c-31f3e31bdd4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544384, "uuid": "b8d164c2-41b7-488b-b32c-f98a296bef08", "value": "Proforma Invoice # 4504124576.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89655a3c-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784533339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533339, "uuid": "693d9cf7-9652-4a30-b0f2-bb29720d251a", "comment": "Malware payload (Vidar)", "value": "84b7baaa2e134146258d883388114f18", "object_relation": "md5", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533339, "uuid": "579483a1-c835-4c30-9aed-e78d409c4129", "comment": "Malware payload (Vidar)", "value": "3c3f12531045b7eedfe25e0f291d4792b0d8c8366f8de043e2fa8ecf34ccb913", "object_relation": "sha256", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533339, "uuid": "65b76b9c-af1b-44d7-a707-7aa50ec53658", "comment": "Malware payload (Vidar)", "value": "91f2324c19f08256d45bfc675a80efd6ad1e8748", "object_relation": "sha1", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533339, "uuid": "2e7bc5b4-a2ea-47e8-a7c6-d58926f77860", "comment": "Malware payload (Vidar)", "value": "78b961cadbfaccf0a0e45d62f45fc3c2c131fdcb2de37ce2a2289007f2280396fc1dc030185b968886b93d7bb2e12b3d", "object_relation": "sha3-384", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533339, "uuid": "e2057099-ce22-4c84-bd0c-64f9e89c11b1", "value": "T15DB57B523C9104BDC0A9B73248F27692BA35F8190B3627D32F95AA782F37BD01D76356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533339, "uuid": "eb3b7759-2ff8-4df3-a66e-1174831c336e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533339, "uuid": "ce374bb4-128e-45a1-8cd2-032b893100dd", "value": "49152:wuGIVgBM64FTkw5Y/XeWbqRRpxqJIW+mpOSOOR2:wpywJITmpBd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533339, "uuid": "d3d88672-c05a-43de-bf62-7f07afcbedd7", "value": 2381000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533339, "uuid": "06cb084d-9a3f-48de-851b-8dae78cc8b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533339, "uuid": "63c7df5d-2d13-49bc-b594-ba3bec10e59c", "value": "3c3f12531045b7eedfe25e0f291d4792b0d8c8366f8de043e2fa8ecf34ccb913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e082817-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784530179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530179, "uuid": "7951d6a8-c0db-43d9-832d-00ee9ec416ec", "comment": "Malware payload (Mirai)", "value": "03fc7e7f048f58be9c8cceea2e855b72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530179, "uuid": "a336346c-76f8-4026-9aad-02e9523a2139", "comment": "Malware payload (Mirai)", "value": "3cf154dfdf1790f2fd185f6f5ac618c75c0d6ff83ca19812e272da6bdb8bd4b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530179, "uuid": "744039ed-3a6a-4c07-9285-0d76491551f4", "comment": "Malware payload (Mirai)", "value": "c07aa94458e924cd3ee4c7f541a91df9d42c4907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530179, "uuid": "bb905253-6fd3-4539-b422-b83095df217f", "comment": "Malware payload (Mirai)", "value": "c6eca5ec7bc8ff6bceb6587025fa02d78fda2241617891bbf495ee3db720bb5371d49d78c295809be180f259d4518b4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530179, "uuid": "fdf2b8ff-8f6e-480c-8495-619c743285e8", "value": "T1E0D3135A200506CEF626D87560E90B6CAFEDE4B3B3588A4FA15A8C40CDE4AFDF4941D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530179, "uuid": "c5cb885b-8c7e-4665-91e8-db5c63fcc350", "value": "3072:VZa2YVa6yYRu68KTE/MDCgMPnzmWxVLPE9Vj:VZaVnu68KDD3M/zDPSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530179, "uuid": "ab91a130-9095-4359-a28c-27a2afa5a605", "value": 130912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530179, "uuid": "1f1e32a6-2c9d-42de-9291-78b0f5d33fe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530179, "uuid": "3291153a-8497-4c79-882a-8f406e5850a9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d5e780-840d-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784532749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532749, "uuid": "3e880bb2-0623-4a3d-8eef-da7c17f97529", "comment": "Malware payload", "value": "08061619c587f8cfc083497ab1ce29df", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532749, "uuid": "8e3eb0f3-8d20-4ffe-b3ef-f210d87190ee", "comment": "Malware payload", "value": "3dfe67edf7c21e9c73e8e0368d3afcbb6fd50ccf25cc93dab9c2775e03d97ab3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532749, "uuid": "ec9bdb15-07ff-4077-8163-8e7bf0f3b251", "comment": "Malware payload", "value": "4248c05168ffb3425759ac6413482bfa390d5e31", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532749, "uuid": "cf1659be-3eed-40f9-b832-0ae55d5758db", "comment": "Malware payload", "value": "1e26386748891fc479ecd259aa09752e6a35b9f8b85c631b5e083d37c3f1f8f708e75240c993bf0e8d05b2739bdcd9da", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532749, "uuid": "8856744f-0f5f-4783-8555-b8cc36f00108", "value": "T1C8A51494D63D04B5F86D437A1E2DBF8C392667CA07D273ADB8382F91249116078E9EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532749, "uuid": "4a6b1084-6090-4768-9754-a2c8bbec96a9", "value": "768:GVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpVpQ:wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784532749, "uuid": "c1441331-470c-43ae-8cc2-214c53b80057", "value": 2205631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784532749, "uuid": "099987fa-b886-4820-80b9-2ac968eb4952", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532749, "uuid": "c4f39227-611e-49a1-a864-d15fe76eaae1", "value": "Request for Quotation EQ - RFQ - 2026(CLOSING 18-7-2026 - ASAP).hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb85c156-83cf-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784506365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506365, "uuid": "b0a7baac-346a-4d15-ac97-1b4d4a77f5a0", "comment": "Malware payload", "value": "b2008a2aab04bc0c7a015aeebe01c7d0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506365, "uuid": "c33d87ff-6d61-4c28-a150-e276291ba84e", "comment": "Malware payload", "value": "3ee8b4e38efa5f872f5f1f4fac720d80eb7c079fc538ef75f2d8a8dc7068ef9f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506365, "uuid": "8bd702d0-3620-48f3-ab44-904c55686a72", "comment": "Malware payload", "value": "9142c74cd0de1543afb2bea83c609c0a6b309fbd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506365, "uuid": "790dc464-839d-4c27-8db7-406fb73a2c10", "comment": "Malware payload", "value": "cbdc29e19161e79c9d143f7893675f778a719d980f136396d837cd18719db7e3b5637bc4ade5c4d1bb62b37c4362d9bc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506365, "uuid": "60908478-7600-4b14-915a-fecab7421bbd", "value": "T100C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D4B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506365, "uuid": "11faa249-32d3-4c16-aec3-03d321baf8d5", "value": "768:s8vCB+25j6es8Rh9FYpMSUpi+20qUpi+20YQX:s8l25JXd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784506365, "uuid": "663e3046-10ab-4928-9726-93770b3294b3", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784506365, "uuid": "ebdd883d-b621-4c42-b8dc-abe7070eec1d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506365, "uuid": "acbab673-21bd-4e92-bea0-88fd7b1788be", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084a64dd-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784533122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533122, "uuid": "052b9255-efba-407f-8544-1b5a57f5e6e9", "comment": "Malware payload (Formbook)", "value": "ae4f0c27bfe35ba1ff750304a46c12da", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533122, "uuid": "ca974f34-7c31-4e8b-bf17-87c5f6dff1e6", "comment": "Malware payload (Formbook)", "value": "3f0b4ff0a87bf8001f563cb37188927324950819b5b4dc584f77d98030b63be0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533122, "uuid": "9006c459-db1f-4685-b0a0-2c326de6dec6", "comment": "Malware payload (Formbook)", "value": "22c0f179e78609e0ed2bda087fdf13c1db21e0f8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533122, "uuid": "7ef3e116-897f-4a72-bc6d-b27c5cc4630d", "comment": "Malware payload (Formbook)", "value": "d568c6fcc4dae5e446fe863263886a706704fcaa2a07558a531b02c7de93d72cd8d118215a24d7b2e92adbc6ca51a82c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533122, "uuid": "36065276-fe5d-44a9-9d76-7e3ab609679b", "value": "T162344A30D924067A4F475B9DFCA60A71CABCC619862740F1FADA470D60069ECE3BE67D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533122, "uuid": "f58dbbd3-871c-431d-8b13-9a96ef4960be", "value": "6144:NWlTZU4t1W9jiZriQ8NN1oWB0lYH08fjVygQqlB43qL:MtC4ijicQeoS0lYH08BkuBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533122, "uuid": "2da858de-4876-4ceb-9c5e-3815c9a1da08", "value": 238417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533122, "uuid": "a0e581c5-7ff9-4bad-be8f-eb6d707f369d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533122, "uuid": "9654506b-4e8c-475e-9fe5-d9ef0d6acbf9", "value": "Ungr98.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8214d6e2-8434-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784549648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549648, "uuid": "dc15583b-758b-4f8e-adfb-f6f5cf53a741", "comment": "Malware payload (Mirai)", "value": "a85ce4885e8e61f7412158a7829adde3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549648, "uuid": "05a5102f-4550-4236-8742-ec05e1769b50", "comment": "Malware payload (Mirai)", "value": "3f1acd59f536aa8886229f7c8065ab5866b62dfede6c738752efad37a1725f44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549648, "uuid": "6f9ee7b4-0d56-4216-89a7-eb02f12d91f2", "comment": "Malware payload (Mirai)", "value": "8e1a7f3319b0c7764a0ffbcd7d1817f7cf4c8194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549648, "uuid": "58173307-5e13-4215-9382-f4b5c4d04c99", "comment": "Malware payload (Mirai)", "value": "125ae0b7c1a94d1d1a56a3acb4b5cdad9cb55e32659e68645bfbca427729eb786f9699d8a905cce5843b3d55e4d352e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549648, "uuid": "28710094-3588-444b-99e8-ad9ea9acd045", "value": "T16EE39EA89E0FAD83D2C7E3BD9E5A0FA6303734B40510D1F75D00A69DE5DEED588B2522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549648, "uuid": "a03877f9-7159-4cfe-870e-f491bd8587cd", "value": "3072:SkYlNLwNGzHR/KnHGmyI4zs0YayDIHOLCt+nIrbSsKhRcLAv:TeqUVezydzs0ByDCNtzbDKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784549648, "uuid": "6893363a-fcd8-4436-a895-2731c85f9551", "value": 153464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784549648, "uuid": "e9ae4db8-27b0-4ad0-9094-9204b497e3e4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549648, "uuid": "00c0d3f5-c589-44c7-b69f-917ea2482da2", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc29dc64-847a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784579917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579917, "uuid": "7fa474b9-02c3-4b19-a1f8-30722fd1bd71", "comment": "Malware payload (Mirai)", "value": "1de1a8bdd8806f731beef46446e05388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579917, "uuid": "70309ed1-a397-4a70-a98d-e9e017686647", "comment": "Malware payload (Mirai)", "value": "3f509b8445f1b263397f3d531f478aeb9b046e0ab7582549a622e912a7161fda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579917, "uuid": "8d7bf468-302b-40d4-85ea-cb7ed788201e", "comment": "Malware payload (Mirai)", "value": "6744313410664c9f4be860f4dabf9485f478ffdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579917, "uuid": "8f59b99f-1dcc-4ee0-9c59-89b74ac2b535", "comment": "Malware payload (Mirai)", "value": "1c8ec8c93fc97a877126ceb120bad93b74ef69dbadfebbde7a9b7aa86799f7257a8a1ad647ca73aec0f281c240f99515", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579917, "uuid": "dfa615eb-8230-4a1a-8580-b12da0130da4", "value": "T17A6302B49055CD93CA3C48B09E3E0FA77D494AB8646678FE56704B586A43FC8ABF4CC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579917, "uuid": "3d452586-6bec-4d8c-b227-0159a4b2820d", "value": "1536:M6km9VKx73LQuBsOahcEFMGprfaY+Ljf2dX08T6bKhVmse0x:M6XA3TsOalTcLje28DVTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784579917, "uuid": "05e36c97-3bbd-469c-ade9-0b27a3d1bba8", "value": 72544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784579917, "uuid": "dcdabf28-7a83-4e6f-90b2-db4882f6b048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579917, "uuid": "aa69c315-1fbf-421a-b07d-3bf5a6e44a00", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b837ba2b-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784530411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530411, "uuid": "04fb211c-5c4e-41ea-9e2c-079a07870aa8", "comment": "Malware payload (AgentTesla)", "value": "2c74e9788372275cdb98aed0f56e8cbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530411, "uuid": "6a682627-c9c9-4e2f-8d63-b1b86a1659c5", "comment": "Malware payload (AgentTesla)", "value": "3f5f4607c45313829fab57a25e1560c8d4601389611288af894a089cbb454c6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530411, "uuid": "31f3a016-af68-4f50-9e67-f4b7c0b5dce5", "comment": "Malware payload (AgentTesla)", "value": "c0d41c87ab582f5fc53c4c14984a847d3fea75b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530411, "uuid": "3339c11b-3cc4-4621-a8d3-d7c10b292332", "comment": "Malware payload (AgentTesla)", "value": "a186e1ac473ea0f7049841c4a0611ad370b4c499f807d8ef8573da1151bab3aca516b0c9703638d1dcc3557eea450c41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530411, "uuid": "76a4edce-9c62-43b0-84ac-48f6d755c271", "value": "T19FF5E545A73595332321DF6E9176DE78948EA04334DDCF4830AED624762CE8BA358BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530411, "uuid": "4488b92f-0c33-4d32-abde-2708c8126983", "value": "98304:7m++0zObjCAB08+a/+LguNRCWLUhHWAeisN1+2p11:7mj0Kbjr+fLxNRCqy85N1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530411, "uuid": "7b71f8b9-e993-41c0-94aa-b6a5b27bbde4", "value": 3592963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530411, "uuid": "f557c0e5-5915-4004-80e7-a7ae3e1e59cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530411, "uuid": "25cbb125-6536-42c6-829c-5f1eb773b496", "value": "A-5752 Troester.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bf62ba-8411-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784534593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534593, "uuid": "22fd64a3-b0bc-4d6f-8c53-1a501505b0e6", "comment": "Malware payload", "value": "b0dba6ae1a0f39b64890aeeb4676ddeb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534593, "uuid": "e4b2ac38-9eab-4a9f-9731-81e4250b41f3", "comment": "Malware payload", "value": "3f95d0535e29e90b41c47a1199aabb2de0c3db76aaee8adcf34e17a451bbf8c4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534593, "uuid": "6d18120d-f078-4f8c-aed4-b05aa0506e51", "comment": "Malware payload", "value": "8c23c84787f371fcda6126533d7ea9a1d2f66a72", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534593, "uuid": "420f65eb-165f-4aaa-b03a-a3c75d133494", "comment": "Malware payload", "value": "08c43002cbdefe17844de6c74dafedf337b581b1cb59512dc24feaa27d80f96ed2eb11dea931992869694f4cf2594624", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534593, "uuid": "a194c4c1-7cd3-45b2-b19a-efe43ee1bc84", "value": "T159235B2556867C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6ADD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534593, "uuid": "d25e4fa3-4bd4-48e4-a710-3fbfc3322096", "value": "768:n+F9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:n+Wcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534593, "uuid": "84631a8c-afc7-4c78-b0ca-96400190f810", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534593, "uuid": "53236844-303d-4d06-80bf-f5733320c0ec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534593, "uuid": "345ff78d-ab4d-4573-9b01-39f32d772c10", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf19399-8445-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784557046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557046, "uuid": "f0d3179c-adc3-4040-b6cf-7d292e8583c4", "comment": "Malware payload", "value": "7f7c4a42c0833f5b1f5274c9f35c0b48", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557046, "uuid": "3dee2969-4162-47b7-849b-f42dd1d6e839", "comment": "Malware payload", "value": "3f97983a32f87a4aa029dd712a8dc6867c71e10cb238496d48cf7755a236fc92", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557046, "uuid": "3a7cdc7b-7653-41d8-a1d0-2d6f790fd03f", "comment": "Malware payload", "value": "6589c555830b1a7ebbb90d83342d22d22ab32bb6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557046, "uuid": "fd6cbb2c-90b7-4fbb-bec7-2367cf2250c6", "comment": "Malware payload", "value": "11022389f40a81a64aa12ece68c216a4c807e2388acc1c8061bbc3ec30c8966984c420e4e7c0d0b0c85b96afead4f7ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784557046, "uuid": "9a2ad928-21c7-4e4d-8246-6ba1191c729c", "value": "T173235C2556857C24AE98C4361C7E2F0CB9AD83E6320452EE7FCF3CF68C4A6AD910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784557046, "uuid": "b2e2faef-fbc4-4513-b902-87f7f0ceac11", "value": "768:w+59GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:w+Scr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784557046, "uuid": "4b38f09c-9c3e-4ad0-a31f-325f37b29bba", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784557046, "uuid": "d67bb8b3-999c-49de-9298-b89efc3b7a19", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784557046, "uuid": "9d70bc25-b41f-40c8-b8f8-a8c5520aa4d7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d12cb6-840a-11f1-be1e-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1784531702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531702, "uuid": "c6653335-300f-4d22-b54d-f324b0489fe9", "comment": "Malware payload (Gh0stRAT)", "value": "eff8675fac22c49107a2a42d3c735f10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531702, "uuid": "9595f29a-7605-4153-82ba-3f0f1b7e1b2b", "comment": "Malware payload (Gh0stRAT)", "value": "3fc95667b98c637ba785b67dff1bd15ff7a21f082d25894c3a78ec1b6206fcd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531702, "uuid": "20edfc31-bed9-473f-b732-c4593882fb79", "comment": "Malware payload (Gh0stRAT)", "value": "e17f76e0b4c47a5f54ca51b105be0dd29df50c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531702, "uuid": "56dd45b6-b75e-4f2e-9877-77a3d623cef3", "comment": "Malware payload (Gh0stRAT)", "value": "55a943ff52b72ed133e4278091154542557bdad86d11ff8495bbcbe94b4209c47abb710033e93cc0ab0d4233509abb4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531702, "uuid": "f5b0f894-3109-4180-a1d7-e5c1e2700303", "value": "T17B473326F2CBE13EE15B1B330A62F04460F776516522BE16DBF084BCCF298551E2EB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531702, "uuid": "fea0af45-01f6-48eb-b82f-7f04d7d894eb", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531702, "uuid": "38750f1f-2564-4415-9188-d906e6ab32c2", "value": "393216:qd8znsEGvl72xOsNLNTZw9Kai6I/KqKnP0AZE9ESOJTdbF8Xm86eynJq32S7lErP:UY+cxnLlQKa+KqKnP1ZE90FV82nAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531702, "uuid": "f7a82e0e-4b00-4f0e-bd1e-9f9f53db6c7d", "value": 25518763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531702, "uuid": "a29dd307-db33-4532-b628-6e07c8b8eeb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531702, "uuid": "791fa52b-11c8-483f-839a-744633576208", "value": "image_2026-07-19_14-09-36.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa6aa7d-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784525073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525073, "uuid": "72e152b9-d8b2-479c-b052-c9f9ff29af65", "comment": "Malware payload (Mirai)", "value": "8f291fb0a8a0f6bf46db5129008b1f22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525073, "uuid": "9dcc0029-5909-4b23-8a23-ea3e1ea30501", "comment": "Malware payload (Mirai)", "value": "4038bde69b712f50bcc7b6dc59c92df227dd7c23e76fe20076e44cb38f5a0602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525073, "uuid": "1116f18d-1e23-424a-bd38-f09dbc4c9e35", "comment": "Malware payload (Mirai)", "value": "1a7137244f65878a286fcd0f2869059ce033148b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525073, "uuid": "af776d26-7955-4980-b8ed-805af3d24ac5", "comment": "Malware payload (Mirai)", "value": "c0a0cf7d127b10b3938279d092ab51e7a4eb682e0b4619628d135205bdc8a6e752eb88faf1520a7c19320da785c1fd5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525073, "uuid": "85a37b57-9679-4e3a-b584-87f239dd70f6", "value": "T1C8B30886BB43DEB3E55310F102BB4B354A32FD3E4826DA81E339BDA599511D0A61B37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525073, "uuid": "3fe80096-fb41-4ed4-8eee-2f0918a6f8e6", "value": "1536:7hZ1IPEmPmOm/MhgC0bk/wPfYN3Grpld7+MJdQdAOEur/6:7n1IP2/Mhlkk/WgtWvKt/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525073, "uuid": "f9e9beed-15ec-4c9a-896d-b2c6f6e72c77", "value": 114336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525073, "uuid": "2aad1038-dfc8-414e-b700-c0a20adcc425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525073, "uuid": "9d18eb4b-e43c-4a2f-a338-c8b76347b9a5", "value": "eclipse.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb69f73-847b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784579975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579975, "uuid": "8f15bd2e-ef9f-442a-80ae-388042dd29bd", "comment": "Malware payload (Mirai)", "value": "5d4b0dba09b8f4ca7f97f559a28f3c56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579975, "uuid": "69f38a4a-5a2c-4a97-b6f2-6cc8789da555", "comment": "Malware payload (Mirai)", "value": "40df91b940eea28d176edccda20a8e2e4e281eb531254486d4c69af08dd29842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579975, "uuid": "9c56e1f3-dc60-4b17-859f-5cc48cb2007c", "comment": "Malware payload (Mirai)", "value": "c102181fc2f978a2b5a31c0c33c24c2659b743f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579975, "uuid": "c544f454-8092-4d7e-b3fd-20119421d063", "comment": "Malware payload (Mirai)", "value": "791b7b0a9922f6ecc194ffe77f664d3824ac4bbc7815ac8697d339a96943a002119a67994c5fa4f3e831b5d277b81f9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579975, "uuid": "c2b76be4-cb1c-4795-bee4-c5958522dc4b", "value": "T1B6144B46EA418A23C0D7177AB6AF414A3333A7A4D3DB730699286FB43BC675F0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579975, "uuid": "ff90d67e-bfd7-4f58-af4a-627cc062113b", "value": "6144:bzwCD8W1DCPyalbRblciQsYCKDcerNrye3NwM/9YjGC+:bzwCD8WBCPyalbRblciQD/JByWJ/6je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784579975, "uuid": "51ae9a6b-1497-4283-b58b-6f4e40388fe6", "value": 196872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784579975, "uuid": "ef5ca485-847e-477b-9d76-8fa62db0427a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579975, "uuid": "54904216-17bd-462c-9c1b-d146a3fd497d", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb85141-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784525080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525080, "uuid": "0199eca2-c694-4a4c-8ec7-a688b12ed267", "comment": "Malware payload (Mirai)", "value": "dfddbd600d038974f587dd0b911d501b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525080, "uuid": "2d0be755-1f8d-4f11-abc8-14a00a6aa053", "comment": "Malware payload (Mirai)", "value": "41b0e430db6bdacd42cbd1c65b1f5e08260b6aa46ced16feba6a709f67bdb0f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525080, "uuid": "73cf4d7d-3b42-4bc4-a3a4-f3771c35e06d", "comment": "Malware payload (Mirai)", "value": "c7fef8aea65ce16f5525370f845b9ab4eb476dbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525080, "uuid": "2d7a0aa8-a476-4401-aa10-52dcb2c7d030", "comment": "Malware payload (Mirai)", "value": "04942fce9fb90e6096166299f75c9de3bb5a2dfdf65a1a61aeedd502ae73a34b25c1be7fb852e29acfa4eb247aee58e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525080, "uuid": "eac422f2-fd92-4405-a74d-d82e8e9e4f37", "value": "T1A2B32863ED26AF06C516E0F0B2F28E795F53BD2649871B99A436EAF44147CCCB0053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525080, "uuid": "d5c2a426-127f-4a1b-be4c-4fa0a428d540", "value": "1536:PpBcSfgyCEKIag37obmaqQbBNYWJt+U7mAM2M:PptgyiIHzaqmrYWTjm12M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525080, "uuid": "fdcb9714-c0cb-4fed-962b-661dbaf733b9", "value": 116832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525080, "uuid": "68349340-1f5b-4010-bd06-8a166001f185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525080, "uuid": "2afd8cbd-b61e-4481-8219-2f913a705bbd", "value": "eclipse.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8534d8e1-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784530325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530325, "uuid": "c18e5dac-1ea4-4e13-a124-6e145267c914", "comment": "Malware payload", "value": "3615da2fa53529eb11eb3f3bc5dca876", "object_relation": "md5", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530325, "uuid": "4aec6a44-2525-4ea6-94f6-1051edbd3264", "comment": "Malware payload", "value": "427f51e4b519050de775d16e4ac6c1c41cfe8d2336a3e2f641369f25ed56cea9", "object_relation": "sha256", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530325, "uuid": "a55a8a12-9485-4c3d-906a-1e2a34e74fce", "comment": "Malware payload", "value": "10deed7afbdd2548935f181d6caefa2f7977e69f", "object_relation": "sha1", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530325, "uuid": "4f156981-5dcf-4c8a-8cfe-350132c3a3a6", "comment": "Malware payload", "value": "3003cd7ca368ccd0e86bf574beb790848439f975b25f259ca70d7297cf5fcbd3ff9eb16cb4251f8769d54bf2367b97d7", "object_relation": "sha3-384", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530325, "uuid": "454b6104-b979-4f50-a733-a59d97fce11a", "value": "T1EC1429E2F69420E9EDB9073840D52E39B767BDBEB624576F0684F5152E33BD10C34A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530325, "uuid": "f4a42e22-d525-4ec9-a84e-d5f44ee035f3", "value": "3031c7860f6c160a8d033d7c9cc388d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530325, "uuid": "f891d71d-0edc-42f0-8215-0fdc410c14bd", "value": "3072:+Ae9XyoILcvlan4PoCiPHquM0Y3raL970Usow1KZWKQqJ1I8PNB6+9mDTorXnrm5:uhIn4P/kHgmLuUsoSfYvL95X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530325, "uuid": "a01855e0-a6fb-4e1e-910d-ff86edff2d93", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530325, "uuid": "b715f398-9ae2-440d-b411-7e2d1eba7aa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530325, "uuid": "f95382f2-0875-4028-9c50-59025b5561ea", "value": "sinubzclz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2e143d-8403-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784528621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528621, "uuid": "d9956e74-3fc2-469d-8902-de425d5dea46", "comment": "Malware payload", "value": "67169e1641f0228080e6e2060125dc33", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528621, "uuid": "e71026c4-30c0-437e-a3cb-8d6d536ba22a", "comment": "Malware payload", "value": "42c9d140c40bea6eeff73c7e61d7b8838ecbb69cc61561b5d2ea7a024d99e4e6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528621, "uuid": "77e2737e-deef-48b6-9a85-2d1a490cb2c7", "comment": "Malware payload", "value": "1306b651b275afd9057b3378dec1ff886b950062", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528621, "uuid": "d64803f4-4419-43fd-86dc-c4d794ff036e", "comment": "Malware payload", "value": "f69ef07b8b9f4dfd5daea22d8ba0c181fef4a4a346b52a7507aae677de6f0e35e0b2ef88cda057bf5a728efb2a32bb21", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528621, "uuid": "e6422606-369b-48ee-b5ea-a06cc7edb06d", "value": "T185C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528621, "uuid": "a1fc9571-f84a-48a5-a9a3-af6f74957011", "value": "768:b58vCB+25j6es8RK9FYpMSUpi+20qUpi+20YQX:b58l25J8d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784528621, "uuid": "5b09ac71-5901-45dd-822f-3eafc87e8473", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784528621, "uuid": "16673fc3-5c03-43ed-a053-e55f8d8dd8fa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528621, "uuid": "5247787e-d78a-4780-8df4-f5d4e45e0bea", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c7014e-842b-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1784545674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784545674, "uuid": "c6a10bfb-cd5e-4a18-869d-2a14fe098dd4", "comment": "Malware payload (OverlordRAT)", "value": "d0fd58a876d5987c6ea93fcacb5e4b99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784545674, "uuid": "59a5262c-8cab-482b-a6ce-4e99ff4382eb", "comment": "Malware payload (OverlordRAT)", "value": "4320692c3d8740441eddb60c5fece7d15cb5fbb8ca1e4eb7199745223459878a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784545674, "uuid": "195bc0a7-5584-43e5-8bf0-303ea9d5e468", "comment": "Malware payload (OverlordRAT)", "value": "16e4d95d0537841dcd4e94b69d0dee567c1d8e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784545674, "uuid": "b6575f0b-3518-4b88-a2a9-1bfd95463352", "comment": "Malware payload (OverlordRAT)", "value": "d6ca1919eb38664c9d07187f51f2cfe1d56b8d988a9c615bbc940e5d3704666caa2aa53c57e9ae9f90f1491746da7f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784545674, "uuid": "1d572543-d7d3-428d-9fcd-4b41a7c096d9", "value": "T1A3D64947EC6955E8C1ADD1358666D6227B317C4A0B3173E32B60F6287F32BD0AEB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784545674, "uuid": "d1365b7b-bb66-4029-be99-eef219f24e48", "value": "ad5b7eeb902875ee72ed20bca26b0360", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784545674, "uuid": "e5a5a965-3b1f-4d14-92e0-a5cfb90d643f", "value": "98304:ND5rEfOlJlc/yCEfVGPT/5LEc7xC/09XLUUs2R2Dqi1Mu3XudjM:NVGOlJjGPTRYc7xC/3DqPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784545674, "uuid": "93d37a4e-20c7-45c4-a395-563497055579", "value": 13491200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784545674, "uuid": "981f4aab-7016-493a-9b63-b572bae3f2ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784545674, "uuid": "940bc1b3-71f1-4c14-a2d0-c3753d781b5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94034503-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784534216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534216, "uuid": "130f71fc-e0c4-49bc-bc47-bba1455c5d4d", "comment": "Malware payload (AsyncRAT)", "value": "eb3fd1706066aecf68f002c744100218", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534216, "uuid": "6029517c-63e9-465c-a61e-1889f91abc56", "comment": "Malware payload (AsyncRAT)", "value": "43fe17a95010413fce338858f7f675708e1f3b9fb1998a436881c35dbe49825f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534216, "uuid": "9e08d784-d7f2-4a58-9345-504f3efcb407", "comment": "Malware payload (AsyncRAT)", "value": "29fb8a163ec801d7e28fe0e8e817f8501b6cae86", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534216, "uuid": "bceb9bf3-0d12-4332-9084-87d23da90ce9", "comment": "Malware payload (AsyncRAT)", "value": "898bb67979ee4e544231f05aefd47a625c58b448f184fe9bd2fba0cf705be1fd38b6bf88cd3312bc2b71ccc40a2edc93", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534216, "uuid": "3b3c42eb-2391-4cf6-b44b-596ce0923be6", "value": "T142050168675CD502C4521B704E65F2B8159AAE99FA20D317AFEC7FEF3E72B059C40382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534216, "uuid": "da1b8fa8-087e-42db-a62c-0964d923eabf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534216, "uuid": "f575e4ba-6873-49bb-8424-53d62d7dc910", "value": "24576:kcBenknU78vxonjOLqCLh4EXzKXaow9NpswhB:kc9iaLq2h4EXWpUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534216, "uuid": "18c6b6d7-2698-4719-8dba-f04d3b1da9f7", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534216, "uuid": "48e14923-9c38-42c7-96b5-dfdbdfd6f24e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534216, "uuid": "5ca4499e-63ae-4b85-8c46-04e164a010ea", "value": "FCA19022289AFFCA0000004409.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfd3756-843a-11f1-bd95-42010a9c0009", "comment": "Malware payload (AdaptixC2)", "timestamp": 1784552080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552080, "uuid": "c27955f8-7aed-458e-972a-1b45edc374f9", "comment": "Malware payload (AdaptixC2)", "value": "82cdbe243a14f95b8bcc80afb24df8d8", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552080, "uuid": "959e9ba0-4c8a-46b4-a0e9-e0862b3a1246", "comment": "Malware payload (AdaptixC2)", "value": "446f04a7517a5ba6b962d65860cb69ce1e8ae1a1fb038fefbf87e875fcf41540", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552080, "uuid": "2f9df525-1d5a-4e5a-a272-d0fe5c695cd9", "comment": "Malware payload (AdaptixC2)", "value": "36e493ed614e4ec0f453f37ce904e7c620de5e6c", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552080, "uuid": "6c927a6a-2b27-4be8-8152-f3f229dafd3b", "comment": "Malware payload (AdaptixC2)", "value": "d56d542b584d8972f21e65240fd4edce9983704978f440f64213104ce5af18527ebfc3a9f7c27f5adc0318b457109997", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552080, "uuid": "74a0b9c4-b32c-452f-b8ea-5ba5168d6c7a", "value": "T15A937335E3B2D0ADC45F8578AF975873AAF07C2C8630A135479966213B5FDB81FBA180", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552080, "uuid": "226f31f9-2063-4eae-b2be-11a94d9aef57", "value": "1536:/i0mo+NOKqQRELxJBu0jwWhcaZT52GbS2dDevBUafg4ucx09cY2eyFu7vmSvDtd6:T+NOBhucbS28fgOHdIEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784552080, "uuid": "6880b17e-34ca-49df-94a9-ac675d8f804b", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784552080, "uuid": "0c8009fd-08ca-41d3-9283-c1083483f05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552080, "uuid": "b51d9b04-d66f-4a3f-8aa7-fc5966d9b162", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c662c23a-843a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784552339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552339, "uuid": "e0e6300a-9785-4f36-8978-babfdaaf0447", "comment": "Malware payload", "value": "cce96617ed0761b937f6ea6eede7d288", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552339, "uuid": "2822c49b-2544-480c-bd17-a53613a49594", "comment": "Malware payload", "value": "4498c5d7ac8b2f170330c11d33e8bf28a9879964159ffc711009fd4fe902f77b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552339, "uuid": "449412fa-591a-4dd5-a049-7a3705ea56bf", "comment": "Malware payload", "value": "2d65ad2c3c092158c678e9552735f0656c9d91c1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552339, "uuid": "cc2b6d89-9ff3-4e47-88aa-650cf0368968", "comment": "Malware payload", "value": "e02b238003dc819773837ebec3612dfa7fa76fec5873e89ab35a2317a7efe71233e78597465541bc15ce95928b91e07e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552339, "uuid": "cd03d3c0-8c5e-4214-aab6-2e4497b9b714", "value": "T1C1852353A3E88567F6A6377CA9F12323B2793C901B7393DF5A402A9C29337C65531722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552339, "uuid": "3a0c8b9d-8bd9-4a0c-80ac-df5b8d75f30e", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552339, "uuid": "86c3b9db-f622-4e70-9f95-bf5e962f1a5b", "value": "49152:DkfovDwaxCH/WmLWoi3xS0TASv9hiXScH:/Eu34crv9YSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784552339, "uuid": "4dc5e3b9-785a-4d4c-9aa7-719645af61d0", "value": 1757696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784552339, "uuid": "90733748-8429-4817-be84-e284d4495052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552339, "uuid": "05aa6cee-ea07-46da-80b4-74e83e32f7e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0addc9a8-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574788, "uuid": "9778fc9e-a656-4e9d-b2b8-cbbcaafcfe30", "comment": "Malware payload (Mirai)", "value": "3ae0193b1a075db07046ad7f695c6cce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574788, "uuid": "83b3bcc0-8fb0-41f2-8342-d1f360aa1595", "comment": "Malware payload (Mirai)", "value": "451e62772cb780fa8cd93a36f5041c349d62dfb83e6c9879c082050b55a5b444", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574788, "uuid": "1c83488b-9b72-47f4-bc14-fa5c1265cf79", "comment": "Malware payload (Mirai)", "value": "b4c606f432085f215b1be83d2082cb0c2d32fa7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574788, "uuid": "9fb8135c-e08c-4503-820d-6d7469aefb9b", "comment": "Malware payload (Mirai)", "value": "f900f49911d2d9e13fb7b706f862d5e96b42717c04b930ed7e8dc144a9d53d03d8c887d7307c888ae4ca0b2bfa4253e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574788, "uuid": "4ca2c3aa-d0ca-474e-ad17-be1992657659", "value": "T1894302A4EEC36971EFB81D32EC674027B7C546B06DE677EDA21901EC3AB504928E4096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574788, "uuid": "13cd5be8-7b41-4892-83dd-45e14b381222", "value": "1536:BSLvjxPkC/fXZZ5Y9NvHX7NPd5X38rE1oaXFIbuWAMf7:kLv1PkCnZ47NvH8AZXKCwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574788, "uuid": "a666b21b-0a2f-470d-b761-d4f1adf9f664", "value": 57808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574788, "uuid": "0d7bfb8e-f9ca-431d-b894-9713a52e3d72", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574788, "uuid": "6f25c588-92d5-4250-a549-df7df6f81e13", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4d482a-8408-11f1-be1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784530582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530582, "uuid": "1fbaf4cd-89f6-44a3-84eb-ce15169e54b8", "comment": "Malware payload (Formbook)", "value": "c57d0a3bc3cc6d858af1e5f9632da7cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530582, "uuid": "4f150be0-c5d9-4f77-b95c-d54a42e65dc7", "comment": "Malware payload (Formbook)", "value": "45956fd4db0627af8d3b230671a034bdf785821b617643040c57a57e8eb9015b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530582, "uuid": "e340b857-fdae-402e-ac97-38f9dcd00ec8", "comment": "Malware payload (Formbook)", "value": "57daf94c45286910601f3d0fd89a5341cc586394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530582, "uuid": "49fd2d2d-c9f1-4332-ae5d-ee2c73d24a0c", "comment": "Malware payload (Formbook)", "value": "99140dfda6ad67d009f4cbf314053c52f2b44e7ab4a970a336fb3aa70790854620faa777f801b7a6787b20a113aff9a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530582, "uuid": "1b5c9932-2255-4ae3-a01e-680d73faeb4c", "value": "T150251284A2DADF01D4B847B48AB2E0F10375AD6EE130E21B8EE0BDDB7675B515D90B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530582, "uuid": "1d02b30c-8892-42bb-8e49-97b9626daa5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530582, "uuid": "bf365767-c60d-460c-8785-0f0349fe2ab0", "value": "24576:9qj/Og3BbCKT+DYowkv6gqQpVDd+hFIL/zZRm+upcs:ePxbj2B6gFBd6FkZRm+Mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530582, "uuid": "a49a9bc5-ccfc-4158-8f13-5efcb85dd2d2", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530582, "uuid": "3a2bdf47-4d94-464e-8373-0b7c75826461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530582, "uuid": "17f58e22-f93f-4015-a63b-59ed0aaa679b", "value": "4500048477-Q4345094 85doEjPWRzJ9i0n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a3ab13-83de-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784512521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512521, "uuid": "b4b2d639-8835-4a76-aa17-c526c5099497", "comment": "Malware payload (Mirai)", "value": "83a52d42c62bec87c510d55965565c0f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512521, "uuid": "d2c93285-df79-4a53-bb32-91ac2abad6b6", "comment": "Malware payload (Mirai)", "value": "45ce79bbac91e3ca67d3cc7dd150ada9109cf6a52b09d3e6eaad8adb4df30777", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512521, "uuid": "03ae0826-74d6-486c-8ce1-f5a3bcd7e833", "comment": "Malware payload (Mirai)", "value": "43b49da0b67b0fe4428cd9939cdb00a39e79ff24", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512521, "uuid": "3a726896-a938-4248-9077-5d8e20ad7d3c", "comment": "Malware payload (Mirai)", "value": "b1d95615d36230a0b36ba579edb2b5e13aff9e072609e291380126e2db0c22a1f80d914277fe60750400e5900fc19e0a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512521, "uuid": "05371300-ef61-4937-bb3b-e142ea3ad900", "value": "T1BA314B0DC2C2EA2095815CE6F0C69112B913D7DCBBA31E74FE0AE7B1782C8497132D72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512521, "uuid": "c6d153e2-c45b-4d6e-9f49-a4a468f003a9", "value": "48:QvQhnojhnojhnojhno0jDGEeECEhEoEgoEP:AQhnAhnAhnAhn/jqEeECEhEoErEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784512521, "uuid": "a608cf08-8646-451f-b4b2-6527133a0f2d", "value": 1723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784512521, "uuid": "9ad13050-f4b9-401b-84c2-f58d56747196", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512521, "uuid": "a1abc183-5e9d-4ec9-9ed4-f8e82ef676ee", "value": "mload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782c2808-83ce-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784505822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505822, "uuid": "16d17a9d-9165-468e-8ef8-8b8fa4f70efd", "comment": "Malware payload (Mirai)", "value": "fd442a5c42c78736b8f81e892e69c1dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505822, "uuid": "bae0e400-2a78-474b-af2f-c9d008709aae", "comment": "Malware payload (Mirai)", "value": "45f072085e50c50ac363bf8a88cd4b362df1230758123e04703c431818b86034", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505822, "uuid": "9f45d555-0e78-40bc-bbfb-6b0ad38334b7", "comment": "Malware payload (Mirai)", "value": "ed63448a4953ce94c06ef639ce932314de78d101", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505822, "uuid": "1c790602-e53f-4071-8c71-690897bc96e7", "comment": "Malware payload (Mirai)", "value": "ea77d1a9adb8985726bcd269e5888b0dbaef6ab7f67a0cafdd8b37c4eb67884bd680233962dcd454a36480ba4a0950b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505822, "uuid": "c4149840-6b78-4ae6-bd8e-6c1250dd180e", "value": "T155E35B59FA5BC0F0D6D340F4063BEB6A9A3A9D116173F5A1FF5A3A62FCB1301248526C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505822, "uuid": "a5fcdfba-ccf8-4396-b23e-724bdf0cd27c", "value": "3072:/2earQ8QEFZO0mKJVMj/rpanXmKWIICtMLEf:O1QDESLjz4WKiSMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784505822, "uuid": "3b610c78-ef59-4280-b8ed-781f961d7aef", "value": 144764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784505822, "uuid": "08ee95c1-a991-4f09-9c22-44b2071b6367", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505822, "uuid": "de7460fb-c2e6-490c-871b-328c4615fae5", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a517fe88-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574617, "uuid": "84b27347-4442-4ada-a385-de0d081f875f", "comment": "Malware payload (Mirai)", "value": "1ebf89fcedc24b4fd4bf44c1c7555551", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574617, "uuid": "4e5e6bd2-0bd8-417c-b32f-d86fbaaf6252", "comment": "Malware payload (Mirai)", "value": "46aa346da774ba70930dbcde4c35b53f8e308301306b2312000ebcdf592a315b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574617, "uuid": "3a8122c7-e544-4def-8647-53260de4518f", "comment": "Malware payload (Mirai)", "value": "4e9312139bfe9d671374ff8f946e25655c755a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574617, "uuid": "05155668-821c-4cdd-aace-364bae86b00b", "comment": "Malware payload (Mirai)", "value": "debe6ded971677d98553f76c576fbdafb32564e2b9722ab97dd3c46ca130ca98d385034e7b67ab9c62ce5e884c193e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574617, "uuid": "cb693397-ea7e-4f9b-91df-700c36ac56d7", "value": "T11AA3F785B9829F11C5C626BBFE5F014D3317BBE8E3EE7212DC245F9033CA59A0E66512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574617, "uuid": "0a30acae-50eb-402f-a9ee-2641205fd061", "value": "3072:p1DWd3AEdzwOwcauQJFzKRA6QPC+7ZgW:vWJAEdzwOwHZJFzKRA3CBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574617, "uuid": "3ffaab93-fdcd-4339-ad8b-67128a86c3c8", "value": 100268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574617, "uuid": "cd0cd875-0ace-4794-b624-31d925dd85d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574617, "uuid": "97a43d46-da2f-42fc-b588-ac15614bd884", "value": "nullnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e181faa6-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509435, "uuid": "574a99dd-50b4-4d71-ab11-35080a217d7d", "comment": "Malware payload (Mirai)", "value": "645ae72a7a03815057cdf1122eb610e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509435, "uuid": "a8243bba-3a5b-4950-b358-41e1199edac2", "comment": "Malware payload (Mirai)", "value": "485bbf2e949d6c00b78fa3a69c346b5a587f9c416310f9496d838d9a0236a40f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509435, "uuid": "acf69ffe-5014-4067-a6bf-b1243d7a5d0a", "comment": "Malware payload (Mirai)", "value": "265312e42d7cb92549f9017de19ca91f246592b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509435, "uuid": "06e05794-7614-4895-b2f8-7d948f9fe33f", "comment": "Malware payload (Mirai)", "value": "3b9c68efb46a7d7e2f5452e6223dd14a79311dfdaff9e073bb584b799eae40ae2abd0e2220a788c6dad644b19b9b3589", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509435, "uuid": "b7e14bfc-9f1b-4810-84aa-1d5025b459c9", "value": "T1B0933A45FC919A12C6D5137BF72E228E372663A8E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509435, "uuid": "e80eb9ea-ee15-4ef9-b4c0-b9a9a29aef64", "value": "1536:9Ot4/NGRVrAFcqyJwBb86PVLIzAX5iXffdXLamvt4:9Ot4/OVEWNj6PZIzhPjt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509435, "uuid": "0158a563-fd7d-4d96-b15b-ce82c68dbe08", "value": 92240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509435, "uuid": "8a15ca0e-c056-42a6-94a9-ba3cc7bd6bbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509435, "uuid": "7559666a-0d36-4d0d-b4ed-17c3bec7de08", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079ae25a-840d-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784532692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532692, "uuid": "eae91524-cc98-4fc6-b593-2cf82db4f624", "comment": "Malware payload (AgentTesla)", "value": "dd91c38ebdf891287a03d35a03be0301", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532692, "uuid": "c4a04c47-5d57-4b6e-b281-fbec78f08c1d", "comment": "Malware payload (AgentTesla)", "value": "49279ff36b563b4cd568c4b836fe28275090f0712af4c36d1469cf5a1f5b0977", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532692, "uuid": "a6b8dcce-3eb6-4acd-970d-1d32c55def5b", "comment": "Malware payload (AgentTesla)", "value": "158118b9ca94a52c40c252869c3163c4cb61f05f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532692, "uuid": "099f079d-6729-4a8c-94d2-5f9447666d05", "comment": "Malware payload (AgentTesla)", "value": "e7d435cc85e21c0050099af88039e9f45f696485f1fd42542de782758708e9844db9b4908a4ec41d4e87020f04007655", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532692, "uuid": "bf6ae307-530e-4f6f-be8d-4022240c171b", "value": "T14D65F18085C07ED49B5B962910BDA269E7A20DCB7C3DAD4DE723FD41EFB2104D6072B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532692, "uuid": "1756e62d-471e-402a-8619-177fb3fdf2a3", "value": "24576:+K35hxv3tdw61jKW9VkoJnKxMg4y8YsEcEkv9Wygtck:+KphnmvskuWOJE0Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784532692, "uuid": "4aec47e2-070d-4fca-8d88-e6ba3afc94e8", "value": 1548142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784532692, "uuid": "d0c9fd8e-8465-4e5f-b6c8-687d43183b14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532692, "uuid": "db175c51-5d2f-459e-894f-6016a5e42623", "value": "Purchase Order No. MP.S.006025-08524.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61df16c-83db-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784511510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511510, "uuid": "edb1cb24-49f1-46f8-bf28-08545f374f86", "comment": "Malware payload (Mirai)", "value": "cdc4c54a7d9c30f9e4698299dbd4e150", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511510, "uuid": "9525dcdf-687b-4bee-a40e-1f533b36a1a9", "comment": "Malware payload (Mirai)", "value": "49d9e5fda3eb3064f04e6d2ac0e4876b509392cc65ad2445f0806339c6a1a356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511510, "uuid": "067dd186-83d9-4af1-ad0d-24a75fadd546", "comment": "Malware payload (Mirai)", "value": "5dfe63b71ec2954a97baf394f9349a635718a2fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511510, "uuid": "b0a6ca72-6aa9-4477-92ca-ad9688e13af8", "comment": "Malware payload (Mirai)", "value": "d2e63a7448156273d6fc1a34f6f8abbb9b6ef215f9f36c497b9ba190b33f71e07b60326f1dc246581625ff1c5a8b2e7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511510, "uuid": "5e363d90-9c25-499e-96e6-56b7d142431f", "value": "T101C33A0675A144FDC166C474877FA937EA31B85D13243B6F3784BA712E22E361F0AB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511510, "uuid": "6c95bf3c-f97d-44d8-bb52-6d74ee3e838b", "value": "1536:l9eX2E5LhbOPKhQKoh6AGPKba4t6364PUKtxn0a6ehMM1/B4CGXDzahG44NorFA9:l9NE5pOPKhi/GyjwkOSa4CGfahG458F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784511510, "uuid": "96608a8a-282f-48bb-b595-2df41663fbe9", "value": 120696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784511510, "uuid": "faa1c87e-2baf-4217-bfa9-2efb87f56d8f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511510, "uuid": "5135faa7-c25c-48d5-a372-787f9fd10479", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbacfc3b-8460-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784568749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784568749, "uuid": "edb80554-ee7e-46ae-83d8-19d18dc4b90f", "comment": "Malware payload", "value": "ec72117aa61ac2defc3ba93c92cddf81", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784568749, "uuid": "9fc8ae8e-b3ec-4fc3-b789-304e3a35775a", "comment": "Malware payload", "value": "4a8aba72d4f2a4778cab0dd3c85d9144a048007bdc267baebff02987afcb0019", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784568749, "uuid": "cfc76397-96ba-4887-8dc9-f566867fb6b6", "comment": "Malware payload", "value": "17858e796d655e10790c3d78d59deba606b4f204", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784568749, "uuid": "60ad1b54-e84f-4dd8-9e77-16c9a525300a", "comment": "Malware payload", "value": "00808d35195d75381ee39d605f98cf2f7b46c3df421bb3185cf9682b25688d3ff16024bdb98696ee0b3a0a83fe19ff42", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784568749, "uuid": "a9f7dd8a-2b54-4f03-bc1c-b0543b1727d0", "value": "T1A04382D4C17DCDEA27588EA3082412FCC07D4BC78A806E7EF49574CAE1F46A4A5646BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784568749, "uuid": "0fa30889-2e1d-42ae-b401-dbf91636af2f", "value": "1536:GvyHEl/EPsu3JqUTUyL3+4pUpUesWMVUTUyK3UpUdU+lqU/UeUxv0UTUZyghUxc/:G99Wsu3JqUTUyL3+4pUpUesWMVUTUyKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784568749, "uuid": "9fc124ec-97af-4cc6-a3c2-7e211e4488a6", "value": 59384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784568749, "uuid": "fa25fc5c-32fd-4c56-a1cc-6d981d111db0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784568749, "uuid": "e895d3ea-30fe-4e31-9d1c-d7c4ae8f6b3a", "value": "Productlist_202607020.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed427407-8441-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784555411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555411, "uuid": "ad823edb-3505-43f1-8946-0bdd36afbd18", "comment": "Malware payload", "value": "e7b5a1b874da8cad06cff9603e27a0d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555411, "uuid": "20d27e65-1dc4-4e0c-a281-2ceced333614", "comment": "Malware payload", "value": "4ad616e69c44ec02ab7f1a35de0bad65d5ceab158f3a7478e7a9b8cbcc8ed1ed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555411, "uuid": "f91af462-4ed2-442c-af07-e98e961d3d63", "comment": "Malware payload", "value": "452fd2b8f2cbb6e847b2cf9f468c725fc9bd0056", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555411, "uuid": "926676b6-976c-429a-a6ec-faa190cca041", "comment": "Malware payload", "value": "04f68da335c811daf4af6a97dbb9bf311337b0df94884b068edf91cda179c9166891501f9cf5b1cf06666940cd131dfc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555411, "uuid": "89bf7db6-a9b7-420d-9705-344f6924699f", "value": "T1F1D0A7E1F2F6164D7F7040656086C0A67FE8A21507D98CD0093C8A81EB1702400E8566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555411, "uuid": "e104dc9d-9e8d-445e-9ff1-3a55661dc5f0", "value": "6:yVWglOKF1KG0RQ7rwVw5HQWiFx8JKx8J8Gx8J4MyDBt:G5lOzWv6xFCYC6GC6M6Bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784555411, "uuid": "1591f660-33df-45f3-ba5a-70d42710d31a", "value": 230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784555411, "uuid": "3c1fc14b-1761-4edc-9e93-effe9c0301f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555411, "uuid": "0d684643-570f-4eb6-9a31-8e2a88a78be3", "value": "test.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d05805-844e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784560735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560735, "uuid": "8df76cd8-2d8f-428d-8b2b-94e06d82b5e7", "comment": "Malware payload", "value": "92d912a3434d265c479ea83999def656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560735, "uuid": "1c27bfeb-763b-4d34-b889-46f1d84a07bf", "comment": "Malware payload", "value": "4adf2ecf694884886667c15a1b86b5d937c35089a97afc585ad524660d85c1b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560735, "uuid": "64576575-dcaa-4f6e-8131-4ee8a07fde85", "comment": "Malware payload", "value": "9d4ebf011a4045a4e3c7c74f5427fc4724a2956b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560735, "uuid": "bf83a9e6-8b0d-4826-8531-bf588751ab0a", "comment": "Malware payload", "value": "5b526e83e499953ea36cd69eff64442075a8e217034f72597b1328042f47f36a19c0b43ed719d8f816f91de555170796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560735, "uuid": "bb8fdeec-3168-430d-a243-edbe0c23a3a6", "value": "T145154A497B9488B8E6B78539DE5A4012C5BB3D840F3A95DF0790339A8F37EC45E36B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560735, "uuid": "b74dfff9-167f-4002-b356-c9af6d5951a7", "value": "ef797a795f6d2e21538eb406839cbb8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560735, "uuid": "17873575-3936-43d4-b87c-14e52a640407", "value": "12288:ov5WvMivaIioO0lBs6sF/u7YVnKjZT4c/IzFJo0LcSPdz:jHjs65YVnKN8cARJpPdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784560735, "uuid": "0bb32537-3be7-4444-8f0b-f86058cf20d4", "value": 929584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784560735, "uuid": "f3ecf4cd-6b2a-454a-91d2-b5d4f1725cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560735, "uuid": "931baed5-bfdf-469e-bf24-2292dd969f70", "value": "77926.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b64de7-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574623, "uuid": "e4fde341-6765-4c11-8f8d-73ce326c3fda", "comment": "Malware payload (Mirai)", "value": "faaa40956086241a0554915eae823852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574623, "uuid": "aa1c6616-6a6b-48c6-aed1-4efee004aef6", "comment": "Malware payload (Mirai)", "value": "4b3db3eebbacffdc4b61271fc3b9e9c944b272c3a366e2a66a8de43e6f1ec2be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574623, "uuid": "e8f29625-a453-48f3-b559-6f7812bffa94", "comment": "Malware payload (Mirai)", "value": "da3cd493eec07bd4683a0e92f8970a2ba46cb3d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574623, "uuid": "502f5bf4-666c-45ae-9eca-d7ffef09d685", "comment": "Malware payload (Mirai)", "value": "71062f46586aa54afce59811b716eeb40a7e378cddb20550a572d1afc18affaab5c81a0da253d09681ad4cae445301f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574623, "uuid": "871aa8d1-aa87-4135-9f30-5be00dd7b61d", "value": "T12C631A01B7054F47E8A30DF0217B17E1D7AAFE9216A4F284720FBB9481B1DB37945EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574623, "uuid": "93f6f4e4-8700-4c08-a105-89c4449d1d45", "value": "1536:dvk6S95GW34oOsBBvDVL9t2RdA3cnGewm6DXFZR:to0W/vDf4Ajewm65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574623, "uuid": "5c26653b-6733-43ed-8c7e-eba75698c4b6", "value": 68564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574623, "uuid": "caa3eb1e-387b-428e-bf72-b4f1d09cdb2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574623, "uuid": "9d83de3c-636b-432c-aacc-8dc42de30b5b", "value": "nullnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c33b574-83d5-11f1-be1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784508728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508728, "uuid": "de2e9359-ffab-4e3f-9047-1d977e7a442a", "comment": "Malware payload (Efimer)", "value": "d22faac1e3af1c95d0dfb6b3565e95d2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508728, "uuid": "fb6d89a4-c1a9-4115-8284-e0812c5b7f0c", "comment": "Malware payload (Efimer)", "value": "4c2032f518894d18f9463850cd1159d2e8664079f8d2526f0a9b1470cbf3488c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508728, "uuid": "1e9054ea-de4a-49c4-a3b2-df4d30700f8f", "comment": "Malware payload (Efimer)", "value": "3e72fd76310c89053a3af411477dfa48319540dd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508728, "uuid": "618c09bf-5b72-488a-959d-2e7a8eb33149", "comment": "Malware payload (Efimer)", "value": "bc60d022dff1622fbe8e59cd688717633e1b265b7735ac2519e613232ed9b6d664e076eac98cf2063981cbc7a8364117", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508728, "uuid": "828aae46-d2c1-4752-8efa-6908a9b05f8e", "value": "T1CEE633156AE023DEFAA35039DFD18B94E469F8660BB1C5CF439885B07E133E68C3D616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508728, "uuid": "2612ef29-7b8d-403f-9acd-98d3091df133", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508728, "uuid": "f9dae448-840d-45ca-829a-729291dfdc91", "value": "393216:xnAdBBECaPy0iF7kzrW+XMCHWUjXCcuI3/PGTAI:xntCcUk++XMb8X/H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784508728, "uuid": "e9b7f27d-8d3d-4237-842e-95e731619574", "value": 14306213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784508728, "uuid": "a5acf8bb-4d4c-44fd-be1a-5ba23c9c74f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508728, "uuid": "8c5aa41c-9da0-4edc-89e5-56d726a1ec9e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51843874-8440-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784554720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784554720, "uuid": "3256740f-dfe4-4162-83ec-2fd3e2faa5e7", "comment": "Malware payload (Mirai)", "value": "dfa2d8e378e8e01e2f8203ce7300bf7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784554720, "uuid": "a47beb89-91ad-4af1-8950-eca47c2488f0", "comment": "Malware payload (Mirai)", "value": "4c6004ee13730aafe6af680f6781bcb18f5c290080076cad1cb184807db4e6ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784554720, "uuid": "3678a12d-0726-4976-b4e7-20a6f04b42fb", "comment": "Malware payload (Mirai)", "value": "53584409ee5dd548e11f5ea45218de61b421efa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784554720, "uuid": "75d13c45-87d7-4336-b930-49ea75688513", "comment": "Malware payload (Mirai)", "value": "1beee243da087ff2f4509ad2e882630ac0a0532cbcc90cdf930e1213a58f356f5aadf987baeacae89fe9d95259f03b5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784554720, "uuid": "5597fd4f-9d6a-4c18-ae3b-9dd81542931b", "value": "T17304E61E6E268F7DF679C73487F74E20975833C72AE1C545D1ACE9111E2028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784554720, "uuid": "ace330a5-c620-4571-be60-ce25cf345eb7", "value": "3072:QSSensR+OFiUI/4ENd9EqEykdno3aGjPkWiSJSAQLnbzYu:QSSew+OFq3T9EqElnaL/vc38u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784554720, "uuid": "3f8628fa-e28b-42bf-a00c-bb16e4c8b881", "value": 177744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784554720, "uuid": "a821c0b4-e6cf-493d-aa17-8523401b68b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784554720, "uuid": "639fce5d-716e-482f-adba-6b4759dfc34c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b9db84-8456-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784564144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564144, "uuid": "28384518-a4b3-4e1d-8940-541a0838fa4e", "comment": "Malware payload (AgentTesla)", "value": "a69c7333ced410800e65c89919486541", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564144, "uuid": "e002ec22-0b46-46c8-9800-5910c243b5c4", "comment": "Malware payload (AgentTesla)", "value": "4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564144, "uuid": "63f29c05-4604-4039-a2d9-243e8e189bf6", "comment": "Malware payload (AgentTesla)", "value": "9a883a02392bfd43d737a842bde2378a3be20892", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564144, "uuid": "7df2e8d3-7916-41d7-bf0c-88f095aa8d8d", "comment": "Malware payload (AgentTesla)", "value": "aa7d4f461e89c7de68f615a8bcd8ceb0f6e01d88cc51dfbfb221f765aa8de57b118c390a9aa4b30bc2ff5c98e8f24c0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564144, "uuid": "d00020cf-c29d-452e-b6b9-738fca9f1138", "value": "T11C25125877ABDE02C2B607B009F1E17043B51E49E433D24B0ED9ADDB3A62B968DD4B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564144, "uuid": "c76bec04-f39c-4a5a-b380-bf33c3dc4e45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564144, "uuid": "51424111-c9fb-4e88-9bc7-2bfc06e76481", "value": "24576:A1j/Og3ieBgi9UkzKyXuJX+QrY5Zl5Yv9CCGu7D/S3E:oPyeBgi99zKQArYV5EMo7D/S3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784564144, "uuid": "ff0d15e3-fa36-41ee-8c5f-55be71ceddc5", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784564144, "uuid": "4e3493f2-e35b-4f60-aae7-1a2a98a8fe55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564144, "uuid": "365f10eb-a2fd-4ad5-972f-836fc186a5e4", "value": "PAYMENT_COPY.PDF,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe190a9-8477-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784578548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578548, "uuid": "08986853-8953-4d35-be29-6daee46dbe79", "comment": "Malware payload", "value": "48d1382b30de604dfb758c4c40157352", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578548, "uuid": "f948ffd4-22f6-4823-b982-7d515ecd97ba", "comment": "Malware payload", "value": "4dc8b56b03e7c8cf3b12bf57c07e0bb9a61ecd18615ed60e2f0124ad9b4e9061", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578548, "uuid": "6e0e8536-0704-46aa-9936-828b17f6a683", "comment": "Malware payload", "value": "0da31900db4a691d9c42b1f0500efb61332ea336", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578548, "uuid": "bd4b97ef-3d4f-49f4-bc7b-677411721d8c", "comment": "Malware payload", "value": "c4df3a3bdaec8d7d3a3421bf6cce2cd974d6bf9f1b6dd5ebc61d3de2d2b2b2ddcb042a4b04605c45740de76eea532594", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784578548, "uuid": "f93dd794-09cc-42fc-bc2d-b54cac2839bb", "value": "T1BA825B0FB9424726C0E110B49675877BDAB9A872338454DBF7D08AAD0B682D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784578548, "uuid": "cfe77c6e-55ad-47d7-9c1c-8d6ac61160d4", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784578548, "uuid": "6e426475-80f4-44b1-912a-cfaaa1b25f5e", "value": "384:fIqQlV6lYR60LZu94gNTc9Qav8U9c2XF:7p049ta0UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784578548, "uuid": "39039afe-9585-442b-bb4c-9afa2894509b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784578548, "uuid": "252abd0c-b42e-4ebe-81f2-5a69b1845060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784578548, "uuid": "4de592f1-4bc4-497c-b1af-509ab868d4ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f9c694-83d2-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784507691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507691, "uuid": "edc0a4c8-3861-4bc4-a21f-5ade2a9d2185", "comment": "Malware payload (Mirai)", "value": "889ec695feeae43ccd91b66a544734e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507691, "uuid": "18f1b8cf-dae1-4a2d-a838-32286c89dcb1", "comment": "Malware payload (Mirai)", "value": "517164c29c0e178b1bb4613d3d5ceb552329c9596791624d8277f2dc5ba37c50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507691, "uuid": "0813c944-f80a-4280-96d0-c88c508d38ea", "comment": "Malware payload (Mirai)", "value": "1ae5a73fc8778fde5f283b0c2ba3ace213415dc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507691, "uuid": "999f8518-309e-48ba-a1ee-74760d82415c", "comment": "Malware payload (Mirai)", "value": "2098e2e1938bfe3bba16eb130fa32e7a03e3e6540d2b0ae95973834c58fe1faee9834b23a6d707be0eaa2d44d9841b75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507691, "uuid": "b9a20072-57f4-4482-a355-5781c0fee74f", "value": "T15C144B46EA418A13C0D727B9B69F524A33339764D3DB33069D18AFB43F8679E0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507691, "uuid": "83ab28b0-908d-45fe-a1b3-74559fd37ad7", "value": "6144:FMOTrLD1PYH5hJaeXHJMGrjtEKbCMblbIjOAM/9GH7:FMOXH1PeXJaqHJMGrjtZNN/5/kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784507691, "uuid": "2db6568b-b408-4dc6-aebc-9cac76fc55f4", "value": 196992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784507691, "uuid": "1e8211bd-71bc-401f-8ae5-cce728e57703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507691, "uuid": "a53b083a-7d22-43ea-aff0-9adbdfa36242", "value": "ohshit.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595a6e3b-8408-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784530681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530681, "uuid": "bea4c9b8-8819-4e5c-a73f-4cfd5e4abbe4", "comment": "Malware payload", "value": "393c5d266b8545f19c4c7ec4f697cddd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530681, "uuid": "d4b10e3d-92f8-4552-b5b4-bc102c040182", "comment": "Malware payload", "value": "538d4d719d79f21c1322441a350e641d0995068b7d015c6e61d2f23d7cd588fa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530681, "uuid": "e729ac8e-69bd-4681-9d11-422b45d65d8a", "comment": "Malware payload", "value": "c3a17523ad711f3f15461c4dcf8d682c391da226", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530681, "uuid": "a49111ae-fc82-4f1f-a11d-d5bb991feb24", "comment": "Malware payload", "value": "499ac645c60aee6e88556002bae08c08a5e42388ae0a00984f0ac5ddd5a84b7e0a0943a92eeeb7fe84009a0fcc5f5bda", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530681, "uuid": "e5dcbae9-9afc-4040-901e-4aa2e77552aa", "value": "T10101AFC6D1509910502A981E66D662E0B831C3C7599B0F797F9C902DFBACA14B066F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530681, "uuid": "ace46632-3044-45ec-a86a-45664b33fb4b", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkasjCBf8CZ+UFC2XjoXC09xIRqCmCM3N3aa:kXCKysE2hi0ziQvZohawvOFVQ19jhvx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530681, "uuid": "ce6183b6-103b-4072-b260-f4dd10d154fe", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530681, "uuid": "0d55c76b-d2ce-41d0-bb3e-09aa13bc9474", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530681, "uuid": "4dfc1bd1-baeb-45d9-a757-71305bfdce39", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467e17b2-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784525066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525066, "uuid": "39e84aa0-e5a4-49e6-8611-d0f3e47793d1", "comment": "Malware payload (Mirai)", "value": "d4bee0e4fbbb5774d4901473a1eaec48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525066, "uuid": "49e509c8-a8da-4bb4-8585-d3043afcaa58", "comment": "Malware payload (Mirai)", "value": "53b03f5aa65b7754986b176850e028f22169ef27affffa171c1a9841fdec1a76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525066, "uuid": "70d89b53-cef4-42fa-a0b4-0d88256acd6f", "comment": "Malware payload (Mirai)", "value": "1e8307dd1d11243c77dda7388ac99a7c772fda04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525066, "uuid": "e5ced7ca-481d-4e1b-94a1-57c0005706b3", "comment": "Malware payload (Mirai)", "value": "820d754cbc5cba66d383b407d91527de5e5a9c49b30f4086c98fce1d931dec899d3f83d6c7fd89b37b78c17303da074d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525066, "uuid": "c0d81d66-8d78-4082-ad74-0d94b74c5b93", "value": "T136C3D746BD418F13C5C321F7FBDE42983B166B6DD6FA72029925BFA037864D60E3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525066, "uuid": "fb2ae355-fa2d-4c6b-b044-8e9fa46142fd", "value": "1536:RUkd4HBrGKAQ8pL4Voet7POciZtcq1HXPjVUqjqqpXl1pCwywwKQzLrBE3UlUOGQ:IhrGK44ftTOcoXyquenUL2e+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525066, "uuid": "667a3030-d48e-45e1-b4ab-6bb21b296bc0", "value": 129348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525066, "uuid": "d45be1c3-4b03-4274-9865-ae5444a52c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525066, "uuid": "ca7adc54-333f-4ad2-b77a-6b18e6e575b1", "value": "eclipse.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e066811d-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574717, "uuid": "a15b3401-2603-4dd1-895f-cce0d58d3c55", "comment": "Malware payload (Mirai)", "value": "4c99c589001bed553523bd56c9d604b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574717, "uuid": "f96d6b64-b0f4-45ae-9f9d-3e99dfedf393", "comment": "Malware payload (Mirai)", "value": "53f741e54d11c319bcf5a268a5325208ec99cd2706c1932f9f6e3193044f871a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574717, "uuid": "dd43d510-50ec-4c6c-b202-2768ed54a490", "comment": "Malware payload (Mirai)", "value": "5a9cbaf66b252ec3987027dd1851d9ea097bd5cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574717, "uuid": "896a747c-eb92-432b-9f6e-4b829a876de6", "comment": "Malware payload (Mirai)", "value": "48dc294d38b32a89309f909fa86288872226797da7184aa03b3a31770213818b2326cb3f6af135547bb7894cda8d5b35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574717, "uuid": "b6c2801a-7b88-401d-9a97-5f7f76bfa62d", "value": "T155B36CC4F687C0F9E80744718036B33FC73295298025CAAADF6AAE76DE67641D61A31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574717, "uuid": "b73a93c3-8456-4db4-836d-de1ddbd841dc", "value": "1536:WKIE20iBxucPpn5F8h0jAO04kKBc4RWs8S0Ss67tXoozIabsp6688:nIoUPBqEAd4TqdfSt7tXbon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574717, "uuid": "62b57ded-d458-4eac-8e71-3851acf30e36", "value": 117136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574717, "uuid": "93df8678-812f-4a1e-ac6f-d49a1b079a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574717, "uuid": "4cbb4761-1034-47a9-83ff-2f5a33da9889", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fa0d79-83f6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784523129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784523129, "uuid": "848777f0-dbcd-43ac-899a-5a64cfb6a14b", "comment": "Malware payload (Efimer)", "value": "d3a3fa596761bffaf8cf7f72f184edcb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784523129, "uuid": "866f7ad9-4bbc-480a-8bd2-14045131335b", "comment": "Malware payload (Efimer)", "value": "54cb86f9c1832999fcb4fb78bc5254c69de12cae15c60934b798858e1b27b934", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784523129, "uuid": "2cbfa5e7-f7b7-428e-b388-9f2b9c89c841", "comment": "Malware payload (Efimer)", "value": "acdee7aaa670090813341c8cda7619438070d785", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784523129, "uuid": "b211ccf8-6508-441e-84cf-2aacbacbd4b5", "comment": "Malware payload (Efimer)", "value": "7d40d0b5ac29a74aabba1fe8d4ccf9d8e289d992856284279e2b7a623ab2d1c4654e0b17170334ece020fc048af8cfde", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784523129, "uuid": "2f77db7a-cfe7-4acc-ae7a-6b00a4cceae0", "value": "T123E633587EE052ECE9A3013DBAE25549F4B6B4550732C9CFD7A853B1AE1B1E0893E313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784523129, "uuid": "98d5c150-0fe8-4bd5-8aff-32570f3e901c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784523129, "uuid": "f5dd9ac5-0e27-41a3-b74b-7663cbedeed1", "value": "393216:aHTlBP/o0xMV0gIYdRUXMCHWUjXdcuI3/PGTAI:aHRB40xMV0cbUXMb8XqH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784523129, "uuid": "62c2f45d-f929-4094-be94-0c8da361cc8e", "value": 14320964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784523129, "uuid": "bccff2cd-ec82-4289-b028-b773074bc2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784523129, "uuid": "58f3e05d-9fcb-4eff-b981-167dca7d6d2f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db6013b-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784533319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533319, "uuid": "b6c14a1b-bd1c-49e3-9cb7-22f214a70241", "comment": "Malware payload", "value": "3face6d278c2cbbf59609dff9369ae60", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533319, "uuid": "76c3362f-4ae4-4e77-9d9e-d3c4251da5e0", "comment": "Malware payload", "value": "5536a19bde30a18d139ed46e941dbfd6749ab9fefcec1c369091211619d3cc56", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533319, "uuid": "1110ad8e-1d46-486f-88aa-f6ce33e73e68", "comment": "Malware payload", "value": "60ac0327630e77d2edfc9fdf685383f89a4208c3", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533319, "uuid": "1a36710c-8bfb-4e9c-820a-71f522927024", "comment": "Malware payload", "value": "446185d92a3bcbf5835599fe7b3429dfb3a663e5bfc8daaedccfb6405ef5cc934fe0bb9b03f2b36b607b764754ab32ee", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533319, "uuid": "d0dec132-15b6-491f-89f6-bc9032df29f0", "value": "T1006196143B8CE5E1B6DD8D1992CB986610B1095A7FD08DB843726EC11C96C2473DBDFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533319, "uuid": "9bb37198-be69-408f-8b0b-50b5af3c1039", "value": "96:eE6FYNbbRuBciexto6MfUkKlBFdK5dlMz8tm:uFSsBcLxO6MfkjdKnS84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533319, "uuid": "6b45536c-9402-49ad-87f4-b76dd7f63311", "value": 3256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533319, "uuid": "671b1f3e-7e4b-40f2-87b4-eb47bbdd3a91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533319, "uuid": "cfdfec13-fb3e-44f0-836a-b2580a0465f9", "value": "ST260016_RO_Comanda_MIRAGE_IMEX.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d9ddc3-846c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784573785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573785, "uuid": "8254bfc3-3cd6-450f-9f6c-89000fd4a1a2", "comment": "Malware payload", "value": "de98d1c0bb0c805243295c656482856b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573785, "uuid": "995f5b12-5cab-4f5f-84df-44acd96f1946", "comment": "Malware payload", "value": "55f8ba7d85308010fb561e91034011e62b57571aa3c185e2e79959d0e8a8cbba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573785, "uuid": "5fdd47ff-d9f8-40e3-9003-968adddbdcf8", "comment": "Malware payload", "value": "ae07709d867698a8d8c1e22c4edf3eb6f46313fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573785, "uuid": "1147e6bc-06c8-44e7-9247-f913467d2823", "comment": "Malware payload", "value": "329c4ebc6ff149123e2d82969120155e70218d1abb894c1123eece0c17ccc5d3e4d9507c1af29462486c6faf117d5209", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573785, "uuid": "f4f35a45-9d34-4056-bfb4-922ca91305ae", "value": "T120C27D956A867C44BEC98A3E4CBD2B0D6DF5C3D1324952AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573785, "uuid": "3ee74445-f40b-4891-b13e-c31c3b3efe3b", "value": "768:Q8vCB+25j6es8RP9FYpMSUpi+20qUpi+20YQX:Q8l25JZd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784573785, "uuid": "268b3b7a-c238-4f3c-9ded-f6027b6d00d9", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784573785, "uuid": "ee59cac5-7cf4-4f2d-a0fe-8a12f58fce31", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573785, "uuid": "848f958d-9624-46e5-9c69-c39426dce015", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932123c1-8429-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784544952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544952, "uuid": "fc4630c1-a041-42d3-92c2-c0679c1c3f8b", "comment": "Malware payload", "value": "9154eac061d3540a7bf8951cde63cf0c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544952, "uuid": "69d8f30a-8fec-4d36-a088-67d53d5e03df", "comment": "Malware payload", "value": "566cc087706f3d3a0e49b9a1d9c8e27090211d80a069162de2e5e8a5b8847414", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544952, "uuid": "e246ee4a-4711-4228-946f-5122307d25af", "comment": "Malware payload", "value": "d33d5c2beb8164849b19c230f113e13a4a55310f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544952, "uuid": "9e448a87-4f4a-44b7-8d68-75fb5e91c596", "comment": "Malware payload", "value": "0b4d4bffd007553e62f70849a8b6cde2fbf5d13e7a9dfbd5993b31a4aecb6b7f764a4ca7016511e4da48eaacbbf18f0f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544952, "uuid": "6d82d112-33a7-4867-aaf5-70b9af048c12", "value": "T19D61CC603781B0320E253AED54CF6616FCB959740A0DFDDA53E4EE2CAE52B988D8D18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544952, "uuid": "7f82cf19-e65b-410b-bcf4-5e45480644b6", "value": "96:pdR2r+fJNiQe1zp2j+55+pz2kMifU8M3FDGNV+3o3rB:pf2r2sQeFMgR5YH+3o3rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784544952, "uuid": "92cffc97-fdcc-4533-a862-bde15bebccac", "value": 3281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784544952, "uuid": "1eef6bff-8642-413c-aed4-e8fbaf555fd7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544952, "uuid": "49974a4c-b8eb-443d-b7d1-6ee63b1a2df4", "value": "Manual_On_Preventing_Deanonymization_And_Traffic_Interception_DKIB_2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c315a633-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509384, "uuid": "9431411c-2295-4919-8f73-6b4526ff7558", "comment": "Malware payload (Mirai)", "value": "cf51047fc939b81fe5ac742406f0524e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509384, "uuid": "6e1f04bb-63ca-4319-9749-a803fe29fb91", "comment": "Malware payload (Mirai)", "value": "566ee3dfd8bee695f40e780f990946df38180dd286d3ef98123b310cc9fe80c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509384, "uuid": "69695ae9-7468-41c6-bf9a-6839ed051756", "comment": "Malware payload (Mirai)", "value": "975b640fdef030add7ae86ef78a9eb18e61e42f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509384, "uuid": "96e144b8-c7a5-4ea1-9024-529a3585717d", "comment": "Malware payload (Mirai)", "value": "78dac094bb637a94acc49809a0a8823c5bc47fe66f816ac01133c7d7ba43f9d442ced61022a4cbe31b7e439c4eb6c4d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509384, "uuid": "6c014676-12a1-4544-90ce-fcc0d52f1fd2", "value": "T1DE935B22B539193BC4E4953722F35326F1F6438A14A88B1E7E720E8EBF256D036477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509384, "uuid": "4618e07c-d5ef-435c-8667-fd4bb949f205", "value": "1536:0sRsLVu48xrIz6YqPog6N8HGdtAQkYm5V4A1Ywt1cx:0kqLMPmdi1YOyWcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509384, "uuid": "5c959186-f061-4cf7-aeed-4a780c22b634", "value": 91960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509384, "uuid": "c9c94335-9f84-4e02-a146-369962afe2a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509384, "uuid": "e6b539ab-7f9b-497e-ae66-1425541a24e3", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54eec31b-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784533251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533251, "uuid": "ed4fbb63-f5c5-4289-a11d-b8eed3d4acc9", "comment": "Malware payload (PhantomStealer)", "value": "71671cc89b18c6a86faed3349bf84d16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533251, "uuid": "7463ffb9-7919-4c1b-b4df-99f0c7d9a1bf", "comment": "Malware payload (PhantomStealer)", "value": "575892f6d1711a7722609b01135a9f7f175f8aaa23af1d60e3bedc273df0b129", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533251, "uuid": "d328bcfe-ad5e-4206-9f39-4e951cfd966e", "comment": "Malware payload (PhantomStealer)", "value": "857868536d694e73af918b5456f805b95406a94d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533251, "uuid": "7d6f53c3-2981-404b-94cb-466ebdc42ad4", "comment": "Malware payload (PhantomStealer)", "value": "8ec8930c1fb7208fa96166c729ac31f3c50ad46e5c78afdd953d23a1906121b16a1be05aef8788f80efd1663363e2a5c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533251, "uuid": "ad48e42a-d933-441e-8923-9578e5cc948f", "value": "T17CF63FEB32519595DC79370DB594FCB0026DFC31AA5A636CB6A20B0502A7FAB5C33363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533251, "uuid": "8607b96f-3cd6-4d8d-a1fb-d5f14c13aa1a", "value": "768:5CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCX:P6hlHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533251, "uuid": "ae952362-5cae-479e-a7c8-8be627e2485f", "value": 16402062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533251, "uuid": "2aaf66e2-37af-4097-a8e7-473854e88910", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533251, "uuid": "a42d574b-da5e-4a44-a150-56f705daed46", "value": "Fedex70705345437_Doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c63ad07-8465-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784570522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784570522, "uuid": "2ac696ce-6cd7-43f3-8986-d3f4c7dd8297", "comment": "Malware payload (Mirai)", "value": "fd35f4743ea9aeb1c17dcf735a91afa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784570522, "uuid": "ee25c4ab-ea2a-4e07-b30f-d0f8f6c3ce6f", "comment": "Malware payload (Mirai)", "value": "57ccfd5d7bc8a410e190e78c63b4b92e561f43219a104226c6a706585763a6e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784570522, "uuid": "35118ded-6d1e-402c-a519-6dadbeda81be", "comment": "Malware payload (Mirai)", "value": "108423f70b7cc4b1fa97ca37cae73ddec955bfe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784570522, "uuid": "f4b4f3be-8fd5-48c9-8f3d-c5d0f1137b29", "comment": "Malware payload (Mirai)", "value": "5977406edbea9318a82f137c509efedfdc41ae499050b3cdb445fe0d6e3d6679a634cc2fd0cd4446ba77a0199d5c2935", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784570522, "uuid": "682cde13-1bdf-4cf3-b4dc-ffc16335ab3e", "value": "T13093F759F8819F11D5D511BEFA0F429D33234BACE3EF7212AD249B2527CA92B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784570522, "uuid": "c6fbd371-608b-49d4-bb42-9860b739fd5b", "value": "1536:CBnxsEdnmjKMchcZVMwn10YoaTw+2C0WyIp+9lIeisIkQpaNMILZorYHmfMn5ZLD:nENaKMco2wKYoaTw+2C0WyyMIkQpaNMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784570522, "uuid": "8e6b5d0a-a75e-4439-8af5-f5e1bba438de", "value": 95568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784570522, "uuid": "46966128-d059-4af4-a0d4-ec52f077596a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784570522, "uuid": "1f06bb72-050a-4305-ac88-7547660c7228", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96abc48d-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784534220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534220, "uuid": "c698c971-77e1-43b6-8c5d-490be9679621", "comment": "Malware payload (AgentTesla)", "value": "10cc531b5f4765f53cd3a58a2c23ffcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534220, "uuid": "5d324788-fe24-47b1-abba-bdf7e6d828f4", "comment": "Malware payload (AgentTesla)", "value": "58328b7f4fecb0407da1947937b41162e23a61559d6f49526ec1683febad6ddc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534220, "uuid": "ca4fbb79-d9a7-4903-8b11-2a65941be868", "comment": "Malware payload (AgentTesla)", "value": "1c89e143465d44f7d3fa6561436624b6990027fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534220, "uuid": "8652e44b-7503-4ec7-9e25-c0b57d3f4fc7", "comment": "Malware payload (AgentTesla)", "value": "a57d9016c63f166753c743d980e65aaa899fe28365bf442ff57dfab54e5d350a7662e8f99c708c646fcfa864357e781c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534220, "uuid": "9267126e-525a-4342-97e1-e382f22a63cd", "value": "T1C684F1392FACD616DD710F349CE9E724866CADE55CA18F8BB304391A7E31BC09C49726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534220, "uuid": "1b9041de-1c99-4096-99f4-14c3b28f3746", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534220, "uuid": "53aa6ed1-818a-4de2-9b20-f33fc4a72053", "value": "6144:hT4DtYa/h305o9fgqMUuBQWYmETquN1TjKq/oQxHC2AHt9qJFRHMJvFGuzv:hT+Vso4DUoQFmETbNFjKqlMHt9y2tGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534220, "uuid": "0540c395-99b0-4630-870d-bf64ca8dcc16", "value": 375464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534220, "uuid": "dca0f97e-aecc-416b-b7f9-f1efe9f59c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534220, "uuid": "5098fa76-7554-4367-ba15-33e74da9edcb", "value": "Fcast0987654.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66836bae-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784531133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531133, "uuid": "cb179e80-fac3-4b61-970e-08b0b9d073a3", "comment": "Malware payload (AgentTesla)", "value": "28430e024d6a2f185f1112c3bf2451ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531133, "uuid": "a9d4d2a7-2fca-4eca-b885-02109a83f9dc", "comment": "Malware payload (AgentTesla)", "value": "5a6a1c65ca83112adc7dd78908ba68722d80de3d53924877039bd9c88099dab1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531133, "uuid": "45cf602e-498b-4a3c-b77d-e78407b8a846", "comment": "Malware payload (AgentTesla)", "value": "edeced604b626af1472478d189dfce42b3894585", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531133, "uuid": "84ef9d30-6f48-4677-99da-92f86945f8b9", "comment": "Malware payload (AgentTesla)", "value": "5901a6c66c34ff2badffb1e45b65f4260158fd4bb247c4f34e1c3a9b221166ca86248c9e505a85c784004f42e3217e35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531133, "uuid": "37994014-38eb-42f7-a850-e15a0b8bfdd1", "value": "T11EF506859351A2337320E3AC2535DE38A48F688725D9CF14B46DD728751CD8BA7A8BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531133, "uuid": "b9101ace-70dc-4710-80de-e14348b4ed81", "value": "98304:jf9JhHAMvMxEjy3fottXeStdi9OVoQ91lGbVChFlAGzliLLS:ZXHA1iesdi8V11nFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531133, "uuid": "8c5def78-af20-4c83-bc16-181696651eeb", "value": 3592961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531133, "uuid": "c2332ba5-9427-4398-9e38-6bd486552757", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531133, "uuid": "90f0f23f-b2bc-49ff-b66c-75e1196123da", "value": "Info_New_Order_7132026 _PDF.shtml(~99 KB).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39ca6a3-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574641, "uuid": "eeccb4df-923d-42ac-ba0c-cc5320a2cc48", "comment": "Malware payload (Mirai)", "value": "9ff8187df386f290836783f57fb666b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574641, "uuid": "305aafa0-5b57-4afd-962d-2c03e78bf37b", "comment": "Malware payload (Mirai)", "value": "5c06f7d67534daddea70dd369085933025571ed01df11cea9d782565532ec9be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574641, "uuid": "92473d06-df73-464c-8b90-8249c4de3ec9", "comment": "Malware payload (Mirai)", "value": "b7aca9c29ec4d2da3fe694dee8329d50ea8faa6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574641, "uuid": "c2c20b6c-1198-4068-bb76-97217fa1aa46", "comment": "Malware payload (Mirai)", "value": "63dd47a6df148365c2247fa0415826dc38c4180331c279e4f1fc054340cdb3310cb1259eb803c118d9cd42b0345079e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574641, "uuid": "80ec6bf9-6fec-48b8-bfe3-a6e71d5b6f2d", "value": "T1DD73F784B942DA17C3C143BBFA5F028D3715BBD8E2DE3253DC256F9433CA99A0D1A256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574641, "uuid": "4a78e5ac-7d12-48b2-b4a7-800f7b062df4", "value": "1536:mXyTSsN6sE8KMTovQuVymk7UyvVEAYt5h0hZJ+8iWr:mX8SsN6sEaT0B7y9E/t5hkJ+2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574641, "uuid": "3a3eaeee-926f-438a-80df-fdc501dab6c4", "value": 76632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574641, "uuid": "18987da8-7251-45ee-861c-99894f329165", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574641, "uuid": "5e93f97a-89bc-4cdb-92f5-0f496ed71f88", "value": "nullnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48386028-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784525069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525069, "uuid": "d37d2b0d-917a-46d5-9505-fa3868877310", "comment": "Malware payload", "value": "87cbffb086fa04dabadc1228b22078d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525069, "uuid": "aaf58457-35f0-48ba-9d14-660c3e291b49", "comment": "Malware payload", "value": "5c186c6ba004aa987bf39e80db91aaf51ccb71341d965b54df36e5963443d6f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525069, "uuid": "69bc5c2b-751e-45d5-b4d0-136c1c50c6ae", "comment": "Malware payload", "value": "0e86bfb12112d83f1c8be526954a1f147598e874", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525069, "uuid": "9a945e33-6ea8-457d-801a-ea3515e05514", "comment": "Malware payload", "value": "103ad4aeb6392c8c28b8ac98fd1b70295c657a9f284f3ce2cbe7895f648975f6866f50e3a9d675d02f54ac4f8ea34792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525069, "uuid": "7126ae11-aadf-49df-9fc7-7e15ae7377d8", "value": "T1EF14C506BF519EF7C86FDD7306F58A0124CCF46725643B3A3274DA6CB91A58B09D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525069, "uuid": "c81d60ac-4c28-45d9-b906-f3ca6408201d", "value": "1536:bnMbNlx75OYVJYYQqMCKMbaf8/fV0yIde2YPt4dgTPjZK286OD6J+MbkfDR4z/Ej:bMbvxpVJYtil2dgTb++gbDRa/na5Eid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525069, "uuid": "82c1d212-5985-4f91-9d7d-f1d3ec4a8689", "value": 198844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525069, "uuid": "02cdfced-31b5-43e0-9770-dc59cfc52c0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525069, "uuid": "ae74532d-f26c-4166-93a7-dbb34f1a87ac", "value": "eclipse.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f53806-83dd-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784512118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512118, "uuid": "a424e853-f993-4404-9f6f-ae0aea2d3741", "comment": "Malware payload (Mirai)", "value": "dd37896c6c6607c70ec4180d5a123b8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512118, "uuid": "8c71315f-e6e1-4dbd-8bcf-8d2085a52441", "comment": "Malware payload (Mirai)", "value": "5c299c0278faf2fb51febdde019a7f24ea147e6c968b688cb05f7cef4d4f76a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512118, "uuid": "11e1bb24-a334-4352-83ef-8ebf0e874c4f", "comment": "Malware payload (Mirai)", "value": "863b72acaacdf74ab347a843011195a3a3c85802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512118, "uuid": "e0d9f9db-f183-468e-bc04-e3fa1839e513", "comment": "Malware payload (Mirai)", "value": "b0fbd0118324843a5b81882633b2754ce7c2cb3313e0e331a9a83e875b465d95f492f50ed47262cddadb930767a186ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512118, "uuid": "3fca37b9-5035-4ce3-b50a-28189a1c497e", "value": "T1CEB33A56F8819B61C5C712BEFA1E618E33131778E3DE32129D185F21778B5AB0EBB601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512118, "uuid": "7ce9393d-c5e4-41f1-bad3-2ae026d99f7e", "value": "3072:0trGt2EYUAe8vLWyA2C6NzaDunZhdi3ZtjKGluetn:0trZHS8vLWJ2C6ta2nqZtzlue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784512118, "uuid": "c61529f8-b71f-47dc-86b2-e4eaf7edf175", "value": 116188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784512118, "uuid": "cc9a8724-5a05-4e58-a824-9a5c98fbf6a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512118, "uuid": "520d964f-a630-417b-82a7-b8060eaa9989", "value": "ohshit.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca764998-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509396, "uuid": "09c79886-ce66-46c0-8021-5d191ab19637", "comment": "Malware payload (Mirai)", "value": "a6ccb4e86a1f4dd484f31a5833c99646", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509396, "uuid": "dcd0dba0-b2eb-41aa-b4d8-b56a8e974268", "comment": "Malware payload (Mirai)", "value": "5d06e47b6a89d9069c501df5dda25f82d7cd21819ca10a6f16d562ed9053e3e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509396, "uuid": "af4adf5f-58f0-4a80-a3b2-7b597a1ea8d0", "comment": "Malware payload (Mirai)", "value": "f2d486505932447e8b0ffd07809eda7d74b929aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509396, "uuid": "5d7364eb-b0b2-4e6c-87b7-594e82da5667", "comment": "Malware payload (Mirai)", "value": "8d6fbbcab61aabefed13f0504268b1fb875c542f13387e990a6faebec98f5542056ff6db69169bacda20a0f7ca1e73eb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509396, "uuid": "db124178-68c1-4018-8662-0f5cb22ff94d", "value": "T1415110C6126207722E529D23BBEB8D2971C0A0DE689BDF66A9DCBCF5518CD083C4D647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509396, "uuid": "369e6adc-537f-418a-b41f-84b6892660e1", "value": "24:It6sYUIhOEh33A9PsaSTrTGF7JvVGAALoRNINksWrCj1TlyUmy7J:i7vEh3waaSTrTGFlTALLJWre1TlVPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509396, "uuid": "0a32926a-426f-4185-86cf-078f3387e1a2", "value": 2729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509396, "uuid": "cbbd9c1d-e416-4187-8abb-20f5cf460156", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509396, "uuid": "44bb6dc3-a7e7-41ad-8ee4-71a2f3af6fc4", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7765d596-83cf-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784506250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506250, "uuid": "46efe033-345f-4201-b787-ca4806911272", "comment": "Malware payload (Mirai)", "value": "797db5498c12ca9b73a72af53567fb8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506250, "uuid": "a8beee6f-e60a-4963-b5b6-be77af1bfff3", "comment": "Malware payload (Mirai)", "value": "5e3c607ce72d51263e201321cc76e30c8c027feeab35a10d1f1ca70f60f1e671", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506250, "uuid": "6812d03e-710d-4e3e-80f8-92b647d2738f", "comment": "Malware payload (Mirai)", "value": "ec21f7a49c3d1a11250f241d9aba9b1d23ae32b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506250, "uuid": "b92f63a1-1bef-4abc-a7ed-a2f465555b2f", "comment": "Malware payload (Mirai)", "value": "68da327bef9395eb18b9acae632636c0ec2c492ae38f84ae614ede1be2b32c283c048a79b5f2fc0b7796348bf23a38ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506250, "uuid": "0f17583f-920b-4475-889a-bcac587560e7", "value": "T12EB37DC6FA43D4F0E8560AB1113BB7264B71F93145F9EF86DBA52C329D23A009A1B75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506250, "uuid": "827c4a90-c62f-42f5-90aa-d89c05b5bbb0", "value": "1536:LuYxTD/l1yCTBUiGe2PcXdz1RM7ePS6qxdtnZW9IQcJh2ORsgizMHrigMG:iOfyC1UfPc9/M7cS6U/ZWyNhlagmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784506250, "uuid": "546e0250-60ff-4ae0-837f-de0affb3f194", "value": 111728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784506250, "uuid": "80618f08-a674-4f00-88e2-2099f33e2d77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506250, "uuid": "cc39c96c-4954-42a1-ad25-51d899cb44cf", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c781dd-8442-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784555687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555687, "uuid": "5c4a91c7-746c-4e75-ba18-1239ef566cf7", "comment": "Malware payload (MassLogger)", "value": "520b652b9f629a1b6065c94f19ea792e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555687, "uuid": "16b837f6-1a68-40eb-b0f3-1970be6c62bb", "comment": "Malware payload (MassLogger)", "value": "5eb4973ce58ca8d691309fe57959dfb2f43d9f9cb4e094b23b6aa0ff173bb12a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555687, "uuid": "cdcbec6a-36af-45f7-a6e0-b8a017123068", "comment": "Malware payload (MassLogger)", "value": "0f127991dc86f591985e92aaf54ccc80b9084c0d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555687, "uuid": "86473ca9-3687-4a04-a26c-3045f258a68d", "comment": "Malware payload (MassLogger)", "value": "ed0828e7394a9f3ed76d73892fba08de4377e249adb9a53407d7e76fc6ad9bc6a8c31ea01815796d48cb655f1ca85041", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555687, "uuid": "aea25b83-4ad3-4e2f-b3c9-feadb6fb7365", "value": "T106C51343D6B0CEB5928C0698E91ED6D9DB60B2317FB59C2B341543BEDBC454423A8BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555687, "uuid": "c70580a4-4fee-4851-bad5-1e4efeb92199", "value": "384:oA9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9r:IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784555687, "uuid": "bc0e12db-1ba0-4bcd-a119-545aab1d04f9", "value": 2591256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784555687, "uuid": "f6bbdb92-12d7-4f6a-9ca8-98b450a10d6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555687, "uuid": "e71c5900-ee88-4d12-a2f5-1d2aa20be14a", "value": "mob44532190.pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b0b0bf-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509387, "uuid": "90156b07-5c2e-4f4f-901e-2a1a3d44c6f9", "comment": "Malware payload (Mirai)", "value": "73feacb286b5ddf597a87a713655ee38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509387, "uuid": "cb42ab1d-29d6-47af-803a-d899ac0a58a0", "comment": "Malware payload (Mirai)", "value": "5f6cc8466655754cb6753127743d2f07d5201f1d6c0e0eb1db12c5696e4d9773", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509387, "uuid": "77be4ae8-b60c-4ba5-8377-58269d6513dc", "comment": "Malware payload (Mirai)", "value": "8109c221f73b43484a708bcea5654f852a00a0dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509387, "uuid": "a15c9177-8241-47c6-93d1-2eb65b5abe72", "comment": "Malware payload (Mirai)", "value": "0ab514cf7fe3264207d6d66380f23967f93c28f449d91c4110f991a155069d9d6aad86e038b12f95b142421be44e331d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509387, "uuid": "d008fc64-154b-4a00-a512-8f0d367f0190", "value": "T1DD63017EF707989874747E76F8D6EA0A15F40DB5CEAF2AA682142E306FD3D815030362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509387, "uuid": "72b67d91-75bc-45e9-a6fc-748221e2a8bf", "value": "1536:VU3Bp2NvAdO9spSBKC5pOJzYgLR4SraHLG8gZNt:VUKNodhMBKCkLRLraHLG8wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509387, "uuid": "258d8d28-9dd7-4915-b3d2-7628233226f2", "value": 67412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509387, "uuid": "faa387ba-9b30-44ff-a531-f990282109be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509387, "uuid": "84ef27dc-49d7-4800-ac42-f4ce1966f573", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2481dc0-83de-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784512765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512765, "uuid": "7b84e13a-0ebb-44da-8dca-495846ae5a2d", "comment": "Malware payload (Mirai)", "value": "51a2ed663fe6309f4903007807f35080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512765, "uuid": "cce7fd1c-191a-420a-8b8b-e847c3108e2d", "comment": "Malware payload (Mirai)", "value": "5f85a860b374bb803aff4cc9e1d928b5ad3d678c0e252b45e7b88d3bed88b152", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512765, "uuid": "73ce73fb-72f5-453e-a788-7a58d0bae380", "comment": "Malware payload (Mirai)", "value": "e26999d09f28c57b6e9155f8154fe22df2946eeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512765, "uuid": "f48d808d-2e5b-4953-b1c6-08721aca4137", "comment": "Malware payload (Mirai)", "value": "7eaad3d4bbf27335819d12e0ae4196aaedd5fe29d55be72bf7df088704a69604da8f6726acf7d8d47c41ebe5fdcc536d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512765, "uuid": "281fc51e-fb97-4537-9f7f-784e51a573c1", "value": "T105E3D649AF610FF7E8AFCD3709ED2B05258C596721A83F35B974D418B24B28F16E3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512765, "uuid": "e3c4044f-48a8-48cd-8aea-62fd8b192c3b", "value": "3072:2Ru0D1FV24MgEf4cyOKnaOsGQ/d3jCk7H1Hvv0n:2RXD3VbMgEf4cy3naOsb/d3jCkTNv0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784512765, "uuid": "527cb7bf-6667-4f1a-a204-4dc13c26fdaa", "value": 143688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784512765, "uuid": "8eb14eeb-8183-4690-824c-8e86ba892fdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512765, "uuid": "4dab52e7-dbf0-44e4-b731-7dd7c6cb30d0", "value": "ohshit.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c12636-840a-11f1-be1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784531809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531809, "uuid": "6063a221-3c7a-479a-80a2-05c2f823f9a4", "comment": "Malware payload (PhantomStealer)", "value": "24d224ae3856ff207ad7f42d832399c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531809, "uuid": "b06cee67-3c5a-4256-ac26-386944375597", "comment": "Malware payload (PhantomStealer)", "value": "621da58b9aee9a07b42dfc239e6d0bc99344e28c05fb829358691f7cb268e4ac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531809, "uuid": "d5147df3-1982-4912-bd0a-660731aa9a44", "comment": "Malware payload (PhantomStealer)", "value": "f7a5d39d532429309783b5ed8c70747479dfed04", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531809, "uuid": "f06c737f-04f1-4050-9778-69b9549823e3", "comment": "Malware payload (PhantomStealer)", "value": "655787e6290d094586453b5d85caf89e00492cdc511780cf3347d66ef0c69cd464d3b2282eac88cb023e52a5adaf6775", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531809, "uuid": "3583e7a5-51b2-422b-854a-842612d52d29", "value": "T110955A61AFE96698B0951344153BFB0B749FB0396301E3AD7C6DB0F0BBF5C8194A98B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531809, "uuid": "cb22b87e-342c-4dcc-83e7-5d1b7ba1dbb6", "value": "96:NovBam8wZ7Zvt1dW1CLavCbkTklYi1vioJELWwOQcUbvAPWrHE//OBXU:eZ5VrdW1ezbkwUisoPWuWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531809, "uuid": "6d34ff35-db51-4740-829e-e525ac07657d", "value": 2029822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531809, "uuid": "3611f0d4-ba48-4803-b22f-da9500108de0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531809, "uuid": "dfd94333-af06-4a34-8834-1fdeeec243b9", "value": "FedEx345729876.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcce5eb-83da-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784510794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510794, "uuid": "3dd593ce-8c48-4899-ba5d-9d3075bebc9b", "comment": "Malware payload", "value": "753a89c82af6532baee03a84279693d9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510794, "uuid": "7aacc427-6067-41bc-8375-a0af42deb85f", "comment": "Malware payload", "value": "628492c45cbb8e26f573675db32cb5687a40b2b4dd6d5e1c73a37c14558bb9a6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510794, "uuid": "4b81445b-6603-4adc-bd46-3258c7e35ba6", "comment": "Malware payload", "value": "c917ba718e7c0b3ca8ed82e6ec400bb7e393c153", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510794, "uuid": "cd478473-ec20-497d-b426-7efdd7c72950", "comment": "Malware payload", "value": "d5f243c8dadc737eee74b52a5cc5111fbf297d42f5fa468edd96e0ba4110ab0bf184aa136a4366707a295f70c2f28ed7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510794, "uuid": "d79e9a9c-5624-41e5-934c-25018256aea4", "value": "T158016FDA85409D004099DA5D22975058F820D3CF254B8FB5BF6C6D7EEB84C14F06BFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510794, "uuid": "ff864e93-ff22-4318-b95b-df549213f0a6", "value": "24:kXCKysE2hi0ziQvZohaSEDqj9aZH/PINlJmUwcFcX:e9Qp+MsSEwQ3oTcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784510794, "uuid": "25cebf7a-b917-4b2f-a35b-f4fc947ae02e", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784510794, "uuid": "e6a64bfb-d14c-4096-a1fd-471be1e3853a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510794, "uuid": "659a8811-d2a0-45ff-a264-3f5125aab5de", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf2b6a0-8442-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784555652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555652, "uuid": "bd7e8988-f285-4647-9e87-afd2ec30735a", "comment": "Malware payload", "value": "1c8f4943d84dc19dde46658f7795004c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555652, "uuid": "ad73f649-96ea-423b-9cb1-cdce18c79844", "comment": "Malware payload", "value": "629b71238160765c0311731c527f79150766088a22a462a63338b9ff61e977e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555652, "uuid": "571bb2d0-91c1-4f64-b5e9-8ee800540a3a", "comment": "Malware payload", "value": "6f93d47d6fb1d61501dab4b1ec0dee5488c16475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555652, "uuid": "4d265f1a-d710-4e7f-8e6f-434ba8d2562c", "comment": "Malware payload", "value": "a62dc15917da91ae10cf5417b2159cc1cb3286cf6dc27fa443129ca6e1bd0fb49d71dae06fba19c73cb5b08a49f1cb7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555652, "uuid": "73226ad9-ff99-4f5c-a449-03d2dc349cf3", "value": "T1E1A423513F685D3BCA656B3EE0BB6E0B0671D6404C02E68F57B83BE72C977802717866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555652, "uuid": "283a6db5-ffad-4b33-98ec-901974f1bff1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555652, "uuid": "ea0ea44c-bfa0-4a72-b5a1-b2675e05a8bc", "value": "12288:LBcYDlLlS7dKA5JaXkMbodetj1x/ooV7i7T9Dm:+ElLlSRKAOcdeZP/XV+tK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784555652, "uuid": "a27de077-d828-4445-abf8-4d1a51862564", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784555652, "uuid": "98ac628d-73fa-414b-87bb-4dd6f06b790a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555652, "uuid": "649dca94-6f50-4fc0-baef-9e2195e29f38", "value": "RFQ-EQUIPMENT#00155890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026e0e4c-83db-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784511208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511208, "uuid": "5d34131f-4ab8-40cb-b1ad-f369e1a1c38a", "comment": "Malware payload (Mirai)", "value": "7a330d3aecd7a95e33aa8cabc5223def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511208, "uuid": "b4c923c2-c160-436e-8f2b-ef420c555ebb", "comment": "Malware payload (Mirai)", "value": "6327eb7f0e774b2be50bcc9665bfcb4a35f120c101368d4800de7e0b94827b0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511208, "uuid": "9890cd3b-f928-4ac8-91f2-aa0f65b9de51", "comment": "Malware payload (Mirai)", "value": "b43c6fc4c5838b09538f14aab83782f4789f45f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511208, "uuid": "81b795d7-7b84-4141-91ff-82c143fcda62", "comment": "Malware payload (Mirai)", "value": "2045366b6cec2c18d53316fcca4ccbdd6dbc6fdffd0bd4be463087757a3bf8d8ad58cf55d5a8ed7ba811542a0b0e7112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511208, "uuid": "e1a2b726-3878-4c31-96fd-3ee7e3bb0e59", "value": "T14A84A291A41059CBCE1098BA7B2C8F7463823CB1935B1F7D1E568559A28F8CFF5C6BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511208, "uuid": "a062d6d4-2ff7-4537-a5b0-56cb6b2101a9", "value": "6144:ISYWMcpnLYbxnpoI4s+1NbQ6cOCZ0CuoEjlPcKTu:ISYBgnL6joDbpcfZ0CuHlPrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784511208, "uuid": "5567e382-0eeb-4fc3-95db-98b1e3c82d64", "value": 404308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784511208, "uuid": "3dcd6dd8-7838-4fdd-b5e9-71ab17280c13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511208, "uuid": "21954ee8-9264-484b-933b-133f2272df0e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e814583-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784531146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531146, "uuid": "1e70789a-37b4-4065-a2f3-a46f3685c388", "comment": "Malware payload", "value": "26ae5cbbfdcb7f7a0108ddb3d5bdc4d7", "object_relation": "md5", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531146, "uuid": "f701bafe-51c6-452e-9b91-e1ed557c192c", "comment": "Malware payload", "value": "633258fc8aa5b4f3e32b05baf836a5cb24ce8309a9704499027649f249fc711f", "object_relation": "sha256", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531146, "uuid": "54d459cc-85d7-49b3-82af-c29ec75eedad", "comment": "Malware payload", "value": "31dae38ba6ad475de324828d769de79896897f2d", "object_relation": "sha1", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531146, "uuid": "481b7a5c-248a-4299-870f-ec79fb3aa341", "comment": "Malware payload", "value": "21556743cfae6193e6f094b98c1156d157768c1d58190a4b0fe902d147e674479353c33ffd1930e6bd228a8b125452e3", "object_relation": "sha3-384", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531146, "uuid": "0184a3df-d598-42a5-b159-f7ed1c83edd2", "value": "T10D12E50577D981A9E1BECB3449F2A3019334BA4B4936DB0F2C99522C0DB0B44AB63F7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531146, "uuid": "481e5462-e6a9-4f2a-9ef6-02e3c4a25b21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531146, "uuid": "18ae4060-c375-42a2-98da-f25a5a19fa79", "value": "96:kvcHL5PX51ZGf+i0je/ectt6iwOnac7E2WC9DAmRvGmmQ/fljaVFrWEm9pzNt:kvcr5TTcNDakE29DAq+K/fletWbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531146, "uuid": "2e511cf0-2888-40ff-a0e7-bd9d34c20995", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531146, "uuid": "64862d95-f007-40ef-b373-aff5e6b4a151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531146, "uuid": "e921f2c2-70db-43bd-ab9d-1d8d1ec268cb", "value": "633258fc8aa5b4f3e32b05baf836a5cb24ce8309a9704499027649f249fc711f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c12d42-848b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784587022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587022, "uuid": "4e600d03-b79b-4c19-8906-8471e7e9e8b0", "comment": "Malware payload (ValleyRAT)", "value": "96aacf012c439b535c3ea2b689bfa667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587022, "uuid": "a8ac20fe-71cf-490e-9005-3ad276d5d59f", "comment": "Malware payload (ValleyRAT)", "value": "63522452b1ed07e4f33376b0b8c85a4045e85594c3e7b03354afd985b691522f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587022, "uuid": "d8ab4da8-ec14-4cdd-911a-c08c507330d1", "comment": "Malware payload (ValleyRAT)", "value": "179bbc5875d95901a512995f461a234524285e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587022, "uuid": "0fe4469b-4c7e-4dc9-a27b-648a7eb8aa18", "comment": "Malware payload (ValleyRAT)", "value": "25366ca7639f62972c37148beba1c4321c5e5221b2bc29b9d3ec85c0f54280360c252f2f7a3764618ba24ea8ca6859a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587022, "uuid": "81d7b427-547f-4f84-9c1d-9bcc47496435", "value": "T1249533BE8E2E57DAC5AEC9F0F535D2D6A9002444A4B697C637C0079D67230B0ECE72D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587022, "uuid": "d555412a-9371-40df-9d86-b21c788ce3f4", "value": "a8ccd30aac69e6061dedcb19d3b311df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587022, "uuid": "c88aa50f-7964-486f-a891-fa10659127ca", "value": "24576:7IO57nnTvIOfOQ+M3WAvbdlUywk9UG8amWJ0+/1m7S:HFbIOmQTHU89UG8aJ+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784587022, "uuid": "2196edd3-e7b3-434d-996b-72aca5028362", "value": 1943560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784587022, "uuid": "dc014415-cfcb-4063-ac70-6650151e6132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587022, "uuid": "0f4c3289-0014-4771-a831-7c0e4840e52a", "value": "2026.07.20\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848_SUET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d0a462-843d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784553296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553296, "uuid": "a9e7e7ce-303a-4c1f-8c9a-ecaa83802fbc", "comment": "Malware payload (Mirai)", "value": "057f72e548d02832f1a7c69390083bbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553296, "uuid": "78ef7b66-591f-4436-8dc2-0ccc4b8ac2bb", "comment": "Malware payload (Mirai)", "value": "63c9b722fae7dfed5851b0cd692e16b9e999b0ff18c0444e8ecd22b6e10a375f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553296, "uuid": "4551fb28-a22e-47f1-b414-a4ad4ee56688", "comment": "Malware payload (Mirai)", "value": "cf6d417067e7c3adc689c196648148615b7fac03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553296, "uuid": "1c985874-54a8-4ad4-8747-6afc39b5a501", "comment": "Malware payload (Mirai)", "value": "532233bd4316283b0647525d62f7c008f0cefe0c1415fbfbe4004572667df943a2bb0e6db3d65575d53d713adcec005f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553296, "uuid": "ef25dd8e-69f2-46ea-a165-94c5cd4207a5", "value": "T16193D606EF611DF7D8AFCD3345A94B0634DCA44B22A43BB63574D938B24A54F4AD3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553296, "uuid": "2a32f0ff-effe-4086-b76a-7ac7819089ab", "value": "1536:N7RGaD32t7Wt08/0tL9sWesWG2PuruQyT+bPA+ZGPUhXwr+Mn5ZLCdRL:NUf7WoPesWG2PiyT2AcYzn5AL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784553296, "uuid": "3675ccb9-cef2-46b0-86a5-04076aba892c", "value": 97148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784553296, "uuid": "7f242ff9-e9db-4550-b822-8506b44848e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553296, "uuid": "f9a4cb61-c2fb-41d3-a66c-4893f85eeda8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed163e30-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509454, "uuid": "5bafe782-edc9-4a81-b8ee-d7389236833f", "comment": "Malware payload (Mirai)", "value": "c8cd2ad7f4ab8d8084ab8a4e9fba680c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509454, "uuid": "a012909c-6ed5-4c69-8e3e-a4b07d6c65db", "comment": "Malware payload (Mirai)", "value": "6416561faf40a608b2e9290e28bdcdc4e256a8e905afee3f450683ee588ec03a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509454, "uuid": "4e40d31e-bec5-4f24-b74d-d0476c3c109a", "comment": "Malware payload (Mirai)", "value": "14038e434622f4918d14e1be3be0179d618f46de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509454, "uuid": "cad5eadc-3af9-46db-bdb8-579ded4c0ed2", "comment": "Malware payload (Mirai)", "value": "f8ff1517819ccafae6f07d64dc472d23b992467a40e41e8b2af896c5914b690ef4fcf51cb74c33d5b259344412d47269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509454, "uuid": "0bf6e4ab-4706-4d04-b769-99458549ddfc", "value": "T1A1B3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509454, "uuid": "a7488635-f584-40e4-b87e-f4679546dff0", "value": "1536:aEkWiTLiZECcpHOWWJDmun5Pd1Oe4+YLxlrwTH+E7+TeVedVPneQBZN010an:oni50po9vYNlrwr7+Te0dVPZ010an", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509454, "uuid": "d7e03e09-e94c-4326-b17d-7bace907a290", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509454, "uuid": "95026ac9-0589-4137-94ea-689f22754154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509454, "uuid": "3a2f5785-224d-4ff6-a893-5f25952ccedd", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010e91ed-840a-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784531392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531392, "uuid": "31880ba2-9af3-4462-bc03-3b71b14bc4dc", "comment": "Malware payload", "value": "36207005b7b6602652025b9c8bdf8d58", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531392, "uuid": "bcdadc1e-e8c9-420e-a385-2efae8e75b23", "comment": "Malware payload", "value": "64b1577db4a977b0c29591a061e313872aefbfa7ec7708969d21dcb1278f6e72", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531392, "uuid": "2b252fef-f7b4-4536-92b1-c70dd9961325", "comment": "Malware payload", "value": "a748e31bbe4ed0a03641044f5803cb69e88352a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531392, "uuid": "5fa0beeb-116e-4628-8d17-cd2698e011ef", "comment": "Malware payload", "value": "b6484f06e2b2f265e46cf40b5daf53c4fbfb36efbd45f7142f86b462cb5a9ea2ee4d0bf12bec3ab95cd9f16306cf500d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531392, "uuid": "691d459b-7d92-4690-a4a7-e45069c83c96", "value": "T1AB2394B96326FDFAC71837148ABCD44ACB97C6542756FB78B2858FCEC519C80E12462C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531392, "uuid": "d9413ce0-1133-44e2-81f6-f9b5ff661ed4", "value": "384:p1NeSQ/BLrPW6YUYQQKGhdQSmPQnsMwzMj+I+tq+Sa6ouzx0:pKSQ/BvbYUYQhGh6/M+I+tq+Sa6ouzx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531392, "uuid": "d4f6680b-2688-4db2-8697-b87fef4916ae", "value": 46855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531392, "uuid": "d84a8eb1-6443-4744-85c5-6ab757d43634", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531392, "uuid": "db8125b6-4f7d-4f28-85e4-635bf547297b", "value": "ENQ-POIRS2026-07-17-PHARMA809_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7058f8-8414-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784536085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536085, "uuid": "69735baa-a8a9-4b37-8eb7-8163a7aecaeb", "comment": "Malware payload", "value": "82432dc312865e37de46645a4f1a8fc8", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536085, "uuid": "646222f9-4dee-419b-9cf4-6288aebd8391", "comment": "Malware payload", "value": "64d1b461eed7795e23a4c51ae525620ee43220e12f01e17e07d4198780a30423", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536085, "uuid": "5125adb1-f09b-42af-a24f-0aea7a7efb97", "comment": "Malware payload", "value": "0e15cbfa44e1b888427e80631b7d4b8ea087bb8d", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536085, "uuid": "f55d4526-deb7-47e0-af64-4e4d1f8bb928", "comment": "Malware payload", "value": "00ea5fe578e826eabc68fba78851d339c7b133017f626a10e92d3f0c2935179128b755172bbc93437733f2f5a288838a", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536085, "uuid": "247f1237-4a07-4a09-8650-d41f6a2b32e1", "value": "T150569D21368AC46BD5A205F01B2CDAAB912CAE350B6188D7B3DC7D6F17785C31633E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536085, "uuid": "2425c25c-3b5c-42fa-a11d-14365935a6d4", "value": "262f7b623746b414d0e9c48c1d61145e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536085, "uuid": "0aacc01a-73d3-4914-a6b9-361a950a2fb5", "value": "98304:tESlP7ZdJuHDfd6MhRXzA8lg/+/npxWhHRZcXIRDLzIQauSpDVs+wRjUzrX29iJj:tESlP7ZdJuHDogRDA8lg/4TYwsBZUHXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784536085, "uuid": "6af30703-3cc3-400f-ac40-a07be338fabb", "value": 6247128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784536085, "uuid": "84356195-f27b-4315-be18-582497e3e332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536085, "uuid": "60b07adc-e362-466e-b0d1-45b74ba4b9f3", "value": "app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d559aeea-8428-11f1-bd95-42010a9c0009", "comment": "Malware payload (PrivateLoader)", "timestamp": 1784544633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544633, "uuid": "a4f8aa4d-05d8-4c82-b10a-bdc6b88cc83c", "comment": "Malware payload (PrivateLoader)", "value": "be9aee8c3cb56fa17d293d48dd0fc1d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hackledorb", "colour": "#4D895D", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544633, "uuid": "0babf245-b9cd-4c08-bbb2-78461bfced02", "comment": "Malware payload (PrivateLoader)", "value": "65ab49119c845801f29a57e8aa177146b2ffbd289d4278109b146f933380f951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hackledorb", "colour": "#4D895D", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544633, "uuid": "d28ac661-a222-4289-ba08-fe57cdaafa65", "comment": "Malware payload (PrivateLoader)", "value": "616a15883f34627757fe19b12324ed8f0583b739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hackledorb", "colour": "#4D895D", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544633, "uuid": "4af90c08-3620-46ae-a5f8-3542b6e2bd66", "comment": "Malware payload (PrivateLoader)", "value": "d9fa9e3d3ce9d28d49bd158abae42630db90210fbce71d9020e9ca6a4189d8ea3d418fdc493640f8873f4a54b17de820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hackledorb", "colour": "#4D895D", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544633, "uuid": "22323ba3-6cce-4da0-b63a-bd7d43ff8c48", "value": "T11506E012B441D47BD6861070DC2DE67867213E3CA7F249E3B7C43EEA79B02D1753AA4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544633, "uuid": "04aa0f91-374a-45b1-9c04-df44677d4816", "value": "91f3638ed81918491a1a5366767e31e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544633, "uuid": "48c49653-2aa5-44ca-a6ed-d1aca185980a", "value": "49152:PvVnLYyAH0n6JZUfr4XF0NXTvOwJ/aHZVdG8lzLVKKpasTHLTpYGFXD8hH5u5477:VnLY5H0cvV0JZF0VZ7KAasTHKOAhZvo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784544633, "uuid": "d52528c3-c883-42a5-ac4e-ff12eb8713f1", "value": 3990528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784544633, "uuid": "92bae179-4a8c-4aa3-bc99-784220dee17a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544633, "uuid": "46824d7d-9c15-489f-9a2d-0385e8c676bf", "value": "nw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9264ad-8497-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784591994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591994, "uuid": "64576a40-ff92-4d3c-89c2-1ba3f1a70837", "comment": "Malware payload", "value": "a41abe65af606f4e304cf45891b48862", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591994, "uuid": "b5520065-7ffe-4837-9a66-07145df33345", "comment": "Malware payload", "value": "65c8a814d54394758ae4cff4318466c127117f46d22514a2ebb56610c8bf6dcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591994, "uuid": "fb3b86e9-8c36-47a9-9b47-a07d67a39748", "comment": "Malware payload", "value": "e3214cdb1f51f71a521a41baf3b07c3111f7f233", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591994, "uuid": "d72a7e32-2f7c-46db-a22b-bae97bb546a4", "comment": "Malware payload", "value": "e3d191ffb097b9ff1777ea203e10eb0c50b92adc188fd79b6c24ca4596b34d90b36d7b7abba698b368a6e93a0be7dca9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591994, "uuid": "aae09301-4fb0-4e98-8f35-fc8cdeddd3c3", "value": "T1F5E3AFA89E0FBD93C2C6E3BE9E5A0FA7303734744614D1B70D00569DE6DEED588B2522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591994, "uuid": "c1dee68e-6eb5-4ae2-8a14-9dfab773fd9f", "value": "3072:bDfdCg3++cVpPveAgN142M02fMqs9AG2vwz5IZsKhRcIA:bL0Q+j/dgN+2M0NqsZ2EIiKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784591994, "uuid": "fc757c6b-e17e-4540-afbd-9235291bfde9", "value": 153464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784591994, "uuid": "bd2fb36e-13e2-40f0-8813-3d338163d9f3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591994, "uuid": "2e693606-4783-4ddd-a803-3ea821017f07", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6f5547-840d-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784532807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532807, "uuid": "b66f6a68-afb9-402a-8638-8a68fee1f26d", "comment": "Malware payload", "value": "67d243a98de87d347b744d80d5a79ae5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532807, "uuid": "f03c6acb-f3ad-4810-9bdf-44644eca853e", "comment": "Malware payload", "value": "661bf586731bb60c3bcc88dddd64e724c204372211fa24d9fd09d3b02bc0cab0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532807, "uuid": "ab0e109e-46f6-402e-b1ae-cb5e0e4faa35", "comment": "Malware payload", "value": "2c5472993d94dafc3b14c6e86efba2c361e15379", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532807, "uuid": "1c7b7311-fb3b-443a-9a9a-9e5023f124d9", "comment": "Malware payload", "value": "bce78954bb03f10bebd0c1fd1db464bcb46e01db4013010eff9212de57ce262dc8daecc6e3b7d216447e4b2045fdebee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532807, "uuid": "5691d28a-8168-4b0d-8edd-ae6c594d8839", "value": "T1C0A5016C95AECF3C74E652818D746F91B86061A48C6BFF3DE83C0BF6348D815191FA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532807, "uuid": "f85884d4-5fbe-4989-8979-350b398b0325", "value": "96:yElElElElElElElElElElElElElElElElElElElElElElElElElElElElElElElJ:Q7g+ZgIWRaB/bzjEtKAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784532807, "uuid": "c92f01ca-3434-4baa-b361-00b8d33025a1", "value": 2208446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784532807, "uuid": "95328e1b-7419-426d-8706-600dc0688dfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532807, "uuid": "ffe570aa-c120-44b7-93b3-92cc3077d97e", "value": "Comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906fc840-840c-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784532492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532492, "uuid": "2ed9e78c-5aff-4b9f-aef8-cc081ce78457", "comment": "Malware payload", "value": "c32950f4ad5f1f98abe6a8e12114712d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532492, "uuid": "d001a146-7e12-4842-bd5a-1f90dc919073", "comment": "Malware payload", "value": "66be8e49609157729ebb8489935b76eb505cc1ad0b0a6db664bf5277ebf386c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532492, "uuid": "0ec26011-5afc-4a4f-8406-76a9de63a352", "comment": "Malware payload", "value": "ffa291b577b58bf897e893565c2a75d569b12136", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532492, "uuid": "2d8cbe16-c7c3-47ab-9d37-6e66b7116146", "comment": "Malware payload", "value": "143d54e0c4c8f048f96b312c69a3e28a32f6f54f17cf4b860203a076d7ea896e53517a3c0f96cbe07ec637aec5cf71e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532492, "uuid": "2b1037d7-fb42-4958-a3b0-2a78e76875c0", "value": "T113244970DA2002774F87AB98BCB90661C66DD325853705B1FAC98B0D900E9ECF77D66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532492, "uuid": "4259eabe-79ca-4c74-8e09-cc6df3bd481b", "value": "6144:yzUw+DIkfG/sUpgfpUnlOwHer6P5OlDPqRh8gggrhX4/03pVIsw:yYhNUlOwb53RhZfFXnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784532492, "uuid": "831094c1-7267-4306-80d9-74308cb1abf8", "value": 225763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784532492, "uuid": "ac5820b0-e031-4174-8fee-7bfb5965d2a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532492, "uuid": "4e6d1ad3-8817-419b-a147-0191882fee4e", "value": "Ordine vendita 26IA000253.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6194bd7-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784575048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575048, "uuid": "7c30b835-b844-436c-9404-fd6bf6c64623", "comment": "Malware payload", "value": "99268cf298b5143bb60bcbc49cbd5943", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575048, "uuid": "ca7caa0e-758c-44c6-927a-0628f730bbf7", "comment": "Malware payload", "value": "67229a5054aa6e8c7f7f05bdff86da66b8e54363a455a8f902141ed0b39fcdec", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575048, "uuid": "07b1fc92-1034-456e-a84a-2bc2af368efc", "comment": "Malware payload", "value": "bef29d60a5f891f694d1b806b9aa3af1211bc99a", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575048, "uuid": "cd64d849-62e7-420b-a846-8d12dd884ec1", "comment": "Malware payload", "value": "94b2607c251962807bc17916a8301853264bf84ec448afade4f2045d0f9870421d3032f1a9e0f1636a6baa3fbf7bddf0", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784575048, "uuid": "4c7e203e-4085-40f1-af0c-2b707f753b83", "value": "T13AD37B6767EA30F9E2778238C8514655E773B8315761AFEF07A042992F236E08D39F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784575048, "uuid": "8e7424dd-562e-40a4-a760-521e9c8d83dc", "value": "1e10de300bb84d91d7b9493496b37e24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784575048, "uuid": "0329e7ff-6ed3-4d8c-8dc1-062f690790ec", "value": "3072:pLrIsu+OC6if92e+qFMLM62pdGAo7eRBG0oTWz/UH7EoCya:ZrI4OC64XFMA64GAZzfsWz/y1Cya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784575048, "uuid": "7883d491-ba60-4162-a526-e954c1bb11db", "value": 133065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784575048, "uuid": "b892666b-c275-4a3a-a1d3-45d2b041e65b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784575048, "uuid": "38c0db64-7c3d-4579-b7ee-9279f92295bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9df463f-8414-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784536105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536105, "uuid": "1d2a84cf-826b-4f2a-84fa-b63f7c67b338", "comment": "Malware payload", "value": "976b16c3e05d2265d7638b2f55cb1ec9", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536105, "uuid": "09a0af9a-10ab-4da6-8d6e-1d3dddecdb7a", "comment": "Malware payload", "value": "675c00bb28188ff6f9c785bff17af59cde1f2993307ae73aa7d3dbc9e6ee9cbc", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536105, "uuid": "2e5de2f9-952f-4c64-92cd-2c458174d7f3", "comment": "Malware payload", "value": "3f1e500a64c77ee89ed141da5ae15fb5611d8bea", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536105, "uuid": "6dd7ba3c-5f49-4567-9b30-f6df4e79f7f8", "comment": "Malware payload", "value": "43b5fc1dca0424d52692fcff72b9c8199c52dda622cf632d0092e6a5d045d1dff5b655ee705564780365fa927a3e602d", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536105, "uuid": "f0ba776a-6021-445b-9c01-5b6485c99574", "value": "T115A4226073A6D36BCCC399B855D914CA1228FC968F9B7E1F61B1F32F19347CE6122906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536105, "uuid": "20bd2d0c-5a3c-4472-8ee4-64a76ae95d4d", "value": "12288:VBzTJSdXdw88AhUSgNCK99qdKFGl3ihCcRI:T7dSg8Q9nF8Kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784536105, "uuid": "00249779-b37f-42a5-8a71-1f161e0758d8", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784536105, "uuid": "c9ad8f7b-9e61-4c22-9c36-85b0c40fcea5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536105, "uuid": "51e9ebf7-33e6-442e-aba2-7847e776bbeb", "value": "POXUpdateX.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1dae88-840f-11f1-be1e-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1784533563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533563, "uuid": "8645b44d-a487-4b6d-80e1-764d720de9ce", "comment": "Malware payload (LxBaseRAT)", "value": "77821003809ca14e3a3bfed894b9ee48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533563, "uuid": "e2345bd6-265c-4d25-b063-115870786a80", "comment": "Malware payload (LxBaseRAT)", "value": "67627ce7abecd377dcded485206ae77b94b08dc5672d6b6726fa587bf953e6d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533563, "uuid": "e783c309-44e8-4bed-a990-a7dafa0ca44f", "comment": "Malware payload (LxBaseRAT)", "value": "65c960c272c170a94009e4c7c03ca026fd55d615", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533563, "uuid": "45cf5020-ca19-448e-8962-0d2b18719f56", "comment": "Malware payload (LxBaseRAT)", "value": "3157e2b63b84ef1235ef8262399ffe632387c7afe1eba3c9ae1f0c1cd7ea12e12241d59dbde690a644ee13ad4ce9e39b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533563, "uuid": "86ed9153-2695-4a0c-bd6b-c2a843d17cc9", "value": "T1AF45BF1469721513C4B9C2E32CE176886368B8E9368F7EB5C791F040FB9F1D1EA611EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533563, "uuid": "ae6fa8ba-e400-415e-8fa2-56f7b5fdbede", "value": "24576:86tf2f/9RQOysMPbXV6FSrLPNHoLumpQKxa2qd+KhDdazzj9hSJTd:w1RRY7THmF0vV09ATd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533563, "uuid": "22e39195-07aa-428c-aa96-4c60bcf11080", "value": 1279715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533563, "uuid": "037277c5-c887-41f5-b788-f93c15c9efc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533563, "uuid": "4e41c606-520d-464e-b0a2-7f935e9de71a", "value": "Purchase Order- BE2607-3463 -July-16-2026..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25696e3-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574639, "uuid": "bbb0f980-a7a2-4df2-ab2e-296df14a430a", "comment": "Malware payload (Mirai)", "value": "6cea611b5095fe3a3f1b5c3e5eda5559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574639, "uuid": "f540fc72-0fa4-4162-9b00-286f428ece8f", "comment": "Malware payload (Mirai)", "value": "680255421c08c0e971700c02ba6501617a4b9c1025707eeea5c2abfa47df74e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574639, "uuid": "7a9317e9-c3c5-435a-88a1-a57d04ed42c7", "comment": "Malware payload (Mirai)", "value": "9f4b8cee81bfb7769dde73a421d6b71eccc591fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574639, "uuid": "7bf9df3a-b551-4158-a999-84a6b64dfe95", "comment": "Malware payload (Mirai)", "value": "0dbb4f57c5129a28cbbf1edeb056fd08bbc6d047a5b8d647ae0c6a4c980f978582b41c7e9d65a46d7515745f010e205a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574639, "uuid": "659a6c0c-1648-4761-9f8e-76146e30cda9", "value": "T11B538D179E32EE81D00288F4B8B58ABD9B53FD669C5379E0E567BBA55103DDC78083B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574639, "uuid": "498e30d3-3ed9-490a-902a-bc9894450094", "value": "1536:geEvsGfkvReHSNUzoVBTNDrAbtfkWC+Zo:ovsGKReHS1NDmfkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574639, "uuid": "1e8766d1-c9ce-4cec-91a8-4c6aafefaf2a", "value": 60792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574639, "uuid": "75422208-54d1-41ca-949f-adc90735b5d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574639, "uuid": "b7a5821e-ba4b-4a69-8f0d-b1c0e3251fe8", "value": "nullnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61e7527-83d5-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509013, "uuid": "516f8e73-c25b-4e30-a195-3cfef9b18dc6", "comment": "Malware payload (Mirai)", "value": "543c9c04c44dd41d3b0431f5285f9c7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509013, "uuid": "80f4afc5-65a2-4364-888a-623054addd3a", "comment": "Malware payload (Mirai)", "value": "698a65556d1937d391e85ddb0c2c4419e907214033dbf68401c92f635bb61c82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509013, "uuid": "febcbff5-470b-4239-907f-91335743f5d9", "comment": "Malware payload (Mirai)", "value": "2a37c778da5328a71e5d825b53c9e984b089a6b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509013, "uuid": "8ccc387d-10ba-4a27-b653-14e29c72b6f4", "comment": "Malware payload (Mirai)", "value": "9fdf08e68adb6f5934b67dec0edb337d5bc0542496499c0570605e5f4833b2fca9c8a31ac7c6b7a85f678a59bacc37f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509013, "uuid": "8fbdc429-3975-4f2e-900c-13145172f87b", "value": "T1EFD313139C83B62EC8B5573CC2BA636F480374C855A28A096B314CDF9B56396A2774F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509013, "uuid": "bd71a207-07da-4452-873e-c60cb3f062c4", "value": "3072:BHqVzcIqwppRfmqK9tMM3bXVJkN0+KF6ApbH:Bszk6B5K9tnbQN0+fApbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509013, "uuid": "1077726d-dcf6-428e-b329-5bc238a70078", "value": 133948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509013, "uuid": "4b6f96b5-3a58-46f5-bdbe-2df1e18be582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509013, "uuid": "ba51aa35-d8fb-445c-83f5-144077b4336f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43029117-8485-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784584331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784584331, "uuid": "6f6e52ab-09e1-4a51-822a-c33d02042cec", "comment": "Malware payload", "value": "27b6bbc0fe5ae39d0461171bd3e0ed94", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784584331, "uuid": "a3dda698-c689-4732-bfbb-5a987fbaac42", "comment": "Malware payload", "value": "6a25ea3dc7e86e1d0bdcf0becbfb120b4d2b36c38cb63e5106ee7e8ddea1cf7c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784584331, "uuid": "2f1e2a7a-aa04-4fa2-8d31-2de7396d20fb", "comment": "Malware payload", "value": "c9d7b16ab3b79e33495459c27c3eaa95d4b08a09", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784584331, "uuid": "7d6b371f-f56c-43ef-b1f0-18d761eb10af", "comment": "Malware payload", "value": "26f9f3a1caab5219353256526c7639344529a604d3e2f97ceccd47e17297b306c93474b8665062b78380828b662b11a1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784584331, "uuid": "2e1f3941-3d13-4555-b0e0-3358d072e861", "value": "T14BE6330C66E516EAEB63813DDFF36286E564B8610B73C6DF5B5483B4AD832E1093C613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784584331, "uuid": "2b7be55a-1d37-49d7-8cf3-b321d85a875f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784584331, "uuid": "296024a9-0f2b-4c35-bdf5-23c5a0669caa", "value": "393216:sSmrvjlmcGaMbXuT1MvuXMCHWUjXScuI3/PGTAI:s9N5qXuT1MvuXMb8XvH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784584331, "uuid": "67b012d2-95ee-47c0-bbe1-f287bdacc468", "value": 14278560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784584331, "uuid": "b39b0e63-4d99-4de6-801f-fca0aeaf2c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784584331, "uuid": "4f4f24f5-9763-437f-bf17-b72776d56f36", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b8d935-8415-11f1-be1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784536339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536339, "uuid": "f6d83c1f-ccdd-4839-8e09-4e82b316a2df", "comment": "Malware payload (Formbook)", "value": "edbe089992b7ed84cac7acbb099fc9ac", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536339, "uuid": "1f6ddf4d-56df-4a37-aa22-4bcceecb599c", "comment": "Malware payload (Formbook)", "value": "6a8578a8755cf42d5379b804d0228e87d9eafc601ff80f7ee813fe75ef3077f0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536339, "uuid": "af99cee3-0367-47d7-9e41-6247b86cce6e", "comment": "Malware payload (Formbook)", "value": "5497a9770c8229b5eb6bdcfefb401bfc312cb4ad", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536339, "uuid": "cff17868-7923-4e63-b285-866dc4f96b39", "comment": "Malware payload (Formbook)", "value": "4ff45006accd5edd22abeef5d088ed53d291d7fa7322859bc44155244f681ad734498b61eba32c013e8795efeb2fd5cd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536339, "uuid": "5e03ca86-cc45-45d6-8d13-d4a1a46c5553", "value": "T18ED3BC6D838F41A5CF51A777531A8A0506FCB33EB309A1B2B4AC937133EC92E19A557C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536339, "uuid": "18e96806-40e5-4f3c-96b3-7c43065fd29e", "value": "384:zs0c4N9wJtl6P5hA9eN0ZXyaPOeNvbD83Xf+N/cmLLY0GIFNNZjx9/on:QZlt9g0kwZX83X0/cQLY/IfNZt9/on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784536339, "uuid": "043da6ef-048b-4da6-b3da-ac3a9f290fea", "value": 135959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784536339, "uuid": "9400d9f8-7506-4097-b94f-8b3d5b3c3f83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536339, "uuid": "73cf23e0-2a9b-4f84-9403-7a5d8f7a9530", "value": "NewXOrder#2026-00398_PDF.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ac892f-848d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784587684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587684, "uuid": "fedafd3c-9c64-4a6f-b8d0-f1c4c5d4e791", "comment": "Malware payload (Prometei)", "value": "10dce2eecd69f7802f240a18d65fb09e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587684, "uuid": "d3675783-21a9-421b-9cb4-a23d1d9d5599", "comment": "Malware payload (Prometei)", "value": "6aae69fdd57ce162f19b5ecd8ffc24f1ceac61281a88e610f6813b7db9195099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587684, "uuid": "5817ec8a-dc71-4c24-8f4f-1abde2494a79", "comment": "Malware payload (Prometei)", "value": "5b3a0bff74de208714a3f233f47bbbf4f6c099f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587684, "uuid": "3fe1e652-1b71-4ad3-b356-dec961451d4c", "comment": "Malware payload (Prometei)", "value": "8ee8b97c12f8b1b81342c8493b6dc479554d48006d9f665309732318c75815a28f94d4daddcd095b7713f58d3b7e074e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587684, "uuid": "c99c2119-4426-41c4-a42d-cf4f09dc6e38", "value": "T111A423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587684, "uuid": "8c03b4b4-1783-456a-bed5-8fd345dca25d", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdY:Fs6pyCC/Ya2hpi6T6N46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784587684, "uuid": "66fa080a-be57-459e-b217-afca8cd56df1", "value": 449087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784587684, "uuid": "1690d0aa-0fd2-483d-9821-e76fa55b975c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587684, "uuid": "11e3f393-0093-426a-9c8a-8eaab93e61ab", "value": "6aae69fdd57ce162f19b5ecd8ffc24f1ceac61281a88e610f6813b7db9195099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4ca270-83d8-11f1-be1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784510121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510121, "uuid": "2c6e4223-f93b-45b8-b1a7-5d8be2c918b1", "comment": "Malware payload (Gafgyt)", "value": "0b39448d80d3f0fb50d8867c2c972dca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510121, "uuid": "dc973b07-fe46-494c-812d-46d1b0f74b08", "comment": "Malware payload (Gafgyt)", "value": "6afda92c73f89ddce818f752d2d3fb7f39cef34c53478ecd993cd42936a12efc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510121, "uuid": "514a3075-1b38-4d56-b5e2-77f01c40acc6", "comment": "Malware payload (Gafgyt)", "value": "3dce555abd0a1849bf3ab9aa64a9b1f133c8c3bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510121, "uuid": "3992e9ca-2c85-42ef-87e6-ea9f86608975", "comment": "Malware payload (Gafgyt)", "value": "379bdf9dff20ba0e066e1596952e8141257ddafeb0327861b3fa1393095bfe284792878c61fbdf88342449a50017f606", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510121, "uuid": "1a995e75-a114-4b68-a750-0637461f8093", "value": "T171F3D61E6E618F7DF668873087F77E35A25833C72AE1C545D1ACD5111E2038EA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510121, "uuid": "78be8974-fdf8-42dd-98a3-c20bbbc8f2fa", "value": "3072:XX64OQ/fVT4OnAUeJB1Ir2VE/iYXftdgPhExBqh:XXmQ/f1HnAUy1IrkIvt25MBqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784510121, "uuid": "e50b210a-6a2e-40d3-9141-2c10dc0867bc", "value": 171372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784510121, "uuid": "73a30863-ae35-4fe3-844d-8cea4f873005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510121, "uuid": "d164aa76-cb0d-4f9e-a094-51611005dce2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb7ee13-8413-11f1-be1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784535336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535336, "uuid": "15379e68-9d1d-4f03-9659-901df6e56b72", "comment": "Malware payload (WannaCry)", "value": "a563ff5a153b001223ff8d93d68405c9", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535336, "uuid": "c846f382-e4ac-41ab-915a-3b4d382843a7", "comment": "Malware payload (WannaCry)", "value": "6b1f9dee6182e98eabff20baa433fced12a7f584e4973eb7b020f6a0c297fcec", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535336, "uuid": "39405670-a574-4a59-84c0-991278f8fbfa", "comment": "Malware payload (WannaCry)", "value": "a3b4e81b5da8cf8a500cb87939e2be9bff352145", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535336, "uuid": "7e3149a1-2ee6-4c75-aa80-da9263ca2517", "comment": "Malware payload (WannaCry)", "value": "db1588cd76e8fbe36b151bf5b4bb9fc7f116f0e3229546e544509cdea856e590c2bbd297184b4e48e27c697293ebce00", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535336, "uuid": "4a0e147d-503a-4945-b64d-7428312032f1", "value": "T12B363359322CD5BCE046197444B3CE29E3737C5167BE9A0F87504EA73E13B9BAB90B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535336, "uuid": "4cf6d727-a104-4235-895a-c227e7ece0bc", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535336, "uuid": "ede9d358-049d-44f8-8046-a05785a14e21", "value": "98304:DXDqPoBhz1aRxcSUg6SAEdhvxWa9P593:DXDqPe1CxcuZAEUadz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784535336, "uuid": "930c576e-80da-4784-85f8-ad816a05df8e", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784535336, "uuid": "21efd8b8-623f-4041-a953-6f66b7d65c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535336, "uuid": "555f50a3-b572-4160-85e3-c8a2919842cc", "value": "6b1f9dee6182e98eabff20baa433fced12a7f584e4973eb7b020f6a0c297fcec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a740ee40-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784533389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533389, "uuid": "b2817d3d-7c2a-46cb-8e49-3d4f7238a014", "comment": "Malware payload", "value": "a2d8adc1d3e52de58e529babd7bf09cd", "object_relation": "md5", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533389, "uuid": "c8809c54-202c-4a80-999f-b282087bdf85", "comment": "Malware payload", "value": "6cf9f7ab3fd2c96b12c5e6e92c1876f093b7c9a4bce8003fd06bad811523f345", "object_relation": "sha256", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533389, "uuid": "daae859a-16be-48cb-9148-48d787520a69", "comment": "Malware payload", "value": "efde292876b5472dce07d5e0b75d89fb1676800a", "object_relation": "sha1", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533389, "uuid": "5829e2ac-b058-49b7-b7c0-52ead41a2c24", "comment": "Malware payload", "value": "72c86deb9195d222e378357a975822f0fe8be8d2fbf396f8746e8c0b22042da1a627dceb79398be30bc183d7831da4d5", "object_relation": "sha3-384", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533389, "uuid": "58ce8a12-5f78-4efc-9d2a-dbdd192cef0a", "value": "T10BC09216AD01092D0BF4CAC0C8F97C244E9B55ACB37879ABFA55A8AA154826AE85D740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533389, "uuid": "f9fa1940-1fbc-42c3-b417-4fa508c2da55", "value": "3:VSJJFISFXKSXARnbN2GVL2wwpu0zIyJAFBALT5ooL47B5ooL4in:s8SFXJEnpDL2wc5IyrLTTL47BTL4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533389, "uuid": "b0efbc7b-6b13-4dce-b651-15ebc7f75dfb", "value": 131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533389, "uuid": "e0c28f1c-4030-4d4c-ac60-6dc89fdb8d80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533389, "uuid": "079cbc1e-01bd-48f5-80eb-573a7b4df567", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db5c77a-8429-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784544969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544969, "uuid": "6f2836fb-a637-4d96-b1d1-370b704e43ae", "comment": "Malware payload", "value": "dd20eedf930e6d9fae11f4b85a4e89bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544969, "uuid": "f40a1d0a-ffc2-4338-8d2c-52f9ad04b664", "comment": "Malware payload", "value": "6d0573a78716d51a5fa5282d99a9568e1d515f5c16b9b86a3f3536c1f2622c50", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544969, "uuid": "ae0bdb6a-3f3e-4673-b143-d24a4723a0bf", "comment": "Malware payload", "value": "1980f6827f0706f1373d81c927badf6fc8e80f4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544969, "uuid": "37e0346e-8803-43e2-a38f-63faeee2df49", "comment": "Malware payload", "value": "d4feaa9623a992c2fc2f9fa560b9b7fb3bca8a576ece9d1201f26c3cbbb4b276c718718d760b5f0c87f3fa171c1f9910", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544969, "uuid": "761c40ca-0887-44bc-97ee-1644b981fd03", "value": "T19A51DDCC169190103232EBED108F1660F18C2D8CEF1EF71AA4A9DE366ED971E60276F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544969, "uuid": "da9139fd-2267-4b22-a4f5-464c3cae4af9", "value": "48:kSP5hpdRNtyd1nFisznq0dQ0NWd4DD0ycWr1D7ECnD1YFh81FubO9DGJWrx16:Eh4TWxHbnBYsL+O9YWf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784544969, "uuid": "7788dae8-c27d-4dc7-b936-b866714c4aa7", "value": 3037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784544969, "uuid": "4a8b73cd-3da4-485a-9f94-85625b6ee66e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544969, "uuid": "3c06f85c-696f-43c4-99bf-2569f6e8c254", "value": "SBU_CryptoCore_v4.2.1_Protective_Network_Client_Setup_secured_release.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f018390a-83ce-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784506023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506023, "uuid": "5081dd2a-3348-44fc-b99c-fe8db1f635c5", "comment": "Malware payload", "value": "f9a04f975b96b6860c6ff9af16bf1fd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506023, "uuid": "40b80032-65ac-4574-8b44-8465ee94a87d", "comment": "Malware payload", "value": "6dfd535055df7f3f0658ff58e3a625f38ef4c0bfc13f0279181db7adf37f688b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506023, "uuid": "8bc5d7f7-79a3-4638-9390-f04acd3ed8e3", "comment": "Malware payload", "value": "81a686d661c92f3a86f313c435ad3202b42770bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506023, "uuid": "f50c6193-2427-43ef-846b-aaaa334eb669", "comment": "Malware payload", "value": "5a1f716158e6b7b53952928baaed508e8d452828970b57c741895ec883c3ac60fa9a9539c069e9dca79e5ec61aa21788", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506023, "uuid": "818be02d-2abe-4683-9562-101ec5f3a3ad", "value": "T158B3128DA8409E14CD12ECF4A8DB97635FB18597722BD6A3FB45DD312B8462B2602DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506023, "uuid": "b1ea9856-ba61-483d-ae91-ddfbe8e39fca", "value": "3072:Nq/5YlO4pft8KIc4DyhSicyhKzU/9qDqmk4u+qgw2uk:FlDpf+ydcyBlbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784506023, "uuid": "b5612b52-0b99-437f-a822-8690867799b1", "value": 116056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784506023, "uuid": "59bcd301-2626-42e9-9cc8-fdd927964875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506023, "uuid": "028a841b-22c5-4c56-92f5-765e9f4c7abf", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8dbfca-8474-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784577129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784577129, "uuid": "329ef27a-5533-4f54-b9d8-07f5a25cdcb9", "comment": "Malware payload", "value": "d19dbf2ae5a8c7350bf3424834ef7031", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784577129, "uuid": "f849154b-e9cc-4467-9cdc-03c6248affb5", "comment": "Malware payload", "value": "6ef76a3b50c9f70408e74e4c15d986f94979711d35f3f6744d1ab61387214eb6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784577129, "uuid": "f12a9786-de2f-4927-9bce-1b6c2a23af8f", "comment": "Malware payload", "value": "1891576b13b73563d5bb08a0a0d00f6cb14aea9e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784577129, "uuid": "30801324-b102-4091-8ace-4dc3df725148", "comment": "Malware payload", "value": "7f3302463c68da0e70b10fea6c747a2c0bf0b27ded6812aeb400dcf6c39a578f9a7ea726aa9ad2e436924c4c085d9eaf", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784577129, "uuid": "3585dd9d-320b-408d-95c6-3c372c57ab40", "value": "T162E6335862E010EDEAB3513CF9E169AAF948B8B613B3C5DF575842623C172D09D3EA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784577129, "uuid": "84e75c1e-2373-4fc5-ab41-7c7ca27e854e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784577129, "uuid": "f7328684-8617-400d-80e1-f546a0a70c71", "value": "393216:+97ceQme+Ku/AXMCHWUjXLcuI3/PGTAI:+9AhmeUoXMb8XoH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784577129, "uuid": "6f38c53f-0aae-4edf-b165-a514091a3d60", "value": 14294268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784577129, "uuid": "62aea149-926c-4e5e-a3dc-bb6d0f344160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784577129, "uuid": "9e8364af-5ef0-4bc5-ac85-1606626db309", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14504a6-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574611, "uuid": "0cf8a039-4d2f-4721-8b5a-29f0c20b56e6", "comment": "Malware payload (Mirai)", "value": "4e86e944c9bc7a5ff091b637773eb315", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574611, "uuid": "44223697-6fc2-4eac-8a00-52637e88c7b7", "comment": "Malware payload (Mirai)", "value": "6f6dfc05b95568a54bf6ffc2ce08f6440bc56f60a6dddb1308d8532ac6222844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574611, "uuid": "d260deb6-252a-4aa4-a925-f7da558a4665", "comment": "Malware payload (Mirai)", "value": "e1fe9b35ceabc59a53904ffa1188b024003ee7eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574611, "uuid": "22c72a14-5878-46aa-a8b5-5ee24cb38db0", "comment": "Malware payload (Mirai)", "value": "c19a15f49a16f5877a4b2ef9db56e1eb0369678da38b70d130836fd5845fbe49dd1be5d55a13f2b4c76f99620539d629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574611, "uuid": "2c063878-37f1-4280-877c-ddef19bf2854", "value": "T134230167E593C229E5FB21301A992F161D04460CBFA5D6A63FE83C355CF03B6AB28F14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574611, "uuid": "1f799556-0718-4ba6-9370-e538d431bf59", "value": "1536:zdCin2H4AD1VqYTPNv6U0CuX1djxFT8nouy8jt:zx2Hd3qYTVv6U+XjjTcoutjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574611, "uuid": "ec1b8f11-f7c7-43d5-9178-1c1b81260f62", "value": 49772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574611, "uuid": "69697082-6e29-40ef-9869-d04af94b1fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574611, "uuid": "28e456c3-6a6a-4a53-b667-a4fe277b674b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38ae47a-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509438, "uuid": "cfefcdcf-1d9d-4e51-8b85-bff4a235b6b5", "comment": "Malware payload (Mirai)", "value": "e818ecd6bb280937df3673e5dc82c648", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509438, "uuid": "38a13004-5344-4aee-b7cd-a7c7d336a6c0", "comment": "Malware payload (Mirai)", "value": "6fce1623d06754d0eca7e3e05542baef73a05f120217e407fc3a4b60b032bbc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509438, "uuid": "ff84e804-8f5c-4aac-81cd-034b1834d039", "comment": "Malware payload (Mirai)", "value": "aa71558abc51da39c9907cf226ddddadb88c4fee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509438, "uuid": "6611a0f3-08a0-41fa-963c-304d2e38a662", "comment": "Malware payload (Mirai)", "value": "7142afc108b180c621c4da9a3683e1f3a8a7d65481e3d7339eed419025696d3eedbdc9336453a2785434c27d58deb70d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509438, "uuid": "6117f103-6987-472b-b452-b9e2c1f59db1", "value": "T131045C46EB818A13C0D62779F69F524533239BA4D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509438, "uuid": "fde0e216-b261-47bc-99e4-abc5a7438654", "value": "3072:WMdy5RuL6KaI5dPRdLBBoJYXoCyj8Ulduysd0LM/9VamtTM:WMIuuKaI5dPRdtBAFC68cduysdQM/99M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509438, "uuid": "b4961da2-d42d-4f4d-bff5-62c269bb578c", "value": 176499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509438, "uuid": "3d9bb8eb-a357-4c3f-a969-4a60727f6adb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509438, "uuid": "aac31f58-804a-42fb-beed-1f9a4d75879d", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919c41d5-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574584, "uuid": "d1ac13c3-90ac-4839-928a-0b59fd8bc04b", "comment": "Malware payload (Mirai)", "value": "112219277b16016a438f2e6e112b5ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574584, "uuid": "eb646a04-a740-495d-af15-0938c87a060e", "comment": "Malware payload (Mirai)", "value": "6fe46be742f3a6323ed4947af3af0ca8699dc2e6e46768c5db08360e7d518a47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574584, "uuid": "7ff00e72-a5fa-4901-b2c0-11e51bed44e8", "comment": "Malware payload (Mirai)", "value": "9cc784e6933cafe1eb2fc7abed07c88b63a294cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574584, "uuid": "988c0bd3-e5fb-40c2-91e3-0cfbcff4fe35", "comment": "Malware payload (Mirai)", "value": "ab04679b9b5e28cb6d6cedd8ba1a01debd4fea9bc9cb87684baca59c868665516eb090afb9df0c0a97d978b283ddfdd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574584, "uuid": "4bd9ccad-732c-419c-bc30-c936e94a1155", "value": "T16BA30885B9829F11C5C626BBFE5F014D3317BBE8E3EE7212DC205F9433CA59A0E66512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574584, "uuid": "b3db49c8-8acf-427d-872b-156582db9e9b", "value": "3072:pbBobhRr8cIU5NVcOy5sNbKxnIQa3vQJf:ihp8cIU5NVLEsNbKxnBaof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574584, "uuid": "87907dca-2287-4e13-ae0d-09bf4049a3ef", "value": 100160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574584, "uuid": "a75c2699-edfc-4e72-800b-eefbcaf30e6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574584, "uuid": "62f0166e-e952-49dc-94bc-e5a2ca5baf2a", "value": "nullnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e674eea-841b-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784538931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784538931, "uuid": "f3c969ed-fe72-4535-bdd3-9543e88a6c72", "comment": "Malware payload (WannaCry)", "value": "ca9050aa6e139627dd5c0d4cdd5e3eaa", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784538931, "uuid": "0c599d21-e830-4ce3-b5df-f62b19cb2a2c", "comment": "Malware payload (WannaCry)", "value": "707d1f44be9210b1f0dd678a37aef925c4b09c3072289a575fadad571470ed2f", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784538931, "uuid": "9f81a249-7d45-4ce6-aa38-d596380b9e88", "comment": "Malware payload (WannaCry)", "value": "2f8782ed3f725c8df861b7c3c3b54c5b37f0c87d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784538931, "uuid": "ea07d207-1918-4bb4-8636-bac3f0577420", "comment": "Malware payload (WannaCry)", "value": "b078e46957e9c2f08e1b07ec86cd3f990fe2f8a64e5974118934ae14a59cbda37dfd8b231062ebb2fc3ecf44a868a47a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784538931, "uuid": "cb19ffd0-3652-4a4f-ba48-1e8f8013499f", "value": "T118368D01D1E41A60D6F24AF629B9DB10933ABE46995B9B5E1222410F0C73F1CDEE6F3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784538931, "uuid": "aba74da2-5d05-460f-a07b-abc6883da574", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784538931, "uuid": "3c9a2c87-d3e4-4c57-8164-5922dfd5f684", "value": "24576:jbLg+bLgurgDdmMSirYbcMNgef0QeQjG/D8kIqJASk+RdhAdmvn:jnXnsEMSPbcBVQej/NAARdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784538931, "uuid": "8de8d1bc-dd6a-4ad4-b360-cf58cfb81427", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784538931, "uuid": "597d4f2a-24f0-4123-8efc-4d6abd34f545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784538931, "uuid": "068cd652-7b3b-498b-93e8-eb39e16d7af6", "value": "707d1f44be9210b1f0dd678a37aef925c4b09c3072289a575fadad571470ed2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96a00ac-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574651, "uuid": "5f48d561-e514-4c06-ad1b-0d9cd6329ae7", "comment": "Malware payload (Mirai)", "value": "2593bceb7a688c84e43da0164d455113", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574651, "uuid": "862d8e53-08b7-409e-a70e-b7f7f95b4b5b", "comment": "Malware payload (Mirai)", "value": "70ad15526da0fcfe0b038908dc05976b69410fe3716c662db15e45fc7b9a8139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574651, "uuid": "94e5f9c2-a4dd-42e3-9125-159e9a927796", "comment": "Malware payload (Mirai)", "value": "0b5639c70058bb1bb157a62ea6422e5bd2b8539e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574651, "uuid": "7814d844-f282-432a-82d5-40b129ec8fcd", "comment": "Malware payload (Mirai)", "value": "a39adc2199410ab7ea3f253ccfc8736deb88714846c0f6e348a681b8c4d5e57fbafb3fc7a84a0d1ab91d87fb347a5852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574651, "uuid": "6d66cc6c-e830-4b62-8b0a-2edc39aa350e", "value": "T1A753F1BEF1437370E8A1E2B52B5782FCC9618EB7D41E071B1A9892F4C4B19A75984733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574651, "uuid": "2fb0eb55-7a17-44bc-bbc5-edd97c1c485e", "value": "1536:pGStOwguGD0zzZ/btiqCVYLzHz0ynOrH9GqUSuno+:p7rgh+z3iZVYLbrOEo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574651, "uuid": "4ff0e472-7286-4f47-b224-a143e2c81feb", "value": 63692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574651, "uuid": "9626ce95-300b-4b90-81b7-1549ad5d0469", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574651, "uuid": "5284ab29-c451-4b62-beb9-45e617fb4c6e", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64efd8a6-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784531130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531130, "uuid": "ab8e0745-d5a1-4825-a45d-7d35eb715f26", "comment": "Malware payload", "value": "a8cc7a3c37e680ded52932da35f18684", "object_relation": "md5", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531130, "uuid": "3be29942-9d12-49ed-a34b-8f52151c1e1c", "comment": "Malware payload", "value": "70c47d8ef8d35f29173ab5ac9233d12858a56aab5ea176c5dfc8ec42980eebfd", "object_relation": "sha256", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531130, "uuid": "b8715515-c52f-4775-b437-d1d99d05c6ed", "comment": "Malware payload", "value": "e82c571a1da4f75729272567cb18e6e492efd42f", "object_relation": "sha1", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531130, "uuid": "2aadae90-5774-40b0-b217-985c4c80399a", "comment": "Malware payload", "value": "8bd08f282140c6a9cb35b391abb353884e63a18e60f2624d66fd5d9c0dc2cd48a86d199f0e0f32b1b30cee542b1f3516", "object_relation": "sha3-384", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531130, "uuid": "2a3598a7-d278-4551-ae17-05ba06471234", "value": "T154A2A4089C2418DC8577C36EC782B1DCE876226363DB28A2756CF456EFB235C425F87A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531130, "uuid": "0b691e6c-9d39-4b7c-8100-de93395d7258", "value": "384:742eV1YTVQx57Po+mX2ZOFeO5JgXdXJyVbCsIjQ4WPGr:l/Qx5boNXcOPba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531130, "uuid": "f5bd5335-093a-49bc-9f38-c243c940d279", "value": 21480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531130, "uuid": "5f7e8d62-357b-4d09-a492-83c7722b836b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531130, "uuid": "519c44f7-9b92-42b2-a86e-b6163677462c", "value": "1_ftp.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa34913d-8406-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784530092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530092, "uuid": "454c934b-4547-4d7e-a82d-ad8adabec92c", "comment": "Malware payload", "value": "26c1dec0b8973e5b221049fbc94b5a89", "object_relation": "md5", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530092, "uuid": "e1cd5f49-9d43-4862-a506-23b1468da09c", "comment": "Malware payload", "value": "70cddfaa97e5f9916c279570e34e07a101d44988cb2ba7149a8c80d7f60dc111", "object_relation": "sha256", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530092, "uuid": "ee14e98f-1f71-4b4f-bbb1-7af71e72f526", "comment": "Malware payload", "value": "13a96a28b0307ef79ac91f0c0224d34cf567c23b", "object_relation": "sha1", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530092, "uuid": "b71a159d-f403-4049-a844-eb819fbff232", "comment": "Malware payload", "value": "39d39348c01ce6fbcbfe9a6a9e32e5fe8df39d80a10378a189db9491348de97fc4e95997ce98dac2b48f6c38eb89f23c", "object_relation": "sha3-384", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530092, "uuid": "2b1900a3-e5e6-47c1-a4b9-5a6be9a893d6", "value": "T14214230AAB113034F3770406C6BC91DD532EE45411FA9756808FBFA1BB6D8A5B9DE0AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530092, "uuid": "960271f5-e912-4821-9ac2-4087d09d958c", "value": "6144:qf5roam2oaOxFsyfw7ksaOmjezWsI/wMwiV:qRroWo/nsSsaszWlNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530092, "uuid": "f278092c-2207-4f88-8168-c3dcacc4fc6d", "value": 206637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530092, "uuid": "1ac521c6-5f59-460e-aec1-80f0d84c311c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530092, "uuid": "da24f3a5-fcba-4fd3-a09c-5ca755071ee8", "value": "XinPu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a580f9-8430-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784548090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548090, "uuid": "656c1dfb-a6ce-4659-a5b4-b152ca16d0a9", "comment": "Malware payload (Mirai)", "value": "aebc3847261097eb356a94fc80899714", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548090, "uuid": "aa485c3f-5a37-438d-a267-b7b15623feb0", "comment": "Malware payload (Mirai)", "value": "70f8e1942b20728ca72e764895633e409858b007f660439c0ce6f671f7070db8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548090, "uuid": "f464f77e-9f7c-4260-99e7-53a51c51615e", "comment": "Malware payload (Mirai)", "value": "fa2238d6213c9e41a43e04efde0bd7b9b7f45da1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548090, "uuid": "5da475d8-90d7-45fd-b070-9939f17f4e8d", "comment": "Malware payload (Mirai)", "value": "b02f89754f3f9c151e7765b174c8e442507dea7722dfcd145518859a7020d42783ec1c8835805f59788032e8c110cc31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548090, "uuid": "68021097-bfbb-4990-90f8-e7539217de58", "value": "T165B36C86E743C4F1ED160671143BA35B8A35ED310035EB86EBE52E72AC23F019A1B75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548090, "uuid": "e40d22d3-276e-4b01-abbe-d7d2e36b6abf", "value": "1536:xVz0SuCYFpcoCM3zFuX5Bz1lKiMQqwpoIs5AsoXtbuY4X4vBmrDtp9yt:QSuCQivX/DKiQwp+5loXh54ftu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784548090, "uuid": "8746e064-7170-40f5-b610-0b08c2dce44d", "value": 115824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784548090, "uuid": "9c53cc4b-0577-482d-955b-35c481283b94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548090, "uuid": "1921fdde-c0ee-4f6f-93fd-91e5ce262ba0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f9189b-8423-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784542532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784542532, "uuid": "aaa508dd-04d1-48e4-b123-e895889355b3", "comment": "Malware payload (WannaCry)", "value": "584e516edb5fc2b79960940b18cd65b5", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784542532, "uuid": "c0b889b2-69ae-4756-afcd-91a3b6c6d1ef", "comment": "Malware payload (WannaCry)", "value": "7132a14099e6824598c5899dea19a4b8f4d89683bb01774b402674da1d4fee2f", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784542532, "uuid": "1f89df65-bfe1-4d68-a05e-97c28bd930fd", "comment": "Malware payload (WannaCry)", "value": "4ad57334dee1fafb11f25b63df07a64370153ea7", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784542532, "uuid": "217a66a1-654e-45b2-8cde-64ef54402024", "comment": "Malware payload (WannaCry)", "value": "d2e790602bbd6dd0cb2462d1a8382ece2f884b4677a7453668baa700b5e6e15b1319c40a46301f856625f5f1ad1501e8", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784542532, "uuid": "11a7eebf-6e49-4a83-9a6a-ffc1a32bd7b5", "value": "T1D536235632AC40F4D1065134D4B74E15F3B7BC7F22BA960FEBA08A252E63B82F624757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784542532, "uuid": "e5c921a7-d2ea-44f1-8d23-7a7ce968efa8", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784542532, "uuid": "fdec923a-5d0e-418d-b613-16e6a38ceee7", "value": "24576:jbLgBbLguripdmMSirYbcMNgef0ZX6SASk+RdhAdmv:jnsnvMSPbcBVh6SAARdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784542532, "uuid": "11dce020-9f0c-4a8b-8c6e-5615eeec6692", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784542532, "uuid": "2263670a-0c30-435c-9cb1-86184a904437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784542532, "uuid": "3444124a-4f4e-418b-aadf-aba2304b04da", "value": "7132a14099e6824598c5899dea19a4b8f4d89683bb01774b402674da1d4fee2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49de0056-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784525072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525072, "uuid": "36b0f7e8-ef8c-4b4d-86de-bc294add765c", "comment": "Malware payload", "value": "6e221ae528acd17eecdc8e87637254d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525072, "uuid": "f251454a-d242-4583-ad77-e310a23916f4", "comment": "Malware payload", "value": "7133c0449e2fd08a0fba85c1523b3380cc4b65ff21d84032d8a9269397429768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525072, "uuid": "761232cf-42bd-404f-8799-585380872fe1", "comment": "Malware payload", "value": "ab3de627efddbd5e44124f49f938fd2aae6d7fe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525072, "uuid": "9f3e265a-6216-4095-8e31-8f4e3d77ae34", "comment": "Malware payload", "value": "54ddfc1221c8a17ce6e2190791ef38de3cc2614d59c6c3df3cc18358aaabcdf593ea4051674ce1935a94f55ea0600df0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525072, "uuid": "f04503b0-a256-47f3-b62b-949f2441d9a7", "value": "T1DBB31786BB43DFB3E85301F002A74B254A32FC3A4837DA95E3797EA599065D0A71637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525072, "uuid": "d21dbad6-02c5-4842-96ff-825f814aa95b", "value": "3072:HYGs6oXao3WRF45Qj23a7ZhkMiZ0iXG5ll:HkWjWHZ0iuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525072, "uuid": "b2f04a10-9904-4306-ad2e-852e65b07a28", "value": 114528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525072, "uuid": "3fb6334c-4312-4423-8014-b3b65c4ec727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525072, "uuid": "9674c9e8-90ea-49f7-94d6-cd7c24e56dd7", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1edf7ea-8452-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784562693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562693, "uuid": "ae858281-4884-41fa-bcbc-dd5702125218", "comment": "Malware payload (Mirai)", "value": "2adde2089642dd828ff4444178207309", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562693, "uuid": "3fe89614-e50c-4184-8237-d28fa4755db9", "comment": "Malware payload (Mirai)", "value": "714f761f1994d2c647aa8feeee06272f5ede71dc704842d9bee2141fa94c22a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562693, "uuid": "3fb0d120-2b14-424b-b8d0-10bbe8e44447", "comment": "Malware payload (Mirai)", "value": "613b1d89e966d13a908312cde6034ee59a5c0339", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562693, "uuid": "c2a97908-6e75-4940-ab03-6b6f7537dc9b", "comment": "Malware payload (Mirai)", "value": "b8369724910354c3bb0150d7efff886e9d54176cdb9ef4b3ea196d515f5b29242ea9c0a4603c226476e3ad362b428058", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784562693, "uuid": "e24b950d-f719-4f8b-b1f4-fde5bdcb56e8", "value": "T126044B49BE342BEBC05FCE30052E930B11DD945FA2F6B779A678CD4C399A24859F3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784562693, "uuid": "d5bd1ec9-311c-463b-a599-80f1f570833e", "value": "3072:kq5xkWiCkjXT9nWSGpWk/xipYoE5zQjYnIvINpEfX5ft1DL:j5xZiCkjXxnWSGpWk/xipYoKnIvE4frX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784562693, "uuid": "72f66ab5-af14-488a-ab1f-0936441a91b9", "value": 185036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784562693, "uuid": "08789b92-fd7f-43c8-9e0b-e26a5e434bac", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784562693, "uuid": "d5d4e270-b0f8-4a0d-976a-db17065c9816", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530de8b4-842c-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784546133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546133, "uuid": "eea32367-d7d2-4629-8842-194c7faff535", "comment": "Malware payload (WannaCry)", "value": "bbc3bd12b1ed9df1ca9f99ed4dc304fb", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546133, "uuid": "4d383f7a-ecdf-4211-b91b-a79045efccd4", "comment": "Malware payload (WannaCry)", "value": "71fcbb434b354f3d49979deb66e458086f266f36c6a161e46cd924445bd22c65", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546133, "uuid": "b83e05c6-e5a2-474f-b6a6-f48d4190418b", "comment": "Malware payload (WannaCry)", "value": "e8b8b9a323db49d7a5f8824efe269b62508afdeb", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546133, "uuid": "33d0e857-6ac8-4dfc-8918-173ebb0f193d", "comment": "Malware payload (WannaCry)", "value": "03aa559412c2899780922e7266bb1fecdee55aaecc1bc9bc6456ed0bf8d9d5b797532c83b61a686935f32f945b8642dd", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546133, "uuid": "b97ff0c4-b233-4cd4-9a31-eed1d366d90c", "value": "T1A5363320B12941B5E0D309F004FFEA2AE6BE7C54137956CF97844BBA4D62BC2AB74747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546133, "uuid": "82216643-d600-40c2-90b8-2eec282d1e1f", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546133, "uuid": "37582171-e96c-479f-a086-05071379f80e", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P59Uc/Pp2H:DXDqPe1Cxcxk3ZAEUadvP4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784546133, "uuid": "3fe24742-8d3c-477e-8973-f33d1bb5fc31", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784546133, "uuid": "ba339bb9-cdab-46e3-b88d-c3a5dba3e540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546133, "uuid": "a6d995d8-2d7a-4726-b64b-0a2894e992ec", "value": "71fcbb434b354f3d49979deb66e458086f266f36c6a161e46cd924445bd22c65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf43a942-8477-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784578553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578553, "uuid": "758d63e6-c7df-4644-9877-962874b52c35", "comment": "Malware payload (Mirai)", "value": "a180f4c1432d2c3e01bad4d167c0859d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578553, "uuid": "df064b46-cf38-4ab1-b794-8eb251344659", "comment": "Malware payload (Mirai)", "value": "72a5a6dd913263a9773df35c1ae3c5d0fea06bb7848c9ecf91c1ea8eca8f9979", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578553, "uuid": "50612d02-8c91-455f-8dc1-327f60b6b97d", "comment": "Malware payload (Mirai)", "value": "0370f11475440cd78d91ce9ca9243f98dde0f29c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578553, "uuid": "18efdcd0-6324-4dfc-99ac-ac7fa83e8b3e", "comment": "Malware payload (Mirai)", "value": "6a6c2d41959a32fdd8b7e81f8dd3381ecf43efdacf991ad015a3bd631f5c4702e9ed14a94031bbd0c83d88338b220b26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784578553, "uuid": "17a989aa-dc23-4bcc-937b-b6819d646a3f", "value": "T13CA31916FDC18CFDC44AC03443BFB53ADD22F4EE0238B29B6BD4AE27690DE611A19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784578553, "uuid": "dea3e102-307f-47dc-a03e-2c033a0686e2", "value": "3072:d4DEFusTs0Hzc+OFq9E9ZvlP2lwqLH9i0eG:d4DE8sTpHzc+QfKwkc0eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784578553, "uuid": "9d3f5f0f-35fa-4ccc-8c0d-7497f5d4515b", "value": 105744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784578553, "uuid": "d14ef62c-8e82-488e-bd56-58f9d6142c68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784578553, "uuid": "95e2110b-abe9-494f-ba37-b7dbdce42026", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d65654-8402-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784528367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528367, "uuid": "90d44049-9bde-43e6-8cfa-76f2730cbdb0", "comment": "Malware payload (AgentTesla)", "value": "6429d42ce5cedce9693f1fb7813f30dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528367, "uuid": "edd3f2c2-8846-430b-b47a-6964e722be70", "comment": "Malware payload (AgentTesla)", "value": "72c4f0ca86df7faa99da27cbc0fe3bba3c18c38b4df1421276e9c61904e1fe6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528367, "uuid": "ec3fff31-3017-4f4f-be13-1c9ad152e9c5", "comment": "Malware payload (AgentTesla)", "value": "f30caef6eed122abac8f4322aff08c5568bc2351", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528367, "uuid": "a873b275-df1d-498e-8855-c4e3325ebf0a", "comment": "Malware payload (AgentTesla)", "value": "7ab2bc4d23480946827bf749e6a536c10b033055c929aa90469df858f2d34037c1add73b770e2e4c9e64ffa5bb1418f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528367, "uuid": "30177ee1-7c58-4236-b6fd-c98d7be2b1b3", "value": "T16CF5C4109B64A4332261936C913AEE79E84E55036CEEDF05305DE634B52CE8BF358BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528367, "uuid": "645c14f4-eca2-4ade-8e37-58484508ea67", "value": "98304:n2wnV86qJQb4WN/HHKClE+WlIxRLshMnC5afhvRKWs3nTawq0V:nL86qib/nRw+OcN0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784528367, "uuid": "c82fb8d6-87fe-4244-a998-7035c6a6cdb9", "value": 3592963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784528367, "uuid": "1f1cc432-73f9-4ffe-b22a-72b60da77656", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528367, "uuid": "e3892c2e-a79c-4e9c-b088-b468457c4fff", "value": "info_New_Order_7132026 _PDF.shtml(~99 KB).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e923ca8e-847c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784580744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580744, "uuid": "e21bfb2f-e304-4e2a-bfc5-62a405f35b95", "comment": "Malware payload", "value": "a34a543870f0c463c4bd83fb37883d83", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580744, "uuid": "9c29d649-efbd-412f-8a9f-de04a2c0234e", "comment": "Malware payload", "value": "7391ec43b2e0621c8c6472b686b900722a4f22ca037b3ebd0ade5a86a880332b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580744, "uuid": "a5c56a5c-1edd-4320-b17c-fa720433b6aa", "comment": "Malware payload", "value": "ef5fee2f2ddf7a7bd246a0671cbc08a0083f6ea1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580744, "uuid": "62a11919-6ddf-433c-a23a-331c0b796c25", "comment": "Malware payload", "value": "e57d126d763e37039f2ebb9580d26229825bc8b4ff39fff3f48a1958efe4428866ea9dd359a0f59744e5622f50401451", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580744, "uuid": "b74668bd-1bc1-4212-bb5b-7ec87278f41f", "value": "T1C0E633589DE001FAFDB34138EED2A65565B5B8750332C6EF07984BA28E672E04D3E743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580744, "uuid": "9410b88e-b0c2-4b8e-a9a5-c3022e156977", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580744, "uuid": "0c922d25-73d4-4cf8-b18b-450fb9e6b399", "value": "393216:g+dc3JDVvdbBL67hZb/1IPpXMCHWUjXzcuI3/PGTAI:gVZPI3+PpXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784580744, "uuid": "03716bc5-b182-4466-88b0-1e799a3e9d86", "value": 14309261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784580744, "uuid": "18ed41d1-33ee-42e0-b679-dc6ab64ea74b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580744, "uuid": "822ab784-54d7-46e0-833c-da0924ffc10c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76386e1-8402-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784528262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528262, "uuid": "8be0bcf5-30b7-477c-a36e-293bdbc4043e", "comment": "Malware payload (AgentTesla)", "value": "85c4f53025f33afd1497c2b3ff4dada1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528262, "uuid": "e23da466-3597-4d0c-a7d0-8319da4dc1e8", "comment": "Malware payload (AgentTesla)", "value": "74dd5ea4d8e0b1fbd163fb30ef75944d28d0c852862abe1a95bd0dabe96198bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528262, "uuid": "a2374f1a-3dd7-4ca2-871f-02b4eddf6d39", "comment": "Malware payload (AgentTesla)", "value": "26af277f84280db420faa93758a5e42d22fe2679", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528262, "uuid": "48894bd3-f35d-4ff7-a2c9-1028d0677852", "comment": "Malware payload (AgentTesla)", "value": "0c6705049d1a26d1dbf9f6fca6491600493e259425cedf931647043687961b7e9af446a80bf05b25d24f58d0cafe41fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528262, "uuid": "52c2ccd3-8911-4a0b-8e20-f074cba946c9", "value": "T173061A915AE5B1233731D7DA5629FEB4C10F8D0734194E5075AFEA38B81CF8AE6A0363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528262, "uuid": "59a4c428-c0ea-4612-97ae-540296205385", "value": "98304:Fu617CBZ2BT0Ln4b1X0LW368VosLgtERLxxlss7WGldyolG/+aWIyJSnkecJyWQx:Fu617CBZ2BT0Ln4b1X0LW368VosLgtEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784528262, "uuid": "7469313e-f9c8-4f43-8343-6319df4ddb6f", "value": 3712221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784528262, "uuid": "4522ede4-0639-424c-9693-8b93d8b2f52e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528262, "uuid": "0606d450-3f5b-4e4d-a720-6cd488ca855f", "value": "New Order07202026001.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e7aea3-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1784533194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533194, "uuid": "ad195480-17e7-44b8-a148-a3c70f0cea3a", "comment": "Malware payload (GuLoader)", "value": "f04a749b44e6fc19b03b6e9950876eba", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533194, "uuid": "60d1a776-84fe-4754-a874-461598fb2cf8", "comment": "Malware payload (GuLoader)", "value": "7517bfe35a6dce8b03a1f0a99381a9fb90b9e45610f1021f4eb20f6f602b2f96", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533194, "uuid": "1e26ab20-a70d-4b8f-bc71-bfc32748f054", "comment": "Malware payload (GuLoader)", "value": "96e19a713203edf0f1d8417588df4b3504d2e828", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533194, "uuid": "40983486-c797-465d-b56d-cc325cfda347", "comment": "Malware payload (GuLoader)", "value": "d2723670a6b7308cac7faa5645e6cc553cc9888b9d66934afab54e56b1315f9cd1bcb0d1b646446431ca9fd5853416f2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533194, "uuid": "1b9f7a80-0cb9-4591-9c7c-5c54868e5b04", "value": "T143618521735657B89E0C6ADFE5DBD48FB4B075B411070A10F237C460385F45E42E896E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533194, "uuid": "857621a6-ea37-4f9b-8baf-fbdf8ac020e4", "value": "96:eLwEx8lvMZX+KBIi3TpyXsr4UvWZ0Xf1TO0Bt0geM+bMRovdfQ:6pf+Li3WsxWZ0PY0QLM+bM2vpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533194, "uuid": "65785509-f62e-4b81-a59a-9548720b78e9", "value": 3362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533194, "uuid": "b8ac78ba-6eb4-40da-ab76-2b19dd03f6ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533194, "uuid": "83bc923c-283f-4279-a222-880a9ecca716", "value": "Shanghai bozhong metal group Order 16072026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4fb02a-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574656, "uuid": "5dc8d11f-a04a-415c-9b24-00527b97edcc", "comment": "Malware payload (Mirai)", "value": "562e290b40770efdf7fdfb48683561be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574656, "uuid": "854b55c2-9f53-4dbf-b1e8-3c4f2ed9c2d9", "comment": "Malware payload (Mirai)", "value": "75d4f00e4dce73174489bc5e2d945aaaa4e19fafd700d5dca9c3a1e64a6c6ed8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574656, "uuid": "c7507eb0-8c78-46d7-aea1-a1aea7d537c8", "comment": "Malware payload (Mirai)", "value": "7822df14dc9adfa01fdf951779721efb58a1c64d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574656, "uuid": "d29ba1d0-cc8b-41a0-8461-854fd93d4eeb", "comment": "Malware payload (Mirai)", "value": "99e791879a8c7c4cd6ca41f91978145fbb126fbb14183c79209e9f630f9241de06efa38160f36801e621b604dc91b40d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574656, "uuid": "74d1090d-f52e-4c11-bb16-a8bba8b00ec2", "value": "T16FD2E1358A05DEBADE347D71C7598207128B18B1B2F132A7170807BC9EC469E7678BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574656, "uuid": "8c7874a7-f11a-485c-9a1b-cf8fc2acf40a", "value": "768:WZp+3110oNTznXmtZTqpp8pj7Is3Uoz9Z:GM3110oN7GT3pdzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574656, "uuid": "ca02483d-80ea-4fc6-8e67-dc7954c81e1f", "value": 30416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574656, "uuid": "8ffb9a9f-f68d-44be-86cd-1d84963c2dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574656, "uuid": "84aa4dee-cf23-4569-b7ba-2be001c8d8ad", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6bab19-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509131, "uuid": "fdfe7f96-5ea0-49d5-870f-5af48cc78ab7", "comment": "Malware payload (Mirai)", "value": "1c3d92164408f3764d012667ed49f133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509131, "uuid": "fc3c3a44-d802-4a7c-a61a-15020cac38b8", "comment": "Malware payload (Mirai)", "value": "75f5413dcdf4c69f8b49ab6bec5c9a9948c768d5abbbbd0c093c971b39e4398e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509131, "uuid": "147e84f0-ef89-4a7a-93c3-43a1614d6da1", "comment": "Malware payload (Mirai)", "value": "c897ba4c611bc95f07d921b44d318b34fc125d63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509131, "uuid": "9de219b9-accd-4807-b3f5-4be72a613459", "comment": "Malware payload (Mirai)", "value": "084a310338333935c7efac4fc89937bb825b1151063ea46112402cb4172b7efc2745ddd00db11b2f2db33cd79f512676", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509131, "uuid": "2a6e91e1-fc4f-46cf-9038-6186845825d7", "value": "T1D9B32989B9816B25D6C256BBFE4F018933135BACE3EE7212DD144B6037CB91B0F7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509131, "uuid": "890f5c21-64ab-4a80-a624-e86b061eaf0a", "value": "3072:y8XKO+pKeFOTUnaFDdKiC33FUUWIa297x9FXrHnoFB+SEwd:ymKJcUnaFDdKx314Ia297x9FrIFUSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509131, "uuid": "f9909958-ba8f-444f-8964-d95be129e4f0", "value": 118088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509131, "uuid": "d7220ba2-957d-4606-8ad1-42e0ea1bd054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509131, "uuid": "af9e4d18-b211-4fad-b250-b039a6cc319a", "value": "tarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ebeb04-846d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784573912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573912, "uuid": "9900b46a-ca73-4fea-950b-d19cadfbaa5d", "comment": "Malware payload", "value": "a69de26ffaf977d7f6d2cc005dae8071", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573912, "uuid": "cf9172e7-2d0b-48c4-a4e4-24b99662c46e", "comment": "Malware payload", "value": "7745290182b09c243b344b7d96511ff03d4638348be38865b926913c21cf0c21", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573912, "uuid": "b919d85b-13fc-4404-9773-ed783a713cc2", "comment": "Malware payload", "value": "b1f09bed5e0cc0ba40d172fe163a9965125f6ded", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573912, "uuid": "983955e8-aedd-4612-8d8f-4174a05ca622", "comment": "Malware payload", "value": "8f588d12aaff05a9d63ac489411c3035745d6b57fdae97eabb11bf05f14fc3c8109bca1ebe91f16253279c8a20efc09b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573912, "uuid": "76a01b17-9ddb-4a10-82ed-be4c999f83a6", "value": "T1D4718E402DDB10D8F2261BB167DBB5BB0B96F8B4D42E6DB412C15A7047F3980B8ADB74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573912, "uuid": "68bfbab3-4bf9-4be2-8f0a-496dfc9401cc", "value": "96:8XIewHZbppFHZbpFHH8poqJgp9xY8h5HE6lYYMxBpu:8Xa5bpr5bp9cWqu/5rlIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784573912, "uuid": "dfa66eba-df36-424a-99d1-dfd9cd6bc2d1", "value": 3644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784573912, "uuid": "3eb9ad48-730d-4380-9a24-0c734ac48a48", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573912, "uuid": "aa4d3e18-e210-4234-9218-37b22a5b984a", "value": "\u0410\u041a\u0422 \u043f\u0440\u0438\u0435\u043c\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 16.07.2026.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a6c589-8479-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784579207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579207, "uuid": "ac7bf481-a8f8-4494-84df-a3cd53a93bd5", "comment": "Malware payload", "value": "7f3b68c197aa920b3cdceef9e50d0d26", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579207, "uuid": "3ea7e813-e5ee-4f92-9879-e75aacbc473a", "comment": "Malware payload", "value": "774813aa1ca069bf99771e37766b073e569e7cfb5056593126598f5fae343661", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579207, "uuid": "4d6a294c-c72f-4ba2-bb4b-176b0202e64e", "comment": "Malware payload", "value": "0e913e1dffeee8878ab321026aa0873ec063e0df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579207, "uuid": "06a35e66-d36a-4073-b7c9-475387025d98", "comment": "Malware payload", "value": "dea0114c6c8c9824a5ef7e25185f5d56733b53e46ebc1aa25de582b385fbcbb798a7af9d76d8eabd7160d8ff8655710f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579207, "uuid": "ce1e30ab-cbc3-4f95-a2d9-8f547eb142ce", "value": "T1CB2104C5006449BDDC82AE48F77B98C4AA594696FE827F8EA9DC047AE55CD34F0CCAD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579207, "uuid": "38393866-9511-42b9-84dc-038a9a08e3be", "value": "12:MCd9I+AA4eNIyJSDfKi+39k1V4HSgM/2n:HnjseNIDzKi+NKV4ygM/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784579207, "uuid": "36199664-4629-4069-8523-94455f1e89de", "value": 1213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784579207, "uuid": "93220541-f85d-4183-bcb6-f3c57abb4e22", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579207, "uuid": "de0afc3b-628e-4aa4-bb48-9a18aa3ae689", "value": "busywget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f95962e-8432-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784548758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548758, "uuid": "413a00af-118b-45af-b004-cfdc879ddd5b", "comment": "Malware payload (XWorm)", "value": "7c208ad79c1e7900bcbf86be3f6f4418", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548758, "uuid": "ef0426fe-2f3f-410b-8e25-51145928eb5d", "comment": "Malware payload (XWorm)", "value": "77ed2de688c8f7e1315dc239763f72079ab0eb883591b81f5fbb9266ae4407d5", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548758, "uuid": "23795d2c-1744-45ce-83b2-070ba613a70e", "comment": "Malware payload (XWorm)", "value": "ca6308bc691571a846baa59fe746a1f97ac7be9f", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548758, "uuid": "2c0f453b-cf55-4778-938b-2cbe2065ab14", "comment": "Malware payload (XWorm)", "value": "fc9a767598d734752df3ee2fb35251696deb6c23da7ad98577c28ea39b0a3bd4600d1c876d388787dd6fb8cfa82b9ed9", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548758, "uuid": "510581e2-d48d-4dfd-ad37-46636a6ae41b", "value": "T1304185021278A836CFF05984C42E6B2D6D0AD8F371029DBD31291BD908DA4EFD1EE5CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548758, "uuid": "cfe1bdce-8d63-4fff-b1fd-7340041834ec", "value": "48:hQYDD4OjyiljJjjUcjVfjQ0HjJPj1GwjZqjLhjnuruvDXru1unu82juia+n:hQYtj3hdR7HdBjEJqqu0ujCR+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784548758, "uuid": "b050b40d-a69f-4535-8030-a9bbc5f622be", "value": 2023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784548758, "uuid": "03238b41-6ed6-4a47-992e-8dd7ac42c190", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548758, "uuid": "684e4a29-2e1d-4a64-ab5e-e650b549930f", "value": "rec.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86612b3f-846d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574136, "uuid": "950c91b4-2658-4136-9221-21f47ded4ba6", "comment": "Malware payload (Mirai)", "value": "ed127a50ffd23b437f87981204d791f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574136, "uuid": "a51daa8f-ed3d-4335-978c-b4cb4107a971", "comment": "Malware payload (Mirai)", "value": "784a65412fd70d644e76b4201d56bc215e81342141a53e052a5095671220da7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574136, "uuid": "58f69ed4-2389-43d8-805a-0821a064ba57", "comment": "Malware payload (Mirai)", "value": "766f173e2b156735aed1dc3f29a6fc5a349fc6a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574136, "uuid": "3e80daee-7199-4d6f-9f41-e39887d72747", "comment": "Malware payload (Mirai)", "value": "31c54686842d061dff25c41a96b4e59c41b5ec7137d3bb75e18d64484b4d95a948fd85e3adeb4db6d44e9b3bf8da8bfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574136, "uuid": "d9a0a84e-cf12-4b94-869e-81accd94ce39", "value": "T13913F217DAFDE24BDE9B32B6438FBB6B5D40F036F91899D259800FBB4149F5486210D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574136, "uuid": "947192cd-2fac-4d4c-8ed3-d72c1e94f95c", "value": "768:VI3ftmj/yCf23h80aowcquQXPhXnyDXG5ljVUiHLcFh8tDxVMSS+3sjbBLqnbcuF:VO9Ikh80aowcmPNnymbvLcz8djDXkbg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574136, "uuid": "29654030-22f8-42f3-9c24-d96a601bcb56", "value": 44376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574136, "uuid": "47aea4f8-bedc-413a-9030-4e64cb695208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574136, "uuid": "b91bf65f-2e9c-49ac-9723-00a7af5300e1", "value": "784a65412fd70d644e76b4201d56bc215e81342141a53e052a5095671220da7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b140a02-8426-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784543542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543542, "uuid": "04011e19-9a46-4b34-bbde-01d72bfc5b98", "comment": "Malware payload (RemusStealer)", "value": "00773d77699aef348fa12699a0481d7a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543542, "uuid": "be75eddb-477d-4a93-87a1-306f0970134e", "comment": "Malware payload (RemusStealer)", "value": "7850ad1925c856904e98fe820decbda81d0a3355239a9f1be7e40a8a34d34754", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543542, "uuid": "1821e1d8-ad02-4df8-9a94-e89dd6a8180f", "comment": "Malware payload (RemusStealer)", "value": "369fbea34dda064d1b2fa4fc80a943e0b3a8aca1", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543542, "uuid": "50b6da53-8a8a-45d6-8f2d-fa6f09fcb665", "comment": "Malware payload (RemusStealer)", "value": "d84d38126419cbb053ff99dbb5efe5ac533a4cb52d3d654afa6ed98dcd3a93a37f6ce9c4713e033047c0b62df56f4e5b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784543542, "uuid": "d3b5fd8c-4ae5-42d9-85f8-617cfe7f8d46", "value": "T1F5C549177C9189F9C09AE331C9765286B771BC490B3133D72EA07A782E767D09E3AB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784543542, "uuid": "5e4fb606-8e29-48c0-89d2-35b0fe61ae1a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784543542, "uuid": "43a53dcf-bc54-46d1-a715-d74c4f933bc6", "value": "49152:BNLYr3pwbn833sfCVdCbqqqcuiAbsYv+sg:BN8d39r7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784543542, "uuid": "7223501d-75cd-4c43-8f95-dac503848fa9", "value": 2588016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784543542, "uuid": "8e4e1bb1-8662-4c93-9b59-21bc388b9e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784543542, "uuid": "f28a39e1-56a5-4279-ad55-9b9a670aadeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57232014-840f-11f1-be1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784533684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533684, "uuid": "0be9c0ce-4793-47c3-9554-6241952589f4", "comment": "Malware payload (Formbook)", "value": "aac21459dc203d21c539a72d54221102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533684, "uuid": "9fbcbc52-9de6-48fb-b510-b340ec10eeb2", "comment": "Malware payload (Formbook)", "value": "78e53037a3b94c1a14f4c8283f27b1b9b6a0601515fe6b4cdc28ac8fce9b938f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533684, "uuid": "d5adc643-19e8-4996-b91a-e3bbcb9158cd", "comment": "Malware payload (Formbook)", "value": "61a27756cba4c8be0a6465912de786b90f6f8de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533684, "uuid": "519487e5-67b3-47c7-b2e2-6e99b9323465", "comment": "Malware payload (Formbook)", "value": "a0605d27667fb583089c1ea129692d69e16495e6c11efec2e6f247014b7f78cbef13a31a1015b192435756f857252390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533684, "uuid": "7237a084-2f28-496c-b281-a0aa7292da3a", "value": "T15E4512987B94CF06EAB58BF009B1D27443785D6A6829D213CED5BDEB3A35F006D21363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533684, "uuid": "953b0df5-cd4f-494f-a3b5-484ed2fc1822", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533684, "uuid": "ab5eba57-c1a2-4770-b356-960f0c844aa1", "value": "24576:R76j/Og3F8+1V1YeXzHkJsnUyglVX3Z40/xFtLKvGi3X3N:6PV8UV1YEas4J40PtLovH3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533684, "uuid": "f2ca9f54-fc0d-46b9-a674-ee9d2e3479d1", "value": 1204736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533684, "uuid": "b42dbc6e-6f60-4d42-b076-5f2b7f7a6c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533684, "uuid": "817fdaf2-1a99-473c-b9bb-2e869e540197", "value": "RFQ-EQUIPMENT#00155890ME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5819621-8434-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784549734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549734, "uuid": "251379d8-0403-4b92-90b0-da5600cd1337", "comment": "Malware payload (WannaCry)", "value": "102988310fb96651bb2d3ea4f8fce139", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549734, "uuid": "d9a4f854-3042-421b-a7c3-2276b37416d5", "comment": "Malware payload (WannaCry)", "value": "799023c3e0098de576fe7bac2a2d3ecf75a579e22e828468811d0efecb4eb0f2", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549734, "uuid": "8e696a1a-692b-415f-bea6-cc137e53f35b", "comment": "Malware payload (WannaCry)", "value": "636c5960efa575add8ba577031c155c4070d0ce9", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549734, "uuid": "1bba81df-d021-4da9-8d41-17f818717926", "comment": "Malware payload (WannaCry)", "value": "2ea3f55a875fca7dd9bbacdf37135ff5090a3e78b864740389d579e2d97a1ae1369dd6d09de0b9b1c9b5d26269f93337", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549734, "uuid": "d36e154a-4e57-47b5-8ba0-afd567b47068", "value": "T1C036338921ACA1FCE05517B494B38E26F7F37C4963BA4B0F4BC483AA0D137966F94752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549734, "uuid": "ff3770d0-4a3d-4a0d-b0d9-311fe542eefb", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549734, "uuid": "4e24088d-7c20-4f5f-851d-8567cfa77fa2", "value": "49152:jn2nAQqMSPbcBVQej/1INRx+TSqTdX1H3MEcaEau3R8yAH1plAH:DyDqPoBhz1aRxcSUDc93R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784549734, "uuid": "bce1afe2-d0bf-4511-aefe-e698f7f3087c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784549734, "uuid": "c72260b5-952c-48ad-86a7-ec6f478954e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549734, "uuid": "cc7863d7-2761-49bd-9704-8624956efa94", "value": "799023c3e0098de576fe7bac2a2d3ecf75a579e22e828468811d0efecb4eb0f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a5335b-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784534210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534210, "uuid": "7f489cf9-05ab-468c-a817-7e93a24c61fe", "comment": "Malware payload (Vidar)", "value": "ea96de1d5ee80bbe8795d352f7ac3e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534210, "uuid": "9e99dbaf-3761-46b4-bfa7-14431b3cde2d", "comment": "Malware payload (Vidar)", "value": "7a8f47c4a4d9870b838791d51abafab65b8279e5c347add2b7e5aaa0222ab84a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534210, "uuid": "bbd90892-80cb-4bf5-9185-927e45ab61f9", "comment": "Malware payload (Vidar)", "value": "1a096f222444db6d4a189dc14d0461423e7bda96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534210, "uuid": "beb154ef-e708-4514-9a1d-6b56ce6a7fd1", "comment": "Malware payload (Vidar)", "value": "baea3d1ea940aacf646d2d1095740d3f4b558e8420df116457cd2971416fff50fb3ea43d1e17a27eedacc9bb4a87e903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534210, "uuid": "2d030af3-ed06-4636-b588-81db37d6e6e3", "value": "T12F521CCAF59771B9D198C2BCCE8B69AB9672708707090FFF86DCC41866D20003EE9756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534210, "uuid": "d325b14c-08b5-4fd7-9b04-58061ea7b875", "value": "eaaf60cd5c7253068dcdb6306a8561f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534210, "uuid": "34b1242c-7f79-469b-9c33-b00254a4fb06", "value": "384:T3is+oklj09wTMFtl5VCQwQjkl5eVsvlbpUTSThrEfElRi:TiRokNYwTMFD5VCle+b+TyhrjRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534210, "uuid": "8f81d0cd-91f3-4545-898b-1dbc0a68cf0d", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534210, "uuid": "cc720cd2-69ba-4653-a7c3-2102e95c7371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534210, "uuid": "663da5bc-0590-4036-85d6-c70163161f8a", "value": "ea96de1d5ee80bbe8795d352f7ac3e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeff169c-8477-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784578499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578499, "uuid": "5e892da0-00b6-42e6-8f66-04ab4bee2cee", "comment": "Malware payload (Mirai)", "value": "1f0191eb33489a385be4f7628e59de76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578499, "uuid": "b568158a-39b9-4727-b024-9bd881cb7ece", "comment": "Malware payload (Mirai)", "value": "7ac23035d89498bc3d3b148d726bb072a07f7e579b55618ad5f686ef7048ade1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578499, "uuid": "5aa3a8bd-099e-462a-9b19-710b92ec0874", "comment": "Malware payload (Mirai)", "value": "75074dbd59dd4974b22c3a4e7a8a6acebe34dafb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784578499, "uuid": "dd28f9b2-1fde-4983-83f5-7805c174e076", "comment": "Malware payload (Mirai)", "value": "b6e70f2c6cb336232f0b60c0f3c7b553abfc964bdffda59c36daf3a47972b1a7ad89fd590abca39ff5aa9bc2db9fa0d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784578499, "uuid": "fa2ca667-53cd-4adf-a7d2-8ef20d36aed9", "value": "T15323F2F7212BBAB5D123C072ACAB53C0BD15B9595A479B2F1FF571488DE118C0ABDC42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784578499, "uuid": "85903b10-0db6-477d-99f2-8ee6a707d5b4", "value": "768:0ACjszYEfRY6jvJyiNQ5iP+h0b3WvnjEoTUV6tk7jihQ283xRGpPSkeNfx02y:zC6YYR1jkiNTPe0bWvINVdKhQZ3jGp6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784578499, "uuid": "ba6073b6-8018-4359-bd96-fda05fcaa8ac", "value": 46776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784578499, "uuid": "d02f0248-31ac-4eed-97c9-852c8802469b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784578499, "uuid": "8ad13e26-02a0-4d7f-b090-6967c640e4fb", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18af0a82-843d-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784553336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553336, "uuid": "043f2203-069c-47a0-9e3a-830d22d6c673", "comment": "Malware payload (WannaCry)", "value": "cbe634977c3347c4661d10ab66786b9f", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553336, "uuid": "1e6d49c3-ede1-4dc2-9778-74641f088975", "comment": "Malware payload (WannaCry)", "value": "7badcc939f598bb1e7c78e1a2aa59969b185ed50625bf257cd6adde96415db09", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553336, "uuid": "f7dc9a0c-7df8-4883-93ac-756bcea59b3e", "comment": "Malware payload (WannaCry)", "value": "f48932f89d74644ca4384d70236608503fe4d529", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553336, "uuid": "8f1aa395-bf75-4c33-8d43-d2b734088460", "comment": "Malware payload (WannaCry)", "value": "f44cd3214331d9f998980a1e7a807506e80685d90382bd1d861c37c49c8c1aef061444ce0659c425b69eb56f56033010", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553336, "uuid": "64cfea7e-9645-4c66-b70a-94e8148bca91", "value": "T10736239932BC81FCD10625B484BB8E12F7B37C5E22FE5B0F9B40896A1E13B55BB50752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553336, "uuid": "78ad4663-255b-4948-a8de-2c8d4fa16d16", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553336, "uuid": "68f17bc2-898e-49c4-ae6d-130a87b3f22f", "value": "49152:jnsnsEMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARd:DMfPoBhz1aRxcSUDk36SAEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784553336, "uuid": "eb51fe9d-24ee-4417-ad28-d3e163d16387", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784553336, "uuid": "676e6747-e429-4800-ae59-2e46227c7d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553336, "uuid": "32338f8c-edd2-4a35-9576-cc1fb35c6a82", "value": "7badcc939f598bb1e7c78e1a2aa59969b185ed50625bf257cd6adde96415db09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55311776-8437-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784550861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550861, "uuid": "1fbd638d-d3a5-4942-85fa-0f0e37778eed", "comment": "Malware payload", "value": "43e3b2fb8130398f66f6316da87faa5a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550861, "uuid": "fcd27eb8-b181-415b-b120-4c42a96382b7", "comment": "Malware payload", "value": "7be45c24e3fd18a88de8b66b7b79756e443aebfc663df7e4ffc4e60d4c944ebe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550861, "uuid": "68287a12-697d-41bc-a834-14ffffdd961a", "comment": "Malware payload", "value": "87d53c835081d4370abc0b88c1d1296bfc8f6d2b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550861, "uuid": "7582cc9e-7415-4e60-bc2f-905739536159", "comment": "Malware payload", "value": "1dc93d945d580af3da043461638bf0e26d15be857eed1b041aa57b95baf89260850665cb48061e7828e907f95344f204", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550861, "uuid": "a50c3e03-c065-45e6-b32e-22fe2d406f67", "value": "T12A016FCA91609900405E995D62E656A0B470C3C756470FAC7FAC942DBB48E14F036F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550861, "uuid": "b770b922-9a43-46fe-8d1c-21533e7053e3", "value": "24:kXCKysE2hi0ziQvZohaTX/h34X+BsAT4Z7:e9Qp+MsLJ34X+OaY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784550861, "uuid": "8d132650-9e38-43f2-b75b-2956f6f04b6c", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784550861, "uuid": "397d141c-28c8-4f5f-833f-75deb7fd4191", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550861, "uuid": "a528ad7d-766a-4799-98ad-aa4323df4f94", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcfd16c-8434-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784549637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549637, "uuid": "3d1f6ff1-fe37-4840-aecf-79dc9794cc80", "comment": "Malware payload (AgentTesla)", "value": "dc8ec9195a2dbf5c7478423291e84b7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549637, "uuid": "ff23ee79-2004-401e-8dfb-f8f7f664a400", "comment": "Malware payload (AgentTesla)", "value": "7c2c94e5e0441e7f085ce775354ec307471e7221ce812232b80f68bb570fe1a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549637, "uuid": "42f72ca0-290a-4fd3-b8eb-8c40b34942cd", "comment": "Malware payload (AgentTesla)", "value": "fcce4256aeaab7ae51c1f277d2740facafac38f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549637, "uuid": "ee38b380-a374-4432-b8b4-3f530e2e710f", "comment": "Malware payload (AgentTesla)", "value": "dc7cb43de0f372f9fdf5a34bb4c6f4f29d32b6ee6f5c7c7bae182df36ea9b42f3ea11cba815cc2852c160f957694fd0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549637, "uuid": "2ccb94a8-00e3-4580-8441-632bb5528065", "value": "T149F508509B5460B6521DD32CD0BAEF78C84E200320E9CF8C3D9D6629B659E57A39DFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549637, "uuid": "1f369d0a-9dd1-4c8a-af58-7a0e7e5d5c4c", "value": "98304:Y0j3iFjpP6EBjPwZcKAJER3s7EQclOKD0NCI5fSj6EiSjkB:zjiVZ6yPB57ErYK6qj6Ene", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784549637, "uuid": "83363244-2d67-4ff9-ab7f-f9d357c75ba6", "value": 3574763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784549637, "uuid": "b4a2f3f8-2369-48c1-b3ad-f6f7f521a7a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549637, "uuid": "b3a6fdb2-0d27-48f6-b8bb-7e34deeabad4", "value": "IMG-RFQ-SRYG-REG#016125-July 20 2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fea5ff7-8437-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784550986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550986, "uuid": "a5906cf1-d7a4-4a5d-8ec8-9c26d8fb8963", "comment": "Malware payload", "value": "02a9142697c19f955110150f7fa60b64", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550986, "uuid": "0677614e-bc1c-4f8c-a80b-4844426b6992", "comment": "Malware payload", "value": "7d96363a3aa804353f97e4d538f10d67699fce7f2372c36d4e758bc95a31a8ad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550986, "uuid": "6aa7938a-0ace-4c1e-b6d7-6479ccfa7405", "comment": "Malware payload", "value": "0ee55b5f5591306b7fd8f24a19fba9900a06f412", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550986, "uuid": "07a2679e-e274-4154-a707-b1c930b5cf91", "comment": "Malware payload", "value": "e2b4daf9ae6a56adf1b5da86b3ff560c09f870c99c5e7d0c43151e957cbde1ee3165e458f809233086d0e68beb872ba3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550986, "uuid": "c32b3c10-90c0-4e88-a5b0-a99bb0c954fe", "value": "T1E0C27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550986, "uuid": "6a8774f5-03ec-4aac-8a19-1e4ea6833711", "value": "768:yR8vCB+25j6es8RB9FYpMSUpi+20qUpi+20YQX:I8l25J3d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784550986, "uuid": "42724787-74f3-48ce-a121-5c61fe675ad8", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784550986, "uuid": "c7461887-32c4-4875-a5e4-2759c7c57c1c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550986, "uuid": "6db2d907-5444-42ad-990a-136ce59433f4", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8bdee7-846d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574172, "uuid": "c491108c-ab16-4644-84ee-93f2f5ec3e50", "comment": "Malware payload (Mirai)", "value": "688c7fbd2963a11e31b8b3e48df43116", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574172, "uuid": "aeae39c0-4ce4-4be0-a708-c53bd5817e49", "comment": "Malware payload (Mirai)", "value": "7e01456e9aa44adb6fbffe5cc2985c04f4cf51e0f730b98a24ee66c9e605c80b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574172, "uuid": "7311b73e-b68a-4d1c-b0eb-237fc1673fd7", "comment": "Malware payload (Mirai)", "value": "9420baf2a6245c7e5b548d39966cbba1c01c0ec8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574172, "uuid": "6684ad35-9654-4aa6-9b03-997833b928db", "comment": "Malware payload (Mirai)", "value": "7f9afb4e9b6c0eae0168ce6ccccd4734583af635d2afb04d83aeb529ca9b872a9c8c622e1cfde9b915f86c174900b8b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574172, "uuid": "37e59d11-e7f5-4026-8e90-d18ecd33dccb", "value": "T1AB937DC5FA47E5F5E85605343136FF379D76E1BA2228DF47D3A88B326C22642C80669C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574172, "uuid": "c378183b-c81d-4755-97b1-2c3704d85c39", "value": "1536:9t7j/UO9RB5C5axWypMOuBRGzS2b2KWRI2sRLE1h6NIfCdsx5gQvZ6iS3htdFh2X:D7APw0ypLewzS2WcA1oIuE5MiS3ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574172, "uuid": "2c858f3e-4d32-4fcb-84de-f3d8f10551ca", "value": 96596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574172, "uuid": "01a2b5f2-d585-412a-8bde-a4035a4d1573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574172, "uuid": "7a8c12ca-a57d-4384-9c8c-ff010b3f38c7", "value": "784a65412fd70d644e76b4201d56bc215e81342141a53e052a5095671220da7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d286574a-8439-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784551930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551930, "uuid": "55999c8b-fb19-4f1c-bbb6-d6e2bdec62ab", "comment": "Malware payload (Efimer)", "value": "0f05070f03e87c4f5827e4dbd3a9b254", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551930, "uuid": "9b49cfb6-1445-4909-b420-0a4e956eead2", "comment": "Malware payload (Efimer)", "value": "8028b0873c7780cd21d746e5869b23560f619710318d427220afe96668d8e600", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551930, "uuid": "1beb3c33-3344-40dc-b641-d90aa16fe8d7", "comment": "Malware payload (Efimer)", "value": "487fb26f9fa042e1fb15697fbbb8641b7245eded", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551930, "uuid": "029fe4c5-dd37-43ef-b9dc-a2128f336828", "comment": "Malware payload (Efimer)", "value": "2a4c454b1761e535b8ed0c18649254ee254c4742b8a4aa7d2e2935e5347203490f92f09513088263ece3e4673b7a69b3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551930, "uuid": "a83a602f-a0db-4bbd-8b33-181f8be08545", "value": "T122E63318AAD053EEF6B6813EDE56449BC5A47CB64731C5CB531083A2AE231F08D3EB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551930, "uuid": "b7cbe432-8055-4d2a-b21e-4f8692665dc9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551930, "uuid": "886214f1-bd2d-49bb-8af7-2551590df6ec", "value": "393216:d4FnnT8n4OnwgY0ziXMCHWUjXzcuI3/PGTAI:d458n4OxY0ziXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784551930, "uuid": "53be1c01-1411-4261-88d3-92f91456ed90", "value": 14318980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784551930, "uuid": "ac0444d3-48f1-4313-b5ca-0c3d758fb44b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551930, "uuid": "8f5254aa-09e5-43af-b264-741f5d66c974", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ca9c4e-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784534239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534239, "uuid": "84efdb49-1b35-4038-90fb-f82b2e58788d", "comment": "Malware payload (XWorm)", "value": "d1dc20911470ed43af8bce0355fd0cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534239, "uuid": "8b44f831-2251-4266-9562-3991923a9df0", "comment": "Malware payload (XWorm)", "value": "80571d10fe416a63ceb0c3b582c547573c41c1b1108ebda0e5604edf4532ff97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534239, "uuid": "b4018765-f45f-420e-b9b3-1d18de783f62", "comment": "Malware payload (XWorm)", "value": "cf7fa092c3cec9deb2bb4a008535f540a6d1ec46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534239, "uuid": "e9088815-6469-4fa5-b952-f89e4daa2c70", "comment": "Malware payload (XWorm)", "value": "fd55601293288bf104adaac27767a6b94c6c9f69a4c7257ebb50e2d5b5cee02bd05e9925d800414ecaff1f3cfe8dd188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534239, "uuid": "433f4937-18f1-44f3-980a-cff9dd2e86a9", "value": "T10A15121C6A48C901D1E20B719470F3B953F26D4DA932D31B4FECAF9B39B67065D18B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534239, "uuid": "07a61b31-7743-4ae9-b487-4e2aa63032da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534239, "uuid": "c3a80179-1940-4a8b-944c-b5a92524eca2", "value": "24576:bFduf32/KsksCgDEuadDh8qmJLwh6Ylc:RC32yEEPDh8/JUjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534239, "uuid": "dcf1d366-b763-4531-abff-9cd09ffa4c09", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534239, "uuid": "1ee25e40-a63f-4b25-ab2e-cdce7e1a4109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534239, "uuid": "70feea8c-7366-4f4d-8646-80473867ae67", "value": "payment_0026 7514378.DOC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee7a703-83d3-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784508169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508169, "uuid": "2f7e19a2-ae8b-4e8a-8fcc-67aebc2606a2", "comment": "Malware payload", "value": "b7cc57affdaffc545e99cca3dffbe4d3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508169, "uuid": "3cac2a89-ccdf-477f-8483-09a3c230eb02", "comment": "Malware payload", "value": "81962ba664cb7cd0865577bc257c1899bfa18df9f2d48482d3fb8b831058e60d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508169, "uuid": "90c8c239-1a4f-4096-a5f9-057625b35df2", "comment": "Malware payload", "value": "905d7f6d70681f9b6651fdd241a835e542313a0f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508169, "uuid": "66025f9a-4dc5-4a9f-bdfc-545097c413e8", "comment": "Malware payload", "value": "1f51e888550466a2c73876005b52ef88e7c7b6a60f6d15bdcd0f40eb57eb51828a34fc9796df616a0d3b72fec6e1d250", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508169, "uuid": "eb553b14-398e-46c0-aec6-eba102357dc5", "value": "T156018ECBD1249900609ED56C22EB5154F831C3CA1D4B4B79FFACA47A9BD4E14F0AAF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508169, "uuid": "a0e65c9b-498e-44cc-9240-338a556c072d", "value": "24:kXCKysE2hi0ziQvZohaGF4XFOy6ZgMi+8uX:e9Qp+MsS4XFh6ZgMi+8uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784508169, "uuid": "6bf26bec-73d8-4f89-912d-cad3c73c8fe1", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784508169, "uuid": "0b1e7bd0-8ee3-4310-baab-4d93ba76e161", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508169, "uuid": "e9846ac4-2cf3-458d-b275-0d16b307d94a", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33928058-8442-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784555529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555529, "uuid": "fd089a65-d996-4691-a1af-b30f89024773", "comment": "Malware payload (Efimer)", "value": "98c94c0841518d702535af308ceff685", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555529, "uuid": "4894c0ec-aacb-4b18-8ccc-32577df2a6c3", "comment": "Malware payload (Efimer)", "value": "81c1d1cdeaf0e551444a1ac4eb79e14b048e2fd439fa808868524dc8e6751721", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555529, "uuid": "5f5feb12-66a7-4209-ae90-b8bc1abf66ae", "comment": "Malware payload (Efimer)", "value": "d7c54aaf4024d0a1780d49b78213da01c7e7cf08", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784555529, "uuid": "b51c25e2-6703-436c-9045-97491ab53810", "comment": "Malware payload (Efimer)", "value": "a34c3817025f4b57088a0fe5dd32503d38615ebf993d4d426975fe3a74d940dac0f69b8aac7d5f1101aa23d172c89630", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555529, "uuid": "6dcfa342-47dc-4b90-878e-1b9f5b534bd0", "value": "T183E63319ABE621EFDEA3913CE6B11E96D07038761B31CADB03E853A45E5B2D01D79307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555529, "uuid": "a5622a65-da97-4ab8-a4d8-ae0eee5d1ca0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555529, "uuid": "32899f24-7156-4661-a0de-de798455089d", "value": "393216:rOv1hM3xfKyi2NVj4iTqJ5gLb8XMCHWUjXgcuI3/PGTAI:rEWxfFNeiT+I4XMb8X1H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784555529, "uuid": "bb9283af-ff2b-423d-bbd3-b48993ff3f49", "value": 14310839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784555529, "uuid": "cbba8675-912d-413a-8859-f8e26e682803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784555529, "uuid": "21b87ae0-ada0-4cc2-8a3a-bbe2de4f2f6c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f743c8-8445-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784556935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784556935, "uuid": "2b7fd6f6-5e4e-4723-9083-e3cdb55dc543", "comment": "Malware payload (WannaCry)", "value": "acca78ce172c1dddc5bf3beb4fc21d45", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784556935, "uuid": "6031083a-5fe2-4692-a655-21e6173c25bd", "comment": "Malware payload (WannaCry)", "value": "82916ed2c0fbf16c53751b50cf1561fd24c74df957d6dcad490c35b7da8539be", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784556935, "uuid": "c7bddf7e-f193-4537-abfd-a49184a781b9", "comment": "Malware payload (WannaCry)", "value": "7a7e3f7f06cfe775cc70376f8009970c5f13c1df", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784556935, "uuid": "8167f29f-c67d-4153-b2d5-7c8337ce49a5", "comment": "Malware payload (WannaCry)", "value": "4374c5475e92fceb09e79aae0be79cd4db3130b9b0d22a8edbb9ad9ade052aa3d9ef1f131aa58ea1f58ffaf350c91923", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784556935, "uuid": "f974e92b-02a4-4437-92e9-7d47498afe9e", "value": "T19F36235E327C91BCD007237994B78E27E7B37C5A22B99B0F4B54866A0D03795AF64B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784556935, "uuid": "4b0bffe6-8440-4dfc-8030-bda482f983cd", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784556935, "uuid": "d86332c1-4eb3-4294-96b0-b20b6c1761e8", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626:jnXnAQqMSPbcBVQej/1INR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784556935, "uuid": "01eb9be9-e79a-4d46-8258-c945ff3d285b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784556935, "uuid": "e81900af-986a-4230-85f7-2af46c64696b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784556935, "uuid": "f37666a3-f558-47ce-bd77-421c2b9f42e2", "value": "82916ed2c0fbf16c53751b50cf1561fd24c74df957d6dcad490c35b7da8539be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dce0384-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784525079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525079, "uuid": "474c6831-22e2-4cab-8f8f-a3cdbb84cb24", "comment": "Malware payload (Mirai)", "value": "9928c862c3b594f96b667276344f4135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525079, "uuid": "cefa2059-7a1f-47bf-b1c8-abcfa7ef45fb", "comment": "Malware payload (Mirai)", "value": "837c2e287aee1334e323ce14e2db1f5be0dedf6a7fd584f761170cd378aed34b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525079, "uuid": "969b3d77-1d45-49a4-acf9-fc9a25f3220c", "comment": "Malware payload (Mirai)", "value": "9e175aa3b7490e069d90c38ca75fec9995781fa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525079, "uuid": "ba57283c-b8e4-453e-8f68-f45679f6e189", "comment": "Malware payload (Mirai)", "value": "e4c93626d174e55531baa942fefb37e43e77c6bc6ac6545f621de47fd0b07eb4268bd9e8e048b321277e167266d604f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525079, "uuid": "7faf31ef-9da5-482f-be8a-0389760755b9", "value": "T10ED3E746BD518F13C5C321F7FBDE429C3B166F69D6EA32029925BFA037864D60E3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525079, "uuid": "11792c42-71a3-4c6a-b8a0-efac53d161f3", "value": "1536:+tiSeUHmDOAt/594Vo8570SP+Ul7UaKA/1yYe9nSlUDwywVx0KXm9d85HOxIa6an:KGDO494l5wSPWaKtP9YYHQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525079, "uuid": "62387ee4-447a-49a7-9c86-ab59b4fe1c1d", "value": 132900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525079, "uuid": "d89c05f1-5f31-4418-853f-054ab1716f65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525079, "uuid": "03e9a917-052c-41de-952b-9577acfa6d42", "value": "eclipse.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57704f8e-8470-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784575346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575346, "uuid": "2a1d9bca-7145-43bf-97e0-6ac4de2fc898", "comment": "Malware payload (Mirai)", "value": "ae5ed82297cf4b4279a40b63e6889902", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575346, "uuid": "d052023a-226a-4bcb-9637-6efdd37acc3e", "comment": "Malware payload (Mirai)", "value": "83fee47d6e11339cbd8af4546a6db2e7b4b29387533f81e7c082d44cafe3ed56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575346, "uuid": "6b7b1b42-8486-4b0b-aa86-e51dc1f98cb5", "comment": "Malware payload (Mirai)", "value": "20f54d041e1e9dbb5ef3ea335df9aee4135f1a36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575346, "uuid": "0f52bc16-7a27-43fb-b7bd-eb2866783d2d", "comment": "Malware payload (Mirai)", "value": "f99b1a67681d7c9967d400157e70d2292e4fc9a8878b373b3489999a966471faacfe27e7c70f971db9bf5d1f8e15f259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784575346, "uuid": "3ab73604-6e9b-4ba9-9b4c-c3b23f6a8a04", "value": "T1F304F80AAF601EF7D86FCC3746E94B0625CC645322A43B757538E928F64A54F4AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784575346, "uuid": "2fb4d4a5-801c-493e-a0a0-3f0404504022", "value": "3072:rLwsaiCL6tXkpTPIAQwQoRrHUphJAUIW38XMxqHOnbv:vwsPkPQwQoRrE/bIQ8XMdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784575346, "uuid": "93a5e5ec-1766-4686-85b9-7d5218ff917c", "value": 180432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784575346, "uuid": "90732111-e890-4dac-b9f9-0eb33a3c9a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784575346, "uuid": "37aa68f6-0397-4498-9b23-5b6c14db316e", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7393711-8473-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784576768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576768, "uuid": "944ccea6-7966-4fe1-82cc-4a7f7cc5dc9c", "comment": "Malware payload", "value": "8bc77047dcd261da4ea5bcdd26db60b8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576768, "uuid": "105906fc-2711-4cc5-8511-479d9ccd2d95", "comment": "Malware payload", "value": "84d07f96725bc87d56f68936dd3879ffe67f1f8d694be9fbc4edd4a6d9a44615", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576768, "uuid": "65004bbe-6c3c-469a-8448-c7548626440c", "comment": "Malware payload", "value": "7f49f6100a34e96847c741130683a3a8e7f0a0ae", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576768, "uuid": "40c9abd9-5dad-4af8-b6dc-25b23931eaa8", "comment": "Malware payload", "value": "c4078830c77b5a6591d19bf1be20e330af94cc789dc377a95b419e3ab9b11185365feb70ced1260a5aecb30eff9f3e0e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576768, "uuid": "d260726a-91be-4dc3-b20f-1be69c02bb63", "value": "T16A65E1E29F3BB41C979C4721D24FA64C2E854CD80D93B8E174DA0ACD67F622752E35B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576768, "uuid": "d3f16ee1-a22e-417d-9da0-5ca6fb2c3665", "value": "24576:MGixYhKvR/kcpIS+O6hmbI1QGqkecRCrdBcp6G5DXc+Lc0fLaQ1U5bz9Y7/mxru+:Mp/kcOQ07EcpPcg1YwxnXkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784576768, "uuid": "b2b9d986-d096-4eb9-89bd-3db079f48baa", "value": 1502040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784576768, "uuid": "7579ee5c-54d8-436b-b83b-5a312730cffb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576768, "uuid": "ca6e5c35-e91f-467c-bca1-a9cf027e411d", "value": "verification.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca17da9-83da-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784510796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510796, "uuid": "94bcecf7-274c-4be0-9d57-c7914d14b4f8", "comment": "Malware payload (Mirai)", "value": "e35d65934cbab5a9ef8f39dd696f8f63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510796, "uuid": "cc57d5b7-3e37-4e0b-9ff2-a4bbe8a7a718", "comment": "Malware payload (Mirai)", "value": "850847440cf308046af0139b1c74e7059d19e82f591705f772d4568d854c1079", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510796, "uuid": "4e905925-f5ea-468e-b24a-c005872d9093", "comment": "Malware payload (Mirai)", "value": "0f237f04c82843901a888453ea22ed096fdf3b8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510796, "uuid": "53445d16-baa3-40cd-8f22-932fe8a87e85", "comment": "Malware payload (Mirai)", "value": "e3afbd159d9fd9225c5d3a651547c01e23f976a2d214ad2fa8c5d9a65f482e359582312501105c814e4f5624e8053c40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510796, "uuid": "17188ca1-ca4a-4c5b-b70d-e3d038c98b2c", "value": "T1F6632B84FC928AAEC5C01779E76EB78E33627391D3CB3213CD145B1127C96CE5A66B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510796, "uuid": "a9ae9690-6681-4adb-9756-9eb5d0134dde", "value": "1536:jDG2SlV+9Ji3Krb/DqKBz8nZ0MN1k7MaqG1chjSFFl0:jDG2o1aX/+KR8nWW1k7APjSPl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784510796, "uuid": "1f01db1d-490d-4616-a694-ea0bfaa4e10c", "value": 72156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784510796, "uuid": "41b380b2-708c-4af6-ac0d-435959dbb151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510796, "uuid": "85a324c9-5d48-48c5-8a24-f662e9ace5e2", "value": "ohshit.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6b1e04-840f-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784533908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533908, "uuid": "5ff103a0-bd8c-49b7-b5a3-12f32ef18df5", "comment": "Malware payload", "value": "21dbe33ead002f6dce988d4e4aed5941", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533908, "uuid": "ab7d70ce-7d21-4573-9965-fb4aab00988e", "comment": "Malware payload", "value": "850c6f47e765f8d386025b81b5efcbcd66da777b959961f310b40e3d014df34d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533908, "uuid": "4dfb40d3-1478-4ef2-9913-64ae6af247c3", "comment": "Malware payload", "value": "bf6f3b0e88c5e8df57f41b494fa361267fb98ea7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533908, "uuid": "5384c4ff-689b-4f99-ab3d-77a5637894f0", "comment": "Malware payload", "value": "7a564227486cf4efd68cd1e31ef95588f4fbd34d1e069d2d6eb34a1c2cc42c3db9e43edfec2420d2e2ed336eaaceef40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533908, "uuid": "0b754c2f-d7e5-4bf7-9f8d-b8d0ceda05b5", "value": "T127D312C3A31E3B34E6759C3EA5E01148FBE07927DE5B49B55E93A0AE3C01B21E3A5D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533908, "uuid": "2317eb7a-7f4d-4361-b2a4-92668a030297", "value": "3072:1e2SEoEFgNYYh36l+AAjCDuUqWxPLxuH8Q74i:UPkFLYJ31ODXK7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533908, "uuid": "642712db-cb58-40b3-96a7-4bf001879a20", "value": 132372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533908, "uuid": "804522dc-6b56-4a20-ad9a-88791e6eb9c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533908, "uuid": "8cf75007-e7a0-4296-957e-9e407b536892", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa58b85e-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574626, "uuid": "c68bd86a-983d-4047-8ba7-43127ee13bb3", "comment": "Malware payload (Mirai)", "value": "c89d5fb4fe5960cbfa4025fc0c0dc405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574626, "uuid": "d4e55f4e-ef4b-458e-8cab-6d3ccadfcb3b", "comment": "Malware payload (Mirai)", "value": "851c8c27ee6f1fc6eb736c01aba177be69bb7de7a7daa7e274bf1aaa5d1596e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574626, "uuid": "3c782e74-f453-49da-bec2-09367a93e995", "comment": "Malware payload (Mirai)", "value": "249c8f6d9a9cfccd449c630eeef863dfc6572230", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574626, "uuid": "30410ad8-b489-43c5-bfbc-5213a0f49060", "comment": "Malware payload (Mirai)", "value": "5b461f0d29ae8369cd1716ab5311c5bf33b0d32645d990473f0773cc8160aa4fcba89b400d9a719c885fba0ef0376e28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574626, "uuid": "c21df8e1-39de-4166-b69f-b16a786f7cd0", "value": "T1555309C3E903EDB2DC2220B816A757619936F5363831B943F7693EB0E992AD1D90335D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574626, "uuid": "907d74ce-9b9a-41a0-8d0a-cbeb6b7f0493", "value": "1536:lLr8NmCDYat2XN3q3mAm8MtIClf4n853hd52j/fEYCBHjyq+6sjHxheXxa6HQfpC:lL2dwa39m8MtIClf4nI3hdcbUc6sjRk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574626, "uuid": "8cc5329a-a95e-4647-80ad-f806a3e08127", "value": 65564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574626, "uuid": "cef96fb8-4837-45f8-8d9f-d89d8e0f2700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574626, "uuid": "ecf63c96-1d35-49e3-8329-e49144cafaaf", "value": "nullnet.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fbf3b5-8414-11f1-be1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784535744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535744, "uuid": "4403c1c4-5bc1-41b5-8530-eb1f5e7cf798", "comment": "Malware payload (Formbook)", "value": "a3f6cbc6b8366c4378504eedbb2408d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535744, "uuid": "b212d99f-e2bf-4375-89d4-87c2d9436f99", "comment": "Malware payload (Formbook)", "value": "865884c27b7ee53c1744c183ca07ce310b4485dfa085fe3ed3c658e38f7d99f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535744, "uuid": "182b6b87-8371-4a53-8828-fdf56f4d8d38", "comment": "Malware payload (Formbook)", "value": "ea88765037a10234f4558c076d3bb1805fe402f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535744, "uuid": "d9b092c8-0b7d-4731-a54d-37746efd5320", "comment": "Malware payload (Formbook)", "value": "c9926b8980808257b7112dd94dea8f6442e7adb4975aa6ef580c12f21f66ed566935e67f7dd15684f61d03465e02f77a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535744, "uuid": "0a076d13-3e5f-40bd-938f-d76143da3ec3", "value": "T1DF25129872E9EB0AC5B847B08AB1C0B4077A6D6ED431D30B8DE97DEF74B17451824B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535744, "uuid": "bbe6dc7e-e5b5-40e2-a9e3-c0ad13d75865", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535744, "uuid": "80719bd6-70f6-4f30-9133-27846604e699", "value": "24576:Ipj/Og3wyrEm+xC5PRvfnmn6X0R3SOVyohNPHtc:EPnEm+xiBnm6X4SOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784535744, "uuid": "d52af8d7-bfb6-4e5a-bca5-43fd6ca3897a", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784535744, "uuid": "6f4877c0-686e-42a2-85cd-b57f488648e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535744, "uuid": "7162b6d7-a70d-498c-8925-4675ae571c86", "value": "REQ Quotation Order Requirment Spec NDKWTDHSSS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3848d466-8403-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784528478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528478, "uuid": "b20fbb03-0847-4c48-85aa-b90b548856f4", "comment": "Malware payload (Mirai)", "value": "7906c02312b2917834f42863292c4fe6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528478, "uuid": "958584be-276f-43f1-90ad-cf1aba3d532f", "comment": "Malware payload (Mirai)", "value": "87129c7eee65f5185ca3977ec2aab905c879765226d1f07813db3a768c5aaf33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528478, "uuid": "ad9721b9-7d5b-4d9e-9862-d5513bed6d7a", "comment": "Malware payload (Mirai)", "value": "0d2db9804f8b83c83a250a25c6988dbc65d50f9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528478, "uuid": "3e1fc521-30f4-4e14-a25e-dcac626755bb", "comment": "Malware payload (Mirai)", "value": "ce32e5142b3a4dd1de450b8e4bab4d9d89b3d37f8f35550b9695c7abe224b92fe796c356e78af12d07417b19223d38d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528478, "uuid": "dc6412a4-7d63-4389-88e8-f6761be4fd52", "value": "T128848E43BBC3CF6AF226B97549E3C5BDA8DB264606BBC557C33C6B12064C2957809EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528478, "uuid": "2e760edf-d8db-406c-92b6-e349e8883d69", "value": "6144:OSe+Ci5M40QoRrG+URN8VwH+YH7EBQ6QqIK43pZCfXwXih:OSe+Cb9QoM+UcVnYbEBh43zCfXwyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784528478, "uuid": "d2ac7295-6208-4217-8425-d67f35fb9491", "value": 378832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784528478, "uuid": "3ff3ab1a-9a8d-4366-bae7-4b556818c9d6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528478, "uuid": "ba10fe76-8db8-4b3b-bdb7-53052cee9669", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8656e949-83d7-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509712, "uuid": "58f8f9d6-1560-4979-bae2-f074adefa11c", "comment": "Malware payload (Mirai)", "value": "831a58da295518e15059c5fb400195b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509712, "uuid": "a8b879c9-7e8c-4e03-9068-63904ee0845e", "comment": "Malware payload (Mirai)", "value": "875257991745c0557dd2fb00cd40934de6281ded379289c26d900bca2628f25f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509712, "uuid": "f8781a3c-e31b-42e7-986c-c3f4e5f2f672", "comment": "Malware payload (Mirai)", "value": "51d0fafed0cd277fce5503c6bb280e5c34b393d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509712, "uuid": "013b0120-5564-46de-a053-1d1c05842342", "comment": "Malware payload (Mirai)", "value": "559d3f6799a82feddffe7035bc805299e9eef8737e09a099d85d2926e8d2a4383b3213e216ebc73404db7c01b2dcdbf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509712, "uuid": "f0b7b4c4-cb77-4d11-8a78-8339e92565e2", "value": "T1A4E39FA89B4EBD42D2C7E3BEAE593FA3312738B041D4C1B64D00954EE5DAED58CE1523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509712, "uuid": "f1961e6e-f24c-4a0b-bf5e-2d2aca9a6bf2", "value": "3072:miSpaiWD3wLvTRyHR3g34yM0W4RbOhow8XXPD3b6a3KhRWB:mdMT6OR3goyM0BbOhwXXTb6wKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509712, "uuid": "90894cfe-5bf9-4d11-970d-93c7d2ea4367", "value": 149368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509712, "uuid": "acbc9e54-d771-4505-9dfa-eb029b04cfba", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509712, "uuid": "3ff132ce-5f7b-4715-9ad8-6f681d70eb02", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae75484-8416-11f1-be1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784536751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536751, "uuid": "c148b9f0-d721-4d10-836f-f8c0b8ffb7d5", "comment": "Malware payload (Prometei)", "value": "015a4593439c35e52824833b56790729", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536751, "uuid": "2965f4a7-32f4-47e0-9d86-6ae415d527cd", "comment": "Malware payload (Prometei)", "value": "88ce48ff6cbe0490c2708808c6108f9f0a6cfa8272fe8278eddc28fbf5d9fd9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536751, "uuid": "7e39d1aa-0270-4a3d-b1a5-4c847ab8c187", "comment": "Malware payload (Prometei)", "value": "5a991a8e0ba4b438e03ef6df12c123426cc3b98c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536751, "uuid": "235a2186-3240-4335-93d7-520ad2d6985d", "comment": "Malware payload (Prometei)", "value": "43efd9dc891cf09491d03acf10ef21b04aff271556ded3a9fecac87157a179e7063c559da21c45ec3bb284340f3e5552", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536751, "uuid": "aaa3f832-d7d1-4af1-8a57-9ee42e200144", "value": "T1D8A423B4F9229E9F6DD76DB91B24831DE181C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536751, "uuid": "1840ede0-8252-494e-a9e6-8c53889741d5", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdX:Fs6pyCC/Ya2hpi6T6N4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784536751, "uuid": "abe61c76-00ca-4944-bdc9-69f8b1ffea48", "value": 449080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784536751, "uuid": "adc9933d-b3c3-47bd-b5a7-7f2b534ea38e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536751, "uuid": "063d0fb4-cc10-4891-ab02-64a6fb78491a", "value": "88ce48ff6cbe0490c2708808c6108f9f0a6cfa8272fe8278eddc28fbf5d9fd9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e232ae8b-8437-11f1-bd95-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1784551097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551097, "uuid": "bbed6899-b28b-4149-b8ba-28838ebd0cac", "comment": "Malware payload (SiriusRAT)", "value": "8e49ddf12f3c5651c35b4a8e3a6d877b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551097, "uuid": "1e7d7012-f079-4a7f-ab76-779352f465df", "comment": "Malware payload (SiriusRAT)", "value": "8a6d7cbf4853d4e88b7dc42f7711d14d8df772db12f3932b9cd90ba3ec0a03af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551097, "uuid": "38f9c60c-d07f-46d1-aa35-9057442e1bc6", "comment": "Malware payload (SiriusRAT)", "value": "2eebef2d354a670f4bf37b3198c023c8736082b5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551097, "uuid": "60cf2900-4210-46d8-a40d-5491445b83aa", "comment": "Malware payload (SiriusRAT)", "value": "f19ac268d2f7ce1cd14fddbd6cadc9550bdc668c9592579959d248c0a1a65f1d32f74f1451cd3eb3daa114dd4bfd90e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551097, "uuid": "4a25d112-a0a5-4094-b402-98e49bf0f2cf", "value": "T1B5757E417DE160055AB5F95CBD6B21C902B23759BB3A876C1CCE97868BB7C0CC1FAB12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551097, "uuid": "c9aa17cf-d9f6-4200-92f3-c6c3cb54bfc9", "value": "24576:xunyrBtQ1hcQmQC1MR0ZptspncIVJRG9CZz4f86t:xun0BtUBTM40Zjspnc8JRG9CZEfLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784551097, "uuid": "a2d47341-4cff-48fd-b9e5-79b789972b6f", "value": 1600976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784551097, "uuid": "cb31b57e-ea58-4097-9588-b79e557c6408", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551097, "uuid": "8e4dba13-c2b5-460e-8d80-d280421fa647", "value": "222921026033312.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f44bbb-8448-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1784558331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558331, "uuid": "eb9d6892-e7a0-4c08-ba46-0219e5068114", "comment": "Malware payload (GuLoader)", "value": "2ce43f30f14201a32886b33a4f765c25", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558331, "uuid": "e20e49ce-8d41-48bb-ad84-69f6590f387e", "comment": "Malware payload (GuLoader)", "value": "8aab978be727a120faf9ab28932c621808c141c6c4100651d7aecce70870a91d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558331, "uuid": "14d2c352-9cfc-4448-b314-7ce53766743b", "comment": "Malware payload (GuLoader)", "value": "64fffbfd4186d8c2a93ebfb6b93c5ecaa018d3be", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558331, "uuid": "756e21b7-1c93-4213-919d-0470ad3c5840", "comment": "Malware payload (GuLoader)", "value": "94cf5d1e563627417bbef0e9295c1d29370ef73b50b345a61c6281e8ee1e810dda209061bc0e086d457ac39f03055306", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558331, "uuid": "9d9306e4-3792-4d6a-b00d-afd05ccfaeac", "value": "T116834B60D9A205B74F87BB58FCA58660C66D8721853344F0F6DAC70C8109DECE779EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558331, "uuid": "fba1d75a-a60d-4399-83ba-238f946758d1", "value": "1536:/tz54lemgHYACPzA/zLc3P4IMjHMehOy+A5aHQO3:/154lemgHYR7A/zLc/4IMjHXhOy+oawE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784558331, "uuid": "2f473827-52b1-4ccf-b72e-398ca474726d", "value": 82911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784558331, "uuid": "a4014f12-86c5-49fa-8520-8989a7dafa0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558331, "uuid": "7a51c7a1-710e-4a39-8247-cfd2588c0669", "value": "Fattura 374-F-2026 del 20-07-2026 BOSMEC SRL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f53056-843e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784553875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553875, "uuid": "4e69f19a-3db9-4879-a508-c830ae0c8c47", "comment": "Malware payload", "value": "93f2a7fc539e0fe98efeb38e65cc97c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553875, "uuid": "78ae5e45-6854-4efd-a515-ba12bd0792d4", "comment": "Malware payload", "value": "8be4b164cca3f97f85398cc7f0cdd140bcd013b865b28546618f162cf474e0f0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553875, "uuid": "cf94c3fd-293e-45f9-aa82-6c7aa9766346", "comment": "Malware payload", "value": "c931c8eb7d670c813c5c57ac8fd3e643e7de9f8a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553875, "uuid": "b9fadd4e-61d0-4b4b-8d1e-fbd18fbff379", "comment": "Malware payload", "value": "01fcf44a55ddc10b3e11b613606a572ce5dba2bd4cbfda0b6f09b66b235fe0245677a947d15b72d5629b560081c803d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553875, "uuid": "f33ae9c0-0f0b-425b-bc02-9c64b86c4572", "value": "T13701ABCAC144AC00509A9A6C32A71094F831C3CF165A4B75BFAC6D3EEBC8910B02AF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553875, "uuid": "2452ac7b-9175-4028-9da7-436a8186cff2", "value": "24:kXCKysE2hi0ziQvZohahhpSvc1X/WLFuJP9X:e9Qp+MshisXsFuJP9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784553875, "uuid": "14730455-9872-420e-a5d0-2541d447bf30", "value": 836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784553875, "uuid": "7cb958da-2d2a-4eaf-af45-4db5e798cf57", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553875, "uuid": "24d006ad-1d33-40a3-99ba-277f5f99efad", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd87b8da-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509482, "uuid": "b44bac7e-971b-4bad-978f-bb6b760fa019", "comment": "Malware payload (Mirai)", "value": "d17ef75a01428afb4de6d7de70e98b4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509482, "uuid": "092af115-ef61-47e8-9a71-21970aa286e6", "comment": "Malware payload (Mirai)", "value": "8c689ba49385129e4f8df15b11f315f1b31f3fc3ee1a610a186d948490f5cd14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509482, "uuid": "8be51631-ee5d-4f8e-91c9-f0d9058e44e8", "comment": "Malware payload (Mirai)", "value": "7912649a7914b6339e73246a76df42c900246599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509482, "uuid": "ca0517c3-9c98-4380-a445-792f2e3e9c04", "comment": "Malware payload (Mirai)", "value": "d14612619dccad923aeecf3fff429073d3df3c9453e6d3770dd142a2423accd5f781c8fbb9d6f48edef9841127335a16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509482, "uuid": "04541a4d-ace6-4693-af3e-d3a5e0f0bb39", "value": "T1938328C1FA8BC0F1D91B88304067F63FCB31E9695061D75DEF9A9E36DA33581A216389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509482, "uuid": "04da77dd-0051-4d92-8bcf-49082552b219", "value": "1536:ivDwDhVtcU4xiUWaqH3FY2SlGe80WJi+Kj/Osv4gv9l7vv:sDWKzQLH3FalGzo+Kj/Oc4Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509482, "uuid": "5d1ba20f-9b32-4483-a5b3-cba65a795cbf", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509482, "uuid": "1de1d482-60e9-4c28-b82f-22dd72c32e40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509482, "uuid": "d5fc1eb9-8488-4fa4-8b9a-d0a9e04c8264", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a353dfa3-848d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784587929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587929, "uuid": "f00cde43-aa85-4fc4-ab91-94e2ad50ac8e", "comment": "Malware payload", "value": "2ab739aea74c61a27a85c7e5c05abf52", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587929, "uuid": "f7a7ff13-733a-421a-964d-d163b9c3b9fd", "comment": "Malware payload", "value": "8c70ae6d0965351ec8417ed37bba85dd58b05afae292cf932efeb4fcc5c7b331", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587929, "uuid": "3925eb3a-1d2c-4e49-a950-e3f0350d516c", "comment": "Malware payload", "value": "971147e924e096e95ed563eff41288a9fcc348cb", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587929, "uuid": "d832d3df-fcdf-46e3-9a24-2b763111a331", "comment": "Malware payload", "value": "537968035d32c431146209f0af77059bb29991acff4b98c62e434b4de603d3337c85d4d99aebc86222c2c5971196f6fd", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587929, "uuid": "55f9ab10-7db2-4d95-991a-aac0e7cbdd7b", "value": "T164E63314AAE101CFF6A3503DDDE30695F99A3CBB0771808F96E457726E672E2C839607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587929, "uuid": "1d8adc84-ab3a-4ba8-a901-d811140afc52", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587929, "uuid": "d883d570-47e0-41b4-a71b-8170f62e5aa7", "value": "393216:bVGw47wd0g6UywFr5QYUxXMCHWUjX4cuI3/PGTAI:bVnd0PBs6YOXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784587929, "uuid": "1832007c-8012-4db5-a4b6-d4588833318e", "value": 14312706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784587929, "uuid": "1401db46-581c-449a-9dfa-cee4e02a9b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587929, "uuid": "5f2caa03-1607-4f77-abee-30b9e670407e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7441f6-8434-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784549556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549556, "uuid": "5ab5d3e7-e8df-43e2-a314-77ea549ed1e0", "comment": "Malware payload (RemcosRAT)", "value": "f524edcbd0bbe8f15e44aabba0c41c32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549556, "uuid": "6835cf8c-1883-47ff-99cf-6276d35ffaad", "comment": "Malware payload (RemcosRAT)", "value": "8d4c7010417f203f7d85abc0fc5f7e6e3e56c2dd38fb242b1b2eb9ac729673de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549556, "uuid": "67902edc-dd2f-4057-98b4-4a7dbd99ab90", "comment": "Malware payload (RemcosRAT)", "value": "ed53b4d32732b55593ae11f2df3eb70bc8b9d5cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549556, "uuid": "93e05ea9-0dc3-4abb-999a-4fd44bc64328", "comment": "Malware payload (RemcosRAT)", "value": "4065acbd55063272d19bf1b75bd1e7f8a21a8d718a3beca249b7e64847ec03980ad8848471f30a71286d8317a843b267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549556, "uuid": "84a2e27a-97ae-441c-958d-b3462c26a24f", "value": "T1A6B2B41A89B25F778ADBD0015C04E473F86BD048F81955FDB4E8C0BF421E6DE89B9DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549556, "uuid": "742ddd4f-45fb-4a25-bcc0-72b8974aabdd", "value": "192:OEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEy:IMOla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784549556, "uuid": "4783f5fd-5bf3-4f0d-b82f-f49f49847463", "value": 25233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784549556, "uuid": "dc4a4227-0cc2-4355-a5d0-1c2fe4c5814f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549556, "uuid": "0cbe94b6-b068-445a-94e2-1a17dd3fcbae", "value": "goodthingsarebestperofrmanceoneforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5ddc77-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784530529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530529, "uuid": "effd2dfc-df50-4591-aa89-258ed0bb2550", "comment": "Malware payload", "value": "7f25267f75056d2b65f8351d5fa3853f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530529, "uuid": "0d7967e9-554d-4a2b-99e1-44328d41eaf6", "comment": "Malware payload", "value": "8df261ce0672369e08e79f205a15e338b1196ebc0f15fa5692027b68d67da378", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530529, "uuid": "833e01da-2001-4cad-8ac9-3c34331e654b", "comment": "Malware payload", "value": "12210a3c3268cac28afc76ea4a5e5e1dce9aab11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530529, "uuid": "048c6060-bc93-4bf5-bd4f-de415dccf5fb", "comment": "Malware payload", "value": "c15cdfc1bf81c58df95bb47a33b5940fec5225913c0c7e5980bec530c2f40a450d63c090d7f595581f300b217c580c98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530529, "uuid": "bfb5d9f9-d567-4f0d-a26a-1b9f765c68e3", "value": "T107B31206CA821CA2CA589ABD45B800771EE7F8B419F710558A3787614DC3263FEBCDED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530529, "uuid": "28c8df47-52a0-49cb-a3ac-74e8d15fc1b0", "value": "3072:2qAhlMCynX49PDC3LU41QVHcQxrLJUK61BlJMXYxI6z:QPIoSCV8QxrLJr6/l6X+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530529, "uuid": "c32bb1e0-0601-4c1d-8345-7445164a5f5a", "value": 116632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530529, "uuid": "c1c7930b-da8f-41ac-9e6a-4f419fa58738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530529, "uuid": "ed5a7dc3-9c66-4cab-b6fe-d884587f4ba0", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6f9ae1-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574710, "uuid": "bee1a8a5-6c4b-4002-9561-0b259adad521", "comment": "Malware payload (Mirai)", "value": "fe808fb7352c278f377e10e68ab0fa51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574710, "uuid": "179ea3e7-3937-49c9-8fa8-f0869a91d724", "comment": "Malware payload (Mirai)", "value": "8e5fe294c314bb1c2dbfa2ff6225b79380a5494fa70ecb1b8f1e6cf725a61427", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574710, "uuid": "227344fd-02a7-496e-9265-32180e0187de", "comment": "Malware payload (Mirai)", "value": "a81c9a6a152cab783048acee9e5ca148e73b4918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574710, "uuid": "38aab686-0063-4173-a4ae-38fd2e6a622a", "comment": "Malware payload (Mirai)", "value": "6b443ba659d3b5bf1367c5e3cc0807b726d8da6f3f86c83e49d2d59ec3d9ca2e3a3d081959eb890a71ddbd34a642466c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574710, "uuid": "c093dbe2-d861-4624-9fee-851e6de448eb", "value": "T107B328C2F98B81F6D00B88306066F63FDA32D5E94171C65DEF9A9F36DB77242920264D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574710, "uuid": "1578fe5c-b1f4-4ede-872b-2592edf702fc", "value": "1536:K3TKBqUN5T9pXpFz+7H7OoHWxwrn1RvTEhMU3y3vWPamwSrH1apoWD3sYHuxotV/:KD43p7SeoHWy7bLEF3lSmwSrVaGOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574710, "uuid": "3ebee0d2-243a-40cf-be13-348baf685f89", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574710, "uuid": "6b42a0c7-9cec-451b-8c04-e61128f36942", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574710, "uuid": "3983571e-f4b2-4c2d-9bea-3225e4b72b84", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0648d430-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784530113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530113, "uuid": "b7eace7a-5aab-44c2-af27-5b8cffa3db87", "comment": "Malware payload", "value": "afe1f10b45ced9a8d8af2bc4a51d93b6", "object_relation": "md5", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530113, "uuid": "470f0376-0bae-4330-b32d-d2ab158b8a2c", "comment": "Malware payload", "value": "8e5ff6948d71e8dba1ae568ea8ff13fa15ba12c7acd391920da6f7e1d44db382", "object_relation": "sha256", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530113, "uuid": "4093bc7b-7b20-49e7-a59e-b7090f462a17", "comment": "Malware payload", "value": "7f9879d12863d919848ad21ed8e1144d64645459", "object_relation": "sha1", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530113, "uuid": "770c9b51-69ea-4f83-943f-82010f85c211", "comment": "Malware payload", "value": "6c0682b15406e7c92682928ceaec87bc085554017f045a82490d4da50257e1093cd93a21a832e077c8b48de8323c4d09", "object_relation": "sha3-384", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530113, "uuid": "22f830fb-9f96-432f-a5f6-91b1ffd0ee6b", "value": "T14694E6B2BA7C119FEB7B9AF498C05931B6136C2D915465250B88F114A932FEDF860F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530113, "uuid": "09696b49-e8b5-4f6b-9f1e-209082a36335", "value": "08d2e8def3bf9cbd7f590ec604622dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530113, "uuid": "01f5ad46-6f87-48e2-ba8b-456d1d74e2ad", "value": "6144:okMwHkfW6YWh3DiQ6veayls3/fEP+9d5sBfHC6UsoSfYvL95Xze+:okTXkFxlaBd5sBKKo/Z5Xq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530113, "uuid": "89708cb8-3c2b-45bf-b928-b4e337e87c7c", "value": 423920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530113, "uuid": "1d4d8833-167e-4db6-9297-7d9d9d56e3cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530113, "uuid": "4e03d99c-e4a1-4727-b637-3dbf0d1ed116", "value": "Hello_World_ver331_5_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdbff19-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509400, "uuid": "daba3181-8b46-46a0-bddc-bffc11bc7e43", "comment": "Malware payload (Mirai)", "value": "32cac052654b5994417aa74d4574784c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509400, "uuid": "d28192f2-36a2-4683-92a7-9a30e476e9c4", "comment": "Malware payload (Mirai)", "value": "8e78c6d44d095554ab431b2d22a0fe6724f1b0312bbfc990f5f7339af72247a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509400, "uuid": "095f0fd2-9cf1-4a53-940b-7a2ca0576516", "comment": "Malware payload (Mirai)", "value": "a3ef2b0312cd8734193223164baaee374ecd67ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509400, "uuid": "b110fb83-c535-4ed7-9956-e6e28af59255", "comment": "Malware payload (Mirai)", "value": "0cf012f41e020fbdddf624d1bdc07c2c1f068a1c18ec4710211b10baa4f86e8565e760289bc1c106b21e9e7a9f819ee4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509400, "uuid": "8e8f77b4-ed71-44e4-8ade-a7958a2e4eac", "value": "T11D13F159535F85E2CD202D39FC204B8B0FC496B1A2AD24108B9D97AFFE9C77367B6144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509400, "uuid": "fa1d1a15-db5a-46d6-8d0b-4ba436e01b48", "value": "768:aFU5jg+eO3dCE5M+nHo2mu3NnrQy3txM3cP11R1gHv6tpfVO6fAJFaqWDjKwz6K/:aFU1g+F3nM+nr33NnFLYK10v4XYWqqKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509400, "uuid": "3d88b31a-b039-4164-b26b-d96116747ada", "value": 44760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509400, "uuid": "57c6778b-48bb-4590-900a-450377d74a64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509400, "uuid": "429e2c6b-e8a5-4bcf-b132-ca863a2b8be4", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abd045e-846d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574143, "uuid": "5467ed1e-dc89-4a9d-b755-d0e6c9d8dd7f", "comment": "Malware payload (Mirai)", "value": "14ee24863ca12d0379fbf30aa653689f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574143, "uuid": "c045c0dc-7844-4e94-b6cb-02a2f9eff2e4", "comment": "Malware payload (Mirai)", "value": "8f43a7dc8f4716f2c7c73c43d55277e0d9f214ed9b0ac332042efb23ef1d4c3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574143, "uuid": "4109defb-674d-4467-98ef-31e0362356e6", "comment": "Malware payload (Mirai)", "value": "6c8ef54ecb271e6f3501b7957c131049d3f99f1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574143, "uuid": "a79fbe08-89ba-428c-8cb2-1a3af238b356", "comment": "Malware payload (Mirai)", "value": "197d9e07481d83bc4f4b517488261508fe73ed07e8959fce2da5484ca161a4e47519ac4362f8d9068987af196dcb1c8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574143, "uuid": "4eaaeceb-484b-4008-81c1-8a00f30ae0c1", "value": "T11123F26C3530B4A4C51AE0BCE7E451727FA44B7AD1419C8326A931D05F224AD7CDBEEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574143, "uuid": "8ae8eb10-c99b-440d-9eec-08cd796c5361", "value": "768:DCGNuJ8rtEmnlz5vz9VvowJQuZnhBlLxyw6RqW8d8elei0CrUJgGlzDpbuR1J9:DCcrrymN9zowJZJhBlLxb6NveeyMVJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574143, "uuid": "2af86c5d-2569-4943-9239-8bf7d49d8100", "value": 48056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574143, "uuid": "b4aa0af6-b170-4c9c-96cb-5e0a2224fae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574143, "uuid": "e57fd16d-302a-4d42-9cce-20e591304d0b", "value": "8f43a7dc8f4716f2c7c73c43d55277e0d9f214ed9b0ac332042efb23ef1d4c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1327ad9f-83d5-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784508659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508659, "uuid": "99e75171-866b-4392-99de-1fc1b72f3afb", "comment": "Malware payload (Mirai)", "value": "a89b89214289251afa03c2cc05733561", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508659, "uuid": "157e6bab-e053-4e80-b099-9ecadb2d1461", "comment": "Malware payload (Mirai)", "value": "8fb4cfabec6fa0b8f0e0d25135e87e88c13c3dce61c1335a89ee2e474a3d1570", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508659, "uuid": "2f487d5e-b99b-4e2a-bb42-a48e91680eae", "comment": "Malware payload (Mirai)", "value": "18af6df7a4d1aaff38db64c8ead737773b748615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508659, "uuid": "817b1b57-2573-4a17-9714-1db4d745d022", "comment": "Malware payload (Mirai)", "value": "8bd69209a820223383398b5e43099a58b30b6abaa37cba672627aef4aebfc3fcf3f8377788389d251f371952ad560057", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508659, "uuid": "f333efc8-677d-4f01-a718-ff07d8767de4", "value": "T17F936DC5E687D0F2EC2605712177FB378A77E13E2129EB83D7A86931AC126C1D21679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508659, "uuid": "5a6e7be2-b76b-42ac-ba1e-b80144d77903", "value": "1536:1jJ0iBtDGXb00Vr1eMf6fGN4Q+ihVoPrNMxzHOLUdF5VmEikSLxj:NJ0iBte9rn6fY4QnVowzuodvidLxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784508659, "uuid": "39df4409-dbe9-45dd-ac38-b3fea0c8e8d2", "value": 95508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784508659, "uuid": "fc3eeed7-b31e-47aa-a470-d2447be06d62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508659, "uuid": "09c42bfb-1913-4270-bc51-badf275dba5b", "value": "ohshit.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7611730-8435-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784550193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550193, "uuid": "f03d6575-2261-45c6-8d88-5ddf3b3415f8", "comment": "Malware payload", "value": "bbf65b174ca926994ec6e2c2d496a3de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550193, "uuid": "22df677c-d85b-4fc5-9787-d2d13e8ac4e6", "comment": "Malware payload", "value": "900e19df6711336dca348e5a5de59c84d6ed8d628426558477eb10782ac3efab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550193, "uuid": "e205d8e8-4ce8-407f-a330-349e5fdb6569", "comment": "Malware payload", "value": "ce81c7c41ecd23b2904da8a7895c4cb287789742", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550193, "uuid": "13112343-42e5-4b9e-be4c-a39faaf5e936", "comment": "Malware payload", "value": "5f9e97b0b05586bf1485a5202cc59439e91710f5b50b61fc274855760d1ab75cbcaf65d09772298bc80ebf68a2fb4126", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550193, "uuid": "4ca02b82-a436-4348-be00-c523a4209188", "value": "T122235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCF3CF68C4A6AD9109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550193, "uuid": "4accd5bc-43ca-402a-8b9d-b42f4478091c", "value": "768:0+v9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:0+Icr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784550193, "uuid": "3254d67b-d5bd-40ca-832f-7f7188f4d785", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784550193, "uuid": "16b57d3a-946e-4119-93ab-7e643d4ded16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550193, "uuid": "d002c58c-b3d9-4a79-85ae-d00097f9ba49", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31067d38-842b-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1784545646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784545646, "uuid": "757fd8d7-e6b7-4bb3-a0e7-de9b74915256", "comment": "Malware payload (OverlordRAT)", "value": "c74d3a3ce1af76dd8768bd9ad21eada4", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784545646, "uuid": "a117c6d4-b9af-411b-bd24-e7c50cf07fc5", "comment": "Malware payload (OverlordRAT)", "value": "90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784545646, "uuid": "ac5a648c-d1bc-4d12-8bd4-52243f1488bb", "comment": "Malware payload (OverlordRAT)", "value": "ec6457fa70a737f9604f2af9a45a2d9bdbe94c2f", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784545646, "uuid": "c741aac3-ac75-4cd0-b630-8561e7fd47bb", "comment": "Malware payload (OverlordRAT)", "value": "047e6c55b8729b87c2ae9eea5cce36d1047f665e7ca7dd19a6c2871e0291bc213b56960d9a7ffffccc966455a66d45a7", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784545646, "uuid": "c9593aaf-f60c-40ae-aad0-5fd26a550592", "value": "T14526336270659FB4DA17B07871074A34E2E61A9E227A0415DDFEDE92E33DE0024F786F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784545646, "uuid": "e1c10e0e-3dd9-402b-89aa-1757750fcb2b", "value": "5699e1d42ceaa51c77691cc53baa5841", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784545646, "uuid": "a5227554-1aee-4761-9722-5a05aebaea57", "value": "49152:bkdCIiOamxHIed+LEzVKZMp/cs/O6SVsbR+A47d10FLTyAJn1VtnDdVBhculmOBs:bkIIzFGEhKZpVyRjc10JJZVjcafReja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784545646, "uuid": "9ed3a8ac-431e-4b59-957d-1c51aa2f938b", "value": 4842496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784545646, "uuid": "ce340735-6441-4052-b7c1-acfb529181a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784545646, "uuid": "bb8929ff-c52a-42e5-92f0-df0e513b70b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d208a68-847b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784579972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579972, "uuid": "674d8213-e1b0-4193-bfbc-7a356f6089f7", "comment": "Malware payload (Mirai)", "value": "127b7061274ffbcabdf1f8b93390749b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579972, "uuid": "4307ebd5-289b-4e31-8cef-0a52d82cb328", "comment": "Malware payload (Mirai)", "value": "90ac8ec4e015343f2f175d29a2e147109a76fd65582dfa9cad80144826336872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579972, "uuid": "9c7ef7df-c6d0-4f12-b152-e87af488e3c4", "comment": "Malware payload (Mirai)", "value": "66e20ddf178ec289f28396b575f12a53d7c17612", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579972, "uuid": "7a3dcbc9-6745-46be-81ee-72f62f0b91c4", "comment": "Malware payload (Mirai)", "value": "04d713fbf230c4b94f62068292f3586d067ceec1a35a14a702f729dcaa6b271b1b34be07e10c6e40cb7b804264913cab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579972, "uuid": "061c4e21-8a60-412a-9ebd-51354110e28c", "value": "T134C32986F8824B22D6D712BEF92D118E331317B8E3DE32229E245F2177C652B0E77955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579972, "uuid": "20ea590b-6c36-4177-b979-d0acaee4f109", "value": "3072:GIQpxQEjVJ3QkkjmG7L6apVH9dhd2P3x9i:GIyxQgVJ3QkY57Gandd2Z9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784579972, "uuid": "10f9c34e-6292-4c28-bb6d-1867e89fb3e8", "value": 120288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784579972, "uuid": "177398a8-739f-475b-bd00-5bdabf9238b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579972, "uuid": "7d8a1b5e-f8a2-4a44-8e47-b1878facce4b", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6e9236-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574791, "uuid": "0bc492b9-c936-4988-8c28-7206934c353a", "comment": "Malware payload (Mirai)", "value": "488ab23871e8fd840d56a8340f27b25b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574791, "uuid": "468713c7-4f74-459f-8dd5-1c6c00aa6681", "comment": "Malware payload (Mirai)", "value": "90b9875329d3272f60376d93c7096818da5264bb7f264c2f76ec7b528be69c87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574791, "uuid": "d6ad6aeb-0722-4f4c-89e4-a0991ad5bbdd", "comment": "Malware payload (Mirai)", "value": "62ecfb43348a27ba1016dae96f0e1760de7dc8ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574791, "uuid": "fa9adb4e-e65b-4fe2-b5ec-5ba702aa12a1", "comment": "Malware payload (Mirai)", "value": "052c4717452c16d4ec4de8058ae1f11dd0bd15f5e17882bd8bd0187fdaca39bedeccbd0ad43ce60901a295589737f99c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574791, "uuid": "feac987d-e5ae-430a-846d-5515d7ac3511", "value": "T17A13F1ACF57C1959CA2E3E634D50FFD767F48E09CE8692111051FE0EA92AC8522C2ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574791, "uuid": "11117e4a-f549-47cc-ac4a-f18a34ff5e39", "value": "768:QAKxjI20hvqUREwtm4HWRiMTEoQVIb5HY4Ni8zPjr4Vcgl/URwhC962wHATi5xYq:QAKxjIxhC2tC/YoQadHYXWAC9lwScY4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574791, "uuid": "b74f643d-ead6-449e-b7cc-4e161fae2738", "value": 44696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574791, "uuid": "17e29587-d2ca-40e1-aa92-031ae5127bb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574791, "uuid": "01fb9481-f406-435f-a25a-aef70fcd1d8f", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e46da9f-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574606, "uuid": "0d4ce1e6-1cba-4332-962a-34131416b600", "comment": "Malware payload (Mirai)", "value": "85ae0a538f587318c3fea0eb77b60dae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574606, "uuid": "9c6bfea9-b200-4c2e-8ea6-1d30548dc870", "comment": "Malware payload (Mirai)", "value": "9176557aa785ddb98e7fd4149d27e49ef064212c7637f94901a5a0965d9fac20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574606, "uuid": "c1fee282-a80a-4b4f-a2a6-ccabe7aebd0b", "comment": "Malware payload (Mirai)", "value": "dff95284bdf65f5ce0704e6854807cb71f48d1e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574606, "uuid": "3f49ce97-dbfc-41bd-ab37-ae7a64b1dd89", "comment": "Malware payload (Mirai)", "value": "4ebe495fd7fa688b3545bef798cda6583a7fe1581017c754aea26aca1c5b07f0eeea72dd60d5fd274109f2d458cd50fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574606, "uuid": "92da3fc4-f61a-4fee-a49c-40de2f65bb18", "value": "T12023F19A9491E768D07B587B5E1D760829A8F04F5B76F73FEF98111F8830744360AB83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574606, "uuid": "e5d74772-d314-44d2-9dfb-e7ad245b4048", "value": "768:EiIIhkHHqDblI7lBqcbC5uHX91/CZvUnNfgHCYDOBxIKnbcuyD7UHQRjf:gq8OlqqcbHMUiHtoXnouy8HyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574606, "uuid": "71df54e5-07c3-4640-9ec9-93b27d516a35", "value": 46196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574606, "uuid": "dbd9dcb0-7696-43a6-af1c-3c49ee0ab2f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574606, "uuid": "60017b2f-0ccc-49c2-9f03-f50d64dcf105", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934ddc45-8402-11f1-be1e-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1784528202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528202, "uuid": "3b936b18-4bbd-446d-a162-c2bb5f0d6d52", "comment": "Malware payload (GuLoader)", "value": "613f66230592910e70bdb34869b6f304", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528202, "uuid": "cf404810-3a15-45be-aee4-5c2b8dcd94c4", "comment": "Malware payload (GuLoader)", "value": "91eab30212060bf6021a4fbd2b844711dd11e680cb50e7f648925bc8179870ef", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528202, "uuid": "783eef91-eb05-475f-b6c5-13e43bc8cc54", "comment": "Malware payload (GuLoader)", "value": "428edc4b274182df88e3c22b94fc28fde6fc1589", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528202, "uuid": "1d588d6b-221d-438c-a389-558f568af457", "comment": "Malware payload (GuLoader)", "value": "ddbbefc4a0338f7bb4ef37027f2a4d068cdd2602659571a4acdb8bc8be46139694f932541c4c258c63b83244c048defb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528202, "uuid": "dcd9d3f5-c01f-4927-a49c-837df9987a81", "value": "T123133C53EFC4083B0D97479ED9780B6684B8CA7985327CBCE9ED7B0E900264C977E259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528202, "uuid": "901fa2ca-19b4-4332-8246-f2d346338b42", "value": "768:xQBWZSyJ2B6lgbuTrv+QX4d+gtSG3thmh3BmDPmWMd5F7rTih11zE97/:xQBWZSXZvQSPB3vmh3cDPo7ruhfE97/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784528202, "uuid": "f613f023-5719-4260-a399-ee07252b0814", "value": 44868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784528202, "uuid": "0d12608b-ff8f-46b0-8945-50f6d611273c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528202, "uuid": "a5772e1d-cdfb-40ca-84f6-373d76bd65e9", "value": "Advice Ref[GLV302261823].vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7812f8-847a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784579916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579916, "uuid": "f9cf8602-ecbc-4656-84c8-d6b40a17fe12", "comment": "Malware payload (Mirai)", "value": "9e830cc6cf92df7c2319f47398da46d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579916, "uuid": "4a75da3a-baaa-45f1-9847-37123b1e2947", "comment": "Malware payload (Mirai)", "value": "9354ba8758ad0702251b2ea6dfa82cb7ba34c0e7f32e5cfc83aed0baebb3c456", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579916, "uuid": "ad8761fe-2935-4e0e-be50-5d448410ddf3", "comment": "Malware payload (Mirai)", "value": "89f489384019796d36a746028599cef14af410aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579916, "uuid": "bfe0e52b-9fb0-4cba-88b0-56dfaa591d05", "comment": "Malware payload (Mirai)", "value": "688a5e66cf254d1a7e47805c2977fdf64ec3c2d550f0a6cad681eec9e626b88c3df482695770652cb77da0dd2d7fb64c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579916, "uuid": "1be46fb9-8c48-403e-9ed6-370ac11ee1a8", "value": "T18223F20D01199D28EDD0F8379A58D489523B4FD9EABCFC1B7590E4647EA53C2E3BE181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579916, "uuid": "25fcaa4c-2014-43dc-b224-999bc7b9270a", "value": "1536:lOWfAAherYCyhib3sdTzOQGObIm2CRuzddJlj0qyDL2d6b5Ly:SAMrshocdHOQGPm2CgRdJq9Q6b5Ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784579916, "uuid": "22fd198d-5fe1-476c-9e2d-1db7d5ebaff3", "value": 49620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784579916, "uuid": "795e1b24-6bbb-410c-8b9a-153f774f1965", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579916, "uuid": "a9de5f93-bb90-42a3-af58-32f81269c5b8", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0306e95-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784534263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534263, "uuid": "0e073f19-a234-4168-b93d-f1d5e78d0d2a", "comment": "Malware payload", "value": "1605971fa40b7f784311cecea47a251e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534263, "uuid": "ea61f132-c663-42b5-9157-be23fee0fbf3", "comment": "Malware payload", "value": "93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534263, "uuid": "690b13ba-e39b-4522-bce7-64b76202c566", "comment": "Malware payload", "value": "9fd5870678ae20ffe9cc8c26068e75935f27957d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534263, "uuid": "80caf70a-3337-4e28-9f2e-4cb48637b44c", "comment": "Malware payload", "value": "6932560098e88f298ed4a943e352d0b83321d9f86c4930ac5a9e16507a1e72d62c6820eb3db5c2c7d7521574dff110c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534263, "uuid": "b753d620-a00c-4270-9a35-5e4f85558bb6", "value": "T126C36C5B63E530E9E1B78678C4914A59E776BC7107609FEF03A0425A2F272D18D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534263, "uuid": "1ff9f71b-091d-4b91-8ba2-beaef07585b0", "value": "c440fed27cd89389c64033011969935a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534263, "uuid": "9754a21d-36de-45a0-94d9-98aedd1dcd88", "value": "3072:dfYomTuROFcA8eTRuznTVTX3xOcODofsdp9:dgouuTQTR4nl3yAsdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534263, "uuid": "69e95132-f96f-495f-99e3-447d6be97459", "value": 120984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534263, "uuid": "f418542d-8a3c-41f9-bf84-1bc360b5d3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534263, "uuid": "5a10d992-2230-4507-b489-ca5877b5088d", "value": "Tax_Notice_13594.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad1dc11-840c-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784532617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532617, "uuid": "2ccb038d-7f31-4467-b808-83d6069d91ae", "comment": "Malware payload", "value": "44c7dcaab3372a2897c419cb7f35fc14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532617, "uuid": "7bc1063a-75e6-4364-86cd-3da610f7d981", "comment": "Malware payload", "value": "93e31494eb014f25761668498b2b5b3e80d953b8bbc7b365d19ad3e51de4cd54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532617, "uuid": "152376e3-97f2-4ed3-99f0-fc03dc58e962", "comment": "Malware payload", "value": "e74a94acd933a66a8bf6e3ba2dc793effbd2bcd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532617, "uuid": "380143ca-e7fa-4187-a778-07aa49fc4408", "comment": "Malware payload", "value": "826bed3e6436034ec0bfcf19bbeeffcaf3c8d2a1f00cea4d8fe66c13bfefc065f451665c79e7f16bdcd0ce4eae285f31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532617, "uuid": "51b5c3d3-ed29-436e-b1b1-98efe74d7ad4", "value": "T19A27CE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532617, "uuid": "54098d1a-44f1-4e7e-8127-eafbf55ebb46", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQy:cqYUQuVDt0TZER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784532617, "uuid": "db4a82ed-5960-4f06-b14d-12e6e5efe463", "value": 22085632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784532617, "uuid": "7439fae5-7e58-4081-8c06-b017d701bab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532617, "uuid": "a6eb7c09-e499-4e95-b6bc-34b208295860", "value": "93e31494eb014f25761668498b2b5b3e80d953b8bbc7b365d19ad3e51de4cd54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a5a6c2-8415-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784536171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536171, "uuid": "b63292c9-55d9-43c0-97a9-791c94054361", "comment": "Malware payload (AgentTesla)", "value": "791d27fd45d5ac5f25235b46547129ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536171, "uuid": "cf47d70a-741c-4285-a299-e248f71097c9", "comment": "Malware payload (AgentTesla)", "value": "940f0d74f64672c50d4b6ed704aefa743d81b7cdfbeb6666a00f690f80b7b001", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536171, "uuid": "4038889f-0116-48c9-a3ad-adc9da28e1d4", "comment": "Malware payload (AgentTesla)", "value": "a302b2902da6ebf1c6f9b79158320bb4111d75a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536171, "uuid": "585b3849-2786-43c3-88ee-4f9a3c265c61", "comment": "Malware payload (AgentTesla)", "value": "6dde1e87682ca377ae1f6519a0e7c4dc96cad0e59ee0f195c4b2145196423262d18614e05c895e29a9e9365465706c23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536171, "uuid": "35c30e8c-85ed-4004-af76-e356576e7a69", "value": "T1A1D423907A64C467DE6005316D3B5BBA9DF3DDB13828656BAB003B4DBCF2044A72E7D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536171, "uuid": "adf4a98c-c88e-485c-b813-6d3b515f5850", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536171, "uuid": "92e85644-3af1-4297-a7b3-595a32d029cf", "value": "12288:ZX42dJ2Gkx88389Lo7cJrel7Fl64SWLEB+lxxzwK:J42dYGkuEa2l+WE8twK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784536171, "uuid": "af8402d5-706e-4328-b78e-6c33a015e0cc", "value": 610696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784536171, "uuid": "61c12e5f-6321-4066-af48-ea98a3854871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536171, "uuid": "81009404-4d74-4e17-bbaf-e816a04f0454", "value": "Directrices de pol\u00edticas para empleados_2026.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8900b98-8427-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784544182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544182, "uuid": "a45e6415-dd3e-4a4e-90c5-2d9d26156cf3", "comment": "Malware payload (ValleyRAT)", "value": "2ddf81c2e31d91a7c486645c0b2ad10c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544182, "uuid": "30b94e0f-dfeb-4fd9-bc53-6246fb019711", "comment": "Malware payload (ValleyRAT)", "value": "94796cf6d4403856fcca825b4fb2e9efd2c2635d6ae43e62a6392c0153f5c944", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544182, "uuid": "23046ecf-df42-4cac-af4b-bbaed6afac39", "comment": "Malware payload (ValleyRAT)", "value": "585dff4e70bc383d205caa50157ff80b62fe5807", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544182, "uuid": "4875c862-7375-4c54-ae8f-54638d8cb302", "comment": "Malware payload (ValleyRAT)", "value": "a604a4fce9a1fc2ab939346e81918fdc08d29d14904d8bb2764ed1720b0f06857f35de45ce55a513862ac406d5523109", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544182, "uuid": "4e16638e-8a3d-4ad0-b50b-1c5203ce8f1b", "value": "T1A5459D41FB951CFAEC7A8438C9A35A16EB72B80503A0D3DB27984596DF273D05E3E391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544182, "uuid": "f7441b1c-c33c-407a-b710-2fe9e1f27111", "value": "6144:FbMNk1Nfm0rfQBqZE+peAn5IEJvMqTBJNFmkfQw1ZWaJkp5i0nTUCogqS:F71Nfhu+1mqTnNFmkfQw1ZWzK0TUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784544182, "uuid": "0855d1b0-6a1b-45ec-8552-658752d6cdaa", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784544182, "uuid": "67dc2fd0-f1f0-4fb7-998b-ff0f9035020c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544182, "uuid": "36eb5c1e-dff4-46f4-970b-f1b6f6014c38", "value": "Notice from Tax Departmen.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c7cd70-846c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784573778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573778, "uuid": "37a8c77b-6228-4689-b2d1-b982ae304935", "comment": "Malware payload (Mirai)", "value": "8f828bf202d4238ddae5073569061fe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573778, "uuid": "257e9649-8569-46d6-8eaf-fd48aaa977f8", "comment": "Malware payload (Mirai)", "value": "94df870d187244e4c64ff80f4ae3d703642bb6cfd384b312e8729bfaf4fd4c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573778, "uuid": "45901f1f-e135-457d-a556-ce61d5bce3c6", "comment": "Malware payload (Mirai)", "value": "d99c55aa5c754ed955eb741236ad08068cca14ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573778, "uuid": "df4cf270-21dc-4a2d-a474-6dfa696505dc", "comment": "Malware payload (Mirai)", "value": "1d3b93f34bd3c09e74fa1fe55b946ff32adeac4bb788d72bc709e369affce36c96a4c0252599873a7d249db0118e4271", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573778, "uuid": "7ccad3ff-a661-4a5e-b361-0ba68b482a56", "value": "T1EC53F1A790DC491CCB2F9B7A2AC3748E4604E545FBCA4DF5EAC4807B4EE92C02475BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573778, "uuid": "4089b4b1-eb64-4f6d-b734-15aba93a2165", "value": "1536:9K8OytlocKlX/xVu4e3A2h4lJnnouy8DMh:99lo3lm4e3h4LnoutDMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784573778, "uuid": "732b5116-0323-4514-9b68-421830ace700", "value": 63744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784573778, "uuid": "77a6e96d-9e7d-41a1-b189-5182089ed117", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573778, "uuid": "f29f7860-e753-40e4-8bc0-d9dfc0b26179", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e5d690-8449-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784558860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558860, "uuid": "f743bf90-e426-458e-bb35-509686de6afc", "comment": "Malware payload (Mirai)", "value": "fe0ea8399dd40d2fd9b161ee1e0bab41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558860, "uuid": "ea38f088-0dcb-4a0f-9396-77760683a762", "comment": "Malware payload (Mirai)", "value": "950b618c7f24e2b67d93bbf111c572978478622706eb7d288193fcea92145502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558860, "uuid": "286cfd7d-0336-42e9-8baa-7055f4d7bb0e", "comment": "Malware payload (Mirai)", "value": "d7350fbb1ac3f2e24b28ada35adfe47ffc6a895c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558860, "uuid": "0d29d8d2-2af0-495b-8a58-643eeb706a8d", "comment": "Malware payload (Mirai)", "value": "2c53d3648ea6f4e305582d2930755e72e95d107b5f4e5c1e080cb51830e1615c86f1587d9d25c92d2896dfc2c70e8b9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558860, "uuid": "786bfb6d-5eea-4bd7-8bcc-2d0cbac5b920", "value": "T1DA14C719AF510FBBDC6FDE3702EA0B0529CC655722A43B363674D928F54A90F49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558860, "uuid": "118248ef-2a58-41b5-b5da-d679891eeec9", "value": "3072:1PLDumBEuqQIjLms/rHFzwnISJeNLzQElrwvxzXkA:1PLiEIjLd/2IcsL0Y8zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784558860, "uuid": "1225602d-f2f0-416c-92e9-e09fa02845c2", "value": 207552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784558860, "uuid": "a75e1cf4-d081-4885-a348-0e1bbe5dbabd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558860, "uuid": "08424c64-e416-4b2e-ba7a-5bd90cc50e30", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f80473-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784530333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530333, "uuid": "80f4d09d-26d3-4e13-b14a-76510728a90e", "comment": "Malware payload", "value": "dbe2afc0bc8ec760f800895ef3ef1fc7", "object_relation": "md5", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530333, "uuid": "7809fc7d-9f9c-4792-9d1c-a1bacac5faae", "comment": "Malware payload", "value": "955415f950e1278a041992f6c6494b1d482861a78effb2c871907b21258631b0", "object_relation": "sha256", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530333, "uuid": "e292f6ca-e22d-4a20-aed1-09df7ea18e60", "comment": "Malware payload", "value": "9975f431f96f064fccd6e07f191116091d3e5088", "object_relation": "sha1", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530333, "uuid": "17466deb-cf7d-46cf-b3fb-16f1347dbbcf", "comment": "Malware payload", "value": "2b1241ac31c78f690abacee09403dea475a15b8055dd8fc529c4cc7435a61e1447c5b318f5fbcd5c41e1bf9da423820b", "object_relation": "sha3-384", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530333, "uuid": "ef5f7e78-4b8b-41e3-af3f-d7f83a2f2e26", "value": "T137E36C97A3A570F9E0768674C4521966D773BC7207209BBF0364B6AA2F373D04C3AB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530333, "uuid": "0cf4e9ed-b028-4a22-8a40-027145147eb0", "value": "3031c7860f6c160a8d033d7c9cc388d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530333, "uuid": "8f3c22c1-8e3c-4e6d-8889-e2d8718db8f0", "value": "3072:WNe9XyoILcvlan4PoCiYHquM0jcre/bLO2TE9P/5jv:thIn4P/DHLv/bi2TEpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530333, "uuid": "016cd7fc-cc7c-471e-b8ab-6a82d935180a", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530333, "uuid": "95c417b7-7046-409c-ae00-e9fe7860185d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530333, "uuid": "f79e9b56-055c-4944-810e-ce6989cbd333", "value": "gurfv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afd8bea-8436-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784550522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550522, "uuid": "52faadf3-acbf-4bfa-a23f-8d38887147e6", "comment": "Malware payload (ValleyRAT)", "value": "2a3c992c2c3458c5da1006d1dccfe3c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550522, "uuid": "56fe9a6a-891e-47f6-a01b-ec7adda96b5e", "comment": "Malware payload (ValleyRAT)", "value": "959001875232215e49463f8528c5786a741fda70e8b0fd95159ebdb0b41e140a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550522, "uuid": "0a2fd189-8ef6-4799-98b6-5a47060ad425", "comment": "Malware payload (ValleyRAT)", "value": "d9626c6d05c2083231e257ad505afc9e41b847a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784550522, "uuid": "c147cf19-9437-4f6e-b7b8-4e9c5162a34c", "comment": "Malware payload (ValleyRAT)", "value": "88a7a5d86b3f19ecf0cd3fcb7bd10dbe233f31853f9d42ea522d451df41bbdb73c6073da1660da1399589143d7887c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550522, "uuid": "01aeb867-290f-428f-9496-bbc185836238", "value": "T184C61286A2AC50F8D157C17CC8168A4BEBF2F8910B31C7DF01A9966F6F772A10D29357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550522, "uuid": "911bb3be-08d1-483b-9275-fc6a758ccc29", "value": "50da9c66b00fd68bbfb8d54a47418acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550522, "uuid": "b487577e-c7f8-41fa-a17d-91abc03b916c", "value": "196608:FQXqhoqk30RlSxZZM1MeJ76uFFkOuPlB+xGo3u0VWjcc02vVZoL:6XqHI0+HXMeS3FMvVZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784550522, "uuid": "5f97717b-82aa-4b00-962b-7cb6474b6919", "value": 11795776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784550522, "uuid": "59745380-f64c-47a8-a75a-bb74ed113ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784550522, "uuid": "36f4f1a0-1f25-4bd6-818a-03477aa492a8", "value": "mumumnq2.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a973d9c8-848b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1784587080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587080, "uuid": "5cc38f2a-9cb6-4d5d-9467-567988a33ef6", "comment": "Malware payload (Gh0stRAT)", "value": "2017e80c1b53a7358978680428d45b98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587080, "uuid": "f0b4d72f-f4b6-4b7d-87e2-9c5a16f2579c", "comment": "Malware payload (Gh0stRAT)", "value": "96c0911c225219cfd380076f5196d7ee87c617cddb968d3d465122473e20d6fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587080, "uuid": "86333b3b-8d49-4bde-a084-46ae75f6d074", "comment": "Malware payload (Gh0stRAT)", "value": "b56dd3281663e2db6f69991ef2f9c3c90ef21d71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587080, "uuid": "3ca282e4-5bb2-4499-ac96-1f630c8c52fd", "comment": "Malware payload (Gh0stRAT)", "value": "f9a07dffd67e5a06aec625bde71a2d67b1c176f4ea68d3223aaf58e74a0ae63d242343764a9f49d0c5d4269614fbf8f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587080, "uuid": "a9c57a73-0090-403a-a9f7-2576fb112330", "value": "T1483733842075E4BEC2541AFA92EDD9B36E356D24CB47E4DF12C5FC0FA0F0A8C5AA1752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587080, "uuid": "a7dc34c4-ec3d-45cd-a62c-91d1938c0bc4", "value": "b484b52df60e8d823b647a09bb1e39f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587080, "uuid": "1c9bfb64-e7b0-43a5-b399-405dbf4d4ab6", "value": "393216:TGrZag/6KiuKk9k9B/yyq03lvGwODuycrJSFuRMYp/27bWPRz9Ftjh1:TGrZl/UBky9B/yy1VLgpop2ihtjh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784587080, "uuid": "65f49f91-4eb3-45d7-9792-dd7c60bb6b7b", "value": 22751423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784587080, "uuid": "bd2a86e8-b3f9-4699-868d-107bcff18115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587080, "uuid": "99841eb5-5820-40ba-bccf-c3b3f0bbf0f9", "value": "yuanbao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de07d368-840f-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784533910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533910, "uuid": "eadc40e8-d3ce-4aba-ad75-931c52a51508", "comment": "Malware payload (RemcosRAT)", "value": "fe74edf558c2336b7f2b2c99d9a6ac35", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533910, "uuid": "908abe2c-781c-4096-b1f2-54327a6f276d", "comment": "Malware payload (RemcosRAT)", "value": "97272d6e3dcecb5d0269b1775ce2aca97670d4991bd7e43379d565bae2fc095f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533910, "uuid": "6b28b6b4-eb44-42c1-b246-8269e5b9f89f", "comment": "Malware payload (RemcosRAT)", "value": "fe31319dabe7f49809eba7f51518a39d3aeadadb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533910, "uuid": "47660f7c-854b-4f1a-8955-b574ad751309", "comment": "Malware payload (RemcosRAT)", "value": "76d3d47e04ed9a3816a9113ae1c54f9e57a74d4548dfb5d1375f667fc685d1e4eddb32209c417b7cea9890b1950c80ec", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533910, "uuid": "9550f36a-efa9-4d14-9640-351d2c6af3f5", "value": "T1006163139DA1ACE360EB196050CB6F4591ED7B9129A138CC5777CB720F2F54807AAACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533910, "uuid": "9df6e4fd-95f2-46e3-9fb6-82082e9b4810", "value": "96:eXJi8H97BQJmf2oj0j9agiYPOWNvRH02JXFIuL:SJi8Hwmf2KU9agIWZRH02JXbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533910, "uuid": "db360cbc-9eac-4b15-9038-10c5857338f0", "value": 3308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533910, "uuid": "dbd953de-4980-4655-aeba-2564160ff487", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533910, "uuid": "cf576c9d-8762-4a5a-8b42-a7b498051c3e", "value": "Ponuda 317258 HM Frankstahl d.o.o. 07-16-2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f7dd0c-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574884, "uuid": "4ecb63b8-c8a8-4cee-8ed9-5bf80cde8216", "comment": "Malware payload (Mirai)", "value": "25d7f30fb4dc7d5efef815694ee96edd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574884, "uuid": "e89d36a2-7292-4756-b93b-22f1422cf1f1", "comment": "Malware payload (Mirai)", "value": "973f0b790ce63155e93a735c98334879ffcda03fdd4976afc9e18fefa8af854f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574884, "uuid": "d986bb75-ea67-46b4-b046-3cd3c331b61b", "comment": "Malware payload (Mirai)", "value": "24c8aeeb22eccb465c8ba5f5c8370bdc8972caed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574884, "uuid": "0297ba6a-431c-42bf-87bb-44ae578500b5", "comment": "Malware payload (Mirai)", "value": "866f23e97e187ebc38ad94f5cf786829f1503422b74279672a4b21ffbb4488b78e3d8dd13c97f879d41aa60f87ee5fa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574884, "uuid": "6fd5b519-a445-468b-927f-d9baa2d38813", "value": "T1DCB32A45FC829623C6D7237BF66E428D372263E8D3DA3107DE256F21338652B0DA7A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574884, "uuid": "66464a32-c493-4d68-83a6-c731c50cd179", "value": "1536:Eq8q7gFsYTo41vn2Ue0/Zd3PobzlhCWc4obhuP4m3pBVaUhvGC:Eqn7gz841ulZI4obhnUnGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574884, "uuid": "eaa08c61-231e-4c84-bdba-228d50003860", "value": 113064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574884, "uuid": "1659646e-4d76-4e62-a719-edd5e9d4dfe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574884, "uuid": "e88f666b-1c25-4c78-92a2-20dc53e3fbf3", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec7165b-846c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784573694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573694, "uuid": "2d81d1ca-59a0-433e-8d72-bfd1d983d8b9", "comment": "Malware payload", "value": "73594229a9cbab08f19994bf1045861e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573694, "uuid": "ee2fed7a-e8c1-4c21-94dd-df3c5cfbba2f", "comment": "Malware payload", "value": "974ec0c700b15d10bc0c00b18a6f60334763675e0481aa7bdbe0215353f7c889", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573694, "uuid": "4b6ad9c8-f37c-4418-ac0b-994b99e167ff", "comment": "Malware payload", "value": "44dcea1d3496053eaa9a50230f57bcb03d056e72", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573694, "uuid": "126be19e-853a-473f-8bd2-0c65fb9699eb", "comment": "Malware payload", "value": "6eb4ca10ed5c5db8b21adb272b0bfd79cf379fbe9248365d8478f00c4f604d2ff0a55f18ef0f1da63c1d3c8d7cc309c7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573694, "uuid": "bec4533a-a096-4407-8b62-6b275122474e", "value": "T17C31DD442DEB0705CAB2DD76AD395B824E373802E830885D14588E8D2947F41DD24F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573694, "uuid": "3ec04864-ac85-44c0-a3c3-e5ce0d8198fd", "value": "24:8wJP08MLUoA5ULrglOpH5ObAkN25nAkN75nAkNM5nAk/RjT4cUt+yMDdB/jX4MXg:8qwOUgApHs12f7fM1F27MDbsM2c9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784573694, "uuid": "bf1d1d05-1778-4dd2-b9e9-fa31f6313a92", "value": 1819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784573694, "uuid": "e188fc4b-068d-44c1-b996-fe9ff60665ee", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573694, "uuid": "2df66307-4d22-44b2-a720-c8ea41b85578", "value": "Document.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e4be63-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574840, "uuid": "d8eb4215-a64d-481b-baaa-2bbea365b2dc", "comment": "Malware payload (Mirai)", "value": "c8d8958142ea407b94219b837555fa89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574840, "uuid": "1fd70243-c7a0-44db-87c0-987f3c75434c", "comment": "Malware payload (Mirai)", "value": "9880eb40dbffc85f31d411dc5f28344ef101494dd2944a87bfa1f87a917b83bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574840, "uuid": "a80f3557-ef95-4aa8-bd26-57f76ef1e738", "comment": "Malware payload (Mirai)", "value": "11188183348a217776a03a62f146dc315ab2dbbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574840, "uuid": "ce0926a3-b5d4-4461-8266-35774d22396b", "comment": "Malware payload (Mirai)", "value": "c758cc6248fa8befebcc9867e46a4251991dff6ae1780fe798236c25abdd22949ad1450309baba63e81629c1119407af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574840, "uuid": "f0c13afe-6540-41a1-904a-c874b8351423", "value": "T168C34902B46148FCC156C474C77FE927EA31785E13343A6F2B84BA712E22E755F0AB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574840, "uuid": "d169ee9b-0cf0-4557-b897-cb05c88916c9", "value": "1536:Cl+xWDOtHexNDVWt49uJU7YBGPKca4SCwJUZPFauU6zp4iHl1/s9GS/ziD5CaG48:Cl+pexNDO2kJGycfHVFI9G2y5CaG4KV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574840, "uuid": "c63dfe41-2a14-4856-ace2-4499847b5c71", "value": 128904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574840, "uuid": "75f0b328-a1c7-4d63-8f33-ce718611f4aa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574840, "uuid": "ea76c78a-7748-4468-9056-afc27569efef", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb63c2a7-840a-11f1-be1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784531705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531705, "uuid": "f4046532-300c-432a-ab4d-36298492ecf6", "comment": "Malware payload (PureLogsStealer)", "value": "680bb6e6d497d417d4bc16b1fd94d3f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531705, "uuid": "06eae203-e510-461b-bb9c-48d82bde4adc", "comment": "Malware payload (PureLogsStealer)", "value": "98fc05ed9f1666528d49980decbf76cff8f5cabd695537eb623340e451e28401", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531705, "uuid": "bed5f4ee-51fd-4a05-9883-658495e57d06", "comment": "Malware payload (PureLogsStealer)", "value": "aea53118212dd62a02695ced185eab66bcdf7457", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531705, "uuid": "7ba2ca7c-8923-4180-afc8-d95c8396a9b8", "comment": "Malware payload (PureLogsStealer)", "value": "2fb960f2325603577130682291a86064a652fd5b90f68d2c12887a2b7559bfcec21b4f942c957061e563aeb71ff83573", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531705, "uuid": "3e149785-16d9-467b-846d-a781e8b9d5e8", "value": "T191A57064AB91846E1237CB049BC935F6609F3E6253EB88F507750CCC875358AB5BA33B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531705, "uuid": "3b9d10d4-6be0-4f91-ab0a-6db8d607d01c", "value": "12288:hIjhHQMgRfPcQXZ8O46lWWh4YNC5fbnyjzuCAAy51nVEiY4hvCqPYbdD:dUJ+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531705, "uuid": "d13ee347-4487-40db-8864-ed0378e109a2", "value": 2136812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531705, "uuid": "f8fec096-0b1f-4039-a5ef-63860d563fda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531705, "uuid": "14839dd8-c675-4fd6-a6ba-ee80c651c6a8", "value": "RFQ_MT26_0717_Enclosure.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da453503-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574706, "uuid": "7dd82605-467d-4d78-ba68-0caf04f22ea1", "comment": "Malware payload (Mirai)", "value": "ab2276d880edd11e081e72bbaf867af8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574706, "uuid": "4c791ce5-1113-4885-a51e-bd6820982f10", "comment": "Malware payload (Mirai)", "value": "993012e0659b402b9ad154ffbbc6d7ba0c69dc79fcf63cc23886ddd6286e79e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574706, "uuid": "c17d1698-220b-4388-86fb-4bb546fa2d21", "comment": "Malware payload (Mirai)", "value": "fa0d6c790c1605fe39c449b3be07b33f5e7fe0ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574706, "uuid": "0c8e1f9f-eb4b-4524-9cab-b227730c4f0d", "comment": "Malware payload (Mirai)", "value": "f5964eb5d18bd04ecc98749f78f3ac483fc2b5820ba308c9faefe32171cbdb7b99ec6a3415331e73c79b202ddef574b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574706, "uuid": "13351a14-a382-414c-bc26-e77e825a003f", "value": "T1AC042A5F7720CF61C329C53045F38B9666A922522BD2C889F35CDE087E65389A92FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574706, "uuid": "645996b9-1e78-4b53-98dc-a9bfd75b45ea", "value": "3072:mqS754eB/M7Pzpc0Zv/28r51TYWL/TH574ecSQX0Kb1DNjC:pSg28XbvG3dkKhdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574706, "uuid": "d9762ec8-447e-4dba-85e9-2f9a4c78f255", "value": 185036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574706, "uuid": "b2e9177b-8e67-4088-b91a-59eb5ca68d13", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574706, "uuid": "a42e43ef-6476-4bc2-b768-93c6b7ef6085", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de168dd2-840f-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784533911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533911, "uuid": "65baf340-8388-4c8c-b9e7-af921e50e144", "comment": "Malware payload", "value": "a6b0f68db815078e93e49a0bd575fd1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533911, "uuid": "9ddf204d-c966-4053-901b-2175c9c15ba6", "comment": "Malware payload", "value": "9a3d1161f32cefd7b28fa38ca355aabfb108b771e30f49f507781d80cc5ae7ca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533911, "uuid": "d40f7428-52e1-4b22-a73f-dbee16fa0d90", "comment": "Malware payload", "value": "7ac9331a9788c10a56d25445b61408806da5fdf3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533911, "uuid": "3cd8df85-bf7e-4df1-b878-ddfecb3c9495", "comment": "Malware payload", "value": "f1a467b081dde5c6249a21beed2b13bf0740d189f76e1bf1c793e1c4401ca60f3ae49e92326e0a59d26642839eaf1aa0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533911, "uuid": "95520c32-807f-43d6-abbc-b09a5a6c2af0", "value": "T1CB118CC6D0549C0050AA941D25D761A4F831C3C7299B8F6ABF5C942DEB98E14B0A6F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533911, "uuid": "da4d7557-c793-4a92-9d9d-9fc8901e70a3", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkasjCFf8C9+UFC2rjoXC09x2RqCmCM3NNX:kXCKysE2hi0ziQvZohawVEFVk19ZhvvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533911, "uuid": "f8272a8e-57bc-45ee-9518-63078bd1aec7", "value": 856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533911, "uuid": "a682cfd9-7c13-46bc-9b74-cf41d440745a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533911, "uuid": "50df8bef-8346-4f5c-b08b-97aaf61e2373", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab939b18-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784534255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534255, "uuid": "6123cb19-ab69-4ca8-a8f5-5092a47b406c", "comment": "Malware payload (PhantomStealer)", "value": "c8a7ae786c0294734130e1685a6f5ae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534255, "uuid": "3125ca8a-6419-4bf5-b222-4fb7c998cf2d", "comment": "Malware payload (PhantomStealer)", "value": "9aa928b433983f53758e42961aa0cf8096a4211a5562bfcd7ba3cb63d902282b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534255, "uuid": "869d6fef-93ae-4703-aa9c-f2f221b9f8be", "comment": "Malware payload (PhantomStealer)", "value": "98c8c5d84a81cc068d24a68b1e2bb3dc7babae41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534255, "uuid": "2d8fbc48-4e25-417d-a4d5-0ec5c489218f", "comment": "Malware payload (PhantomStealer)", "value": "373cda6417adbe6235c44c7a4f8a40928b504db78f55490e622c9b8322fb5ce3c7749faa97e973d5f796e8fd19a3eae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534255, "uuid": "82fa0487-4625-4922-8486-5889b8ee6318", "value": "T16E452358A7ABD542C461037388E1F2B293B28E49F633D32FABDD3DE7B1253465E46241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534255, "uuid": "9a066e69-68f5-4a53-9aeb-1b1789cf6fe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534255, "uuid": "8e1f4dca-90ea-475f-9639-4fbb8e0e0db3", "value": "24576:nwlJtvWmBwtBFMkPSrNazB9SuPq47lChYLD6pHa:PoQBFvSrNazB9SmfiOD6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534255, "uuid": "59b0495c-db7f-44aa-b12e-9f3c6b2d33e9", "value": 1220096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534255, "uuid": "a2303b83-c202-4f24-83d3-451124e2a0eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534255, "uuid": "272a9bee-6efd-4b25-a672-b203388207d1", "value": "RFQ 20260731392 _ Request for Proposal.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b698d4e1-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574646, "uuid": "63b3bc4c-a83c-4e9f-adc3-1fe26e8e3494", "comment": "Malware payload (Mirai)", "value": "c6df1be919ba9fabe8a306295af1cda9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574646, "uuid": "ed9be6fd-169d-49e8-91c4-37bcb34be1a0", "comment": "Malware payload (Mirai)", "value": "9ae4c073425a620c849839f1861f81866b8ea9790bd9146fdef5133f5c26ffba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574646, "uuid": "26347c04-bd27-40a9-a12e-2505c59888c5", "comment": "Malware payload (Mirai)", "value": "84a11f7ba7b2a76aaf5bc31812be4218c56ea665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574646, "uuid": "c0b3ca3e-10fb-41ec-9ec1-42dc909699d9", "comment": "Malware payload (Mirai)", "value": "536b39c735e503381112059744c44b6fb7445cc9d883fe15c541cecba609ed00c88eab421fcad6c694b1cde360db2708", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574646, "uuid": "f57ad955-bad9-491a-9de2-4b2debac3b6d", "value": "T13F634B5359408AFDC48261F44BFF5523C923F87E1673A6CA73D47F563B09EA02B0A689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574646, "uuid": "db5d181e-2ae9-44d0-8796-c4af351aae22", "value": "1536:G6YuazgV2INi1UPixRhLEmncsZDbBbvXeuQf:pYnIkyaxHoYcsZftvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574646, "uuid": "7902d5fb-9392-4d7c-b0ff-d022d6f8006f", "value": 69240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574646, "uuid": "a6600fbc-af0c-4aea-9d8b-7b04414455f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574646, "uuid": "d136baea-b3e1-4a27-9b79-49dfff2ae2af", "value": "nullnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5c3356-846c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784573770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573770, "uuid": "dcb9d18e-a401-4b15-a092-ee0a70b22610", "comment": "Malware payload (Mirai)", "value": "a62ab68b2c9532c7bfcfe1e2e5d6782e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573770, "uuid": "736d1699-eb95-4cf3-8291-aa3d311ebf53", "comment": "Malware payload (Mirai)", "value": "9b441caa70276b8de1b6d3eaba0e72c27b31630e927b9dc1519429c083cce766", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573770, "uuid": "4a66b819-3af1-4480-8e0c-bfd7cff82e29", "comment": "Malware payload (Mirai)", "value": "b47a98216cb46d88d3a3483757fc288668b02ed1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573770, "uuid": "2696f455-cb8d-4aa5-bba1-93c5c9e26fe1", "comment": "Malware payload (Mirai)", "value": "950a2711329791bbad59eae6487e89615f9487d5835bafe46c559286f76cf1a3b88e5bf5b2736d550e5df7fdf3baeb8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573770, "uuid": "951143b4-8b8c-4ae1-aa5a-4629dbf20421", "value": "T1F963026CA23D9C5AEBFD56F23D8DD68067C41F225F60D7416554A308B882B9BDA21FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573770, "uuid": "f42a46eb-fdd1-4472-95fa-ddfd323fa0dd", "value": "1536:Zw2haGw5AOgRkMdpwDK6op82q2tCsen32Hr6qLD+4u+qgw0rN:Zw2hHrrdpwDKPdjKmHr6qL64u+qgwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784573770, "uuid": "010af5a8-b41b-40fb-b1dd-14a55e67a8cf", "value": 67144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784573770, "uuid": "28f46d67-eb2d-40d2-8630-36e1f86e9952", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573770, "uuid": "920a01ed-1af9-4486-ab2c-232badd5435d", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7417d78-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509391, "uuid": "737ce4bb-1b60-4530-ace6-ca07a1555295", "comment": "Malware payload (Mirai)", "value": "21c5786fe8a5c59d02df1a58b4ff833c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509391, "uuid": "5e4f69fb-05b3-4e79-9932-58880efe1cf3", "comment": "Malware payload (Mirai)", "value": "9cccf931d90f97b1380731af74213b539574e975c4e8b0c6a683aa0fc0e7183f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509391, "uuid": "6a42d590-dd1b-46f4-ad63-c1ff74ce8534", "comment": "Malware payload (Mirai)", "value": "e972aa9d979562a8330507eac99dd32edc828124", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509391, "uuid": "2f4b1feb-3773-42da-99fc-e21ee2faafe3", "comment": "Malware payload (Mirai)", "value": "0e88284f997b16700ed825007aae1591447f842d89997cfaf5fa00aa91f781065e6ecfe011120c7cac97fc26498835dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509391, "uuid": "9c2111c3-f214-42a9-8226-f09d5d0a18c2", "value": "T15913F1F805128EF5D91AF1B306F20B124E809FE2CC07FC47849AB58AD8E9C9D5C537A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509391, "uuid": "cb9a55fb-25c6-4499-a995-d77a3382b436", "value": "768:fVKH+MeiZH7vnvd68KHyM5Fg1/WKbJjCn7SVxcOgEXjgZJgGlzDpbuR1JU:fV+1eObvnvd65HyMjiW4+7SVxcOgEXjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509391, "uuid": "c02bcdab-8103-4180-8270-7fc6ec1ecb77", "value": 43272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509391, "uuid": "cbaa9408-74e4-4642-aead-aaec3d2641c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509391, "uuid": "4f25a588-a79a-4c91-8d8d-044af6d6df43", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1f6811-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574580, "uuid": "fcae5a42-5ed9-42bc-9623-2249006f06d4", "comment": "Malware payload (Mirai)", "value": "999d30ad38f17547cfe6b003b62aa668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574580, "uuid": "6fc3519c-ad67-4cdf-a246-ca5dae973731", "comment": "Malware payload (Mirai)", "value": "9d0e379d8565a38e3e50eed590ee32b71641b296ce35a7e6afa4e08666dc2300", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574580, "uuid": "8fe88a8a-c549-464b-89f8-d2fd52ce689c", "comment": "Malware payload (Mirai)", "value": "8e37f5fcf410c8cbd64e3ca74c0bdaa5c40a5293", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574580, "uuid": "8e3a7f4e-09b2-4fbe-a3fc-70134f3f685b", "comment": "Malware payload (Mirai)", "value": "c0dd0a9795d43f9cdc98e840d712db3402c757ae9947f27fc435d2c125e5055f87cfc43fb180f1bb688d58e96dc997ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574580, "uuid": "5a68c542-f4f7-4764-8fd9-67d5f00ef4df", "value": "T170731A59F9819A62C5C145BFFF0F828D772603E8D2EB3307D9196F61368786B0E2B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574580, "uuid": "900c1580-b9ba-4ce7-979a-1a773eabf57f", "value": "1536:WwPjQk6IYICRgOmv8KngrKLYRM9EDLmO/QDyDnHOJvGMn5ZLCZRP:WwDxCRrFKgmMRM9kEd7n58P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574580, "uuid": "70d6ddbc-528c-49ad-85da-f9e2e0d5c766", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574580, "uuid": "c4046d8a-dcf7-4812-a624-353c04f7f0bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574580, "uuid": "689223e6-9d7c-4e03-9c21-00e59def011e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2475b57-8414-11f1-be1e-42010a9c0009", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1784536092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536092, "uuid": "e1823b8d-edaf-4c46-9cc4-1452b7539842", "comment": "Malware payload (Socks5Systemz)", "value": "a77da66551da74d743efd55f09d46dc8", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536092, "uuid": "e8aecfe2-0a42-445c-a795-04699e72d4e9", "comment": "Malware payload (Socks5Systemz)", "value": "a0abe6eb238036b9a233799296c270282a19f603ed5560d4874a277fa55b17c3", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536092, "uuid": "b83f45d7-2ed6-4368-a7e4-c984dd67269e", "comment": "Malware payload (Socks5Systemz)", "value": "ae67101984cab3956d8a8f50c36418a102909723", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536092, "uuid": "e9e7fe56-ad06-4207-bf37-95412e5c43e2", "comment": "Malware payload (Socks5Systemz)", "value": "07a8ae02d2a0642e2fcde8151060cfe964b45edb03b4dee2815c9e88a72829a39b75ec22e527057ba2c41fca383a3b93", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536092, "uuid": "13c02cb5-5e59-4c35-ab7f-250f8d925e25", "value": "T1F3063320F76925B9E18FCAB16D21A40A9D2F6CF43D307466319CF586FF278617490E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536092, "uuid": "4fdb75b9-259f-4da3-a0f5-23cd756dd198", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536092, "uuid": "e3ed58d3-1373-4031-b8ac-e5fcf623154a", "value": "98304:NuAqV8BdBt1VDr8g5JKlwba+MXhvy+HwL+YAK6EsPZb:HpBvbVDrZ5JoBRvy+H9K61p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784536092, "uuid": "a30c4f18-64f8-401a-a4ad-1b7951696661", "value": 3946298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784536092, "uuid": "69d01ec2-45c0-47e2-ba66-69b7d3bcc162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536092, "uuid": "9f68ac97-324a-4ff7-9c58-df63f7174c04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2c1128-844d-11f1-bd95-42010a9c0009", "comment": "Malware payload (KongTuke)", "timestamp": 1784560291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560291, "uuid": "66be9f05-4faf-4c3f-96e0-a0fe7dfaeb8d", "comment": "Malware payload (KongTuke)", "value": "37a499bf29ea274a9482a3383c3d06b1", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560291, "uuid": "a03447c5-fa53-4f1a-ac12-1ef9a5822210", "comment": "Malware payload (KongTuke)", "value": "a1e14e2b06dc859053cb63cfa9e76b4ef43540a35d736dc9fb1c39986bf67654", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560291, "uuid": "a4312f9c-2055-4659-bac3-e4709326d75b", "comment": "Malware payload (KongTuke)", "value": "ca1217edf2d141cafd819a622589fccc89cd40e5", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784560291, "uuid": "5776bd7e-c067-4a5e-87f2-547ad0267e77", "comment": "Malware payload (KongTuke)", "value": "59a190675ac9d686b8168f6dfeee785471a22a4553ac96e7869fc4221b25ee56105ad733ef0c058b6e852c392460f939", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560291, "uuid": "5ed4ef02-ce00-4900-a0ca-572defb5fcc9", "value": "T1850733DE60E0617FE04CF618F8CA1BE8E9210C8893D35C91DB2775A5A427B96C776E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560291, "uuid": "602fc023-f444-4ca1-b34d-0aba930cc227", "value": "393216:J/zDs0zdBadqZxrJUZLpNHK8MZGm0D0IxmJwcX1iFi19:9/s0zdBaSxrEpNHKTrJ1gc19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784560291, "uuid": "666448df-a161-409b-a201-c4b74c7452c5", "value": 17467430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784560291, "uuid": "677f791b-460f-4196-a13f-9906184b6d50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784560291, "uuid": "2dbc7997-5137-4e62-a0e6-a5703d6abc00", "value": "package", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25b072f-8415-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784536387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536387, "uuid": "3ca42080-107c-44f7-a1b2-d98ae725e77a", "comment": "Malware payload (RemcosRAT)", "value": "f5753f1eff1d4d2d38d1a842adbd3689", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536387, "uuid": "4126e464-bb48-4026-a11a-3a0038a71643", "comment": "Malware payload (RemcosRAT)", "value": "a2ce570df9866a5ff6f1ba891c18126c754b2c72d2d992306d04d2e132ed2516", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536387, "uuid": "9d433ba4-183b-4888-914d-09452ae9cc26", "comment": "Malware payload (RemcosRAT)", "value": "733d5e76ab4a6ab07db4a757d42ead6e962869e6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536387, "uuid": "8e299eec-51eb-44fa-bcf5-4f0eb6dc92ea", "comment": "Malware payload (RemcosRAT)", "value": "6ae1d506b2cee3bedfdea3e3def7857223bc493e8a450bac364cca294a8f5b8ac5147bdd7d6d6e4c2f12f92e83d1d65f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536387, "uuid": "952db538-be4e-413e-9f1e-274b035f96eb", "value": "T11AE2F711C5D55BBD9D0617BDAC80350460FC4729813EA4DCEBAE731D242E4BCEAB6AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536387, "uuid": "de632cd1-3fca-4e65-bbb7-3ccce8444427", "value": "768:LmA/nDcVUK+1sEHM4cv0c0ij0f9MX+jswn8d:qA/DcVtEccJq5Am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784536387, "uuid": "66aa7c1b-a686-40dd-94fa-b49ce8ede5c5", "value": 31527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784536387, "uuid": "1d243d4f-779b-4ed8-8ab2-35508e2698ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536387, "uuid": "d2ccb1dd-a260-4d19-ab3c-26554a1671a2", "value": "Invoice_details_for_confirmation_scan_0715202600.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acd045e-843e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784553877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553877, "uuid": "685c3b09-ad83-4322-b425-11131098b894", "comment": "Malware payload (Mirai)", "value": "605465a06cea71ff9b65e260881a0578", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553877, "uuid": "997d4779-8cc1-4137-b7e3-1e13575f53b8", "comment": "Malware payload (Mirai)", "value": "a2e31a2548c728b304be780d7c114738bfd1bb8fcc6f8fe7eda3b0f9cc2fc696", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553877, "uuid": "6d9a8611-f14b-4161-850f-295a5d4a7655", "comment": "Malware payload (Mirai)", "value": "076355c65bdfaa28e08018bf08fb0eda7a0eb19f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553877, "uuid": "09084ef7-9481-45c9-ad9f-aa5bcc6e3ae7", "comment": "Malware payload (Mirai)", "value": "ce3d2a5fbc95a265e40952b4865fa675573238096866bf7191cd5bb6b61f8d1e00f03904e7376c0a8c031ee686afea50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553877, "uuid": "530bb973-5acf-41d3-b430-555aaa847fb3", "value": "T1BED31959FC829A12C6C3567BFA5F82CC332723A8E3EA7117DD155F25368B91A0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553877, "uuid": "9cd9e890-172b-40c9-aeb5-906721da99d9", "value": "3072:+f3J9M9qJ7Lp3b/SFQeeyxuRmqaj7en8l0Hnb5:+f3J9S87LFbLe65ajC8l075", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784553877, "uuid": "98842d6e-f676-43f1-bf5e-2d89725e14c8", "value": 132428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784553877, "uuid": "939c5a7f-c80b-4e1f-be2b-1fdcd3a3674b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553877, "uuid": "a4581e21-90e8-4965-8b64-327f64ceb826", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6c2ecc-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509478, "uuid": "9ee03ca4-3f0b-472b-9358-a2cee8e16641", "comment": "Malware payload (Mirai)", "value": "d125f95b5cc5d85652cabc920421ad5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509478, "uuid": "7d3eea27-eab0-4a20-88ad-788da3f7bc33", "comment": "Malware payload (Mirai)", "value": "a373bfd15be694b9145c506e9356e54dad6c6fe18ec6c628145b6018ca3e70ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509478, "uuid": "21be6f1f-c94e-4d63-ab16-60ed6226c535", "comment": "Malware payload (Mirai)", "value": "fb22effd1fdfe4ead51d356c13633d9b74054bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509478, "uuid": "d0f8e29e-0ee3-49e4-855b-03dceea2f271", "comment": "Malware payload (Mirai)", "value": "0b2781364f2315abcf01ac808c3969ac157d0552f6361f9f51379a13bc8e3278b4387310092f2883ccf812b540d6e984", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509478, "uuid": "413e5081-6726-42c2-9f1d-ed7f1d8c6389", "value": "T178837DC5EAC3C8F5ED2309351272BB275AB2D03E2268EA83C3A5D975EC125C0F556B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509478, "uuid": "bd10c04b-277f-4799-ac46-1c323e4d8103", "value": "1536:RWOLMM5Md27oHyLijia3tAjw19KHVdxYQ5LBn:PLxMdOTLAigti+9IYQhBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509478, "uuid": "b627e4b9-df9d-4ffa-9f9d-b259cd8d79e5", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509478, "uuid": "d62d1398-a4cd-4f63-a6dd-0ca24ed36237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509478, "uuid": "f18ce6a7-13b4-461f-9702-f250e7cdf075", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d304845-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784574577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574577, "uuid": "e92ae3d8-fe28-49a5-a4e4-0857368abc66", "comment": "Malware payload", "value": "eae0a2c80d73ff7bd7fe4b2b9f2699de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574577, "uuid": "5b7857fc-ed84-41c8-8fef-327b9b201b0c", "comment": "Malware payload", "value": "a4c5bd41b0d5f3c5050de5f45223d9e641ef39a7c7bdf9cfbb02030291a65036", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574577, "uuid": "1d698c2e-b8fd-4351-9895-b6010a6fffa0", "comment": "Malware payload", "value": "c795ff33f0a942cb5a2733a5d362913e8fb0769b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574577, "uuid": "3cf44968-a694-43d0-b107-e018577f8cac", "comment": "Malware payload", "value": "18586aa34910ce4b65ac169e621faff743926a9c280f722f110e46518dbb9d27deb4634f66eaf2e686298227ac1f3657", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574577, "uuid": "49434e28-ef5e-4538-a476-2b3faab8ce15", "value": "T16C21E3C50024499DDD02AE48F77BD8C0EA5A8296FE82BF0BADD9456AD45CD34F4DCAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574577, "uuid": "799b99c7-db58-47e1-b52e-c3f07a302729", "value": "24:HGk6k5keNIakzKiHkwkLkIk4jkVkZkuk2:mk6k5kOkzjHkwkLkIk4jkVkZkuk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574577, "uuid": "10714968-df70-4ded-8e20-4df1913574b8", "value": 1117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574577, "uuid": "6b0b1230-f04a-49f5-9e6b-4922c8df5a70", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574577, "uuid": "632ce702-c98c-4d98-ad6f-0f5103ffa192", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68e27e0-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574620, "uuid": "2dd41647-5eaa-466c-abf1-aad196e804de", "comment": "Malware payload (Mirai)", "value": "238eec0456d0e6f20583aa451ce565c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574620, "uuid": "d02579bf-bc2d-4594-9495-ae396ddc35f2", "comment": "Malware payload (Mirai)", "value": "a560251bacbb07fdd69a5fb9eac12b502dae5d684fdf682a5bf55ffb1c746bcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574620, "uuid": "cccbb241-a0ff-4339-ac77-9f3caa821d77", "comment": "Malware payload (Mirai)", "value": "99273884485f8e043cb82d79734c1ba644793e08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574620, "uuid": "690ddc3d-4f92-449e-885a-b4ff1d18f463", "comment": "Malware payload (Mirai)", "value": "63b2be72cd2ef6c04f5d9dcb9b7eef32e102e9c8aa5ef4ca1d9324625c9e148270c79325553b6fdf2e91687b182e029c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574620, "uuid": "fc651902-fcd4-402c-a6e7-00a8f06adc35", "value": "T18B633A8BAA01AE3DFC47E6F542630B00B53176A59D631A17A261FCF33D311D0E96BE94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574620, "uuid": "233590af-ffa4-4585-bc6a-cecf6e4a8353", "value": "1536:QwHHJfUgDxcYHWyEPwUFKf+hqi8Yl9SM6j2yC0Qfq:QwJMgDxcUf+wG6j39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574620, "uuid": "8c2b9b8b-1cf4-4998-a0ef-efdf70fb7864", "value": 67076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574620, "uuid": "7472b944-8f5d-489b-8f0b-47107e6645c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574620, "uuid": "b3922c87-6d7a-4bb4-98ed-6b45f3e9f31a", "value": "nullnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121e52d8-8496-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784591550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591550, "uuid": "083f4330-70a0-4112-9b78-516610862a27", "comment": "Malware payload (Mirai)", "value": "ab8a3b09e6878b2ffe3d13cee8443b12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591550, "uuid": "5e2c1c90-662a-4c3a-b5fa-e559dea83a8b", "comment": "Malware payload (Mirai)", "value": "a5892c7527aceab6f01efb2e266fce135dc6701e3d34cb5f56b857bb28aed901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591550, "uuid": "7ae89c64-1800-4114-bc95-b515d0a4e59d", "comment": "Malware payload (Mirai)", "value": "dbb2a0df710089474dea7ecec4e0479f578988c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591550, "uuid": "1ce44cd4-7b38-4094-b717-4a6073fa64a6", "comment": "Malware payload (Mirai)", "value": "03dc91ab33779476156dc42c498ce2b57505877c6a9c0c83974dfb7b0eb7d4d3d9d896906e69149eac7cf9e34707f8e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591550, "uuid": "152cea03-1e7f-470e-ab4d-84ec79b511fd", "value": "T1D9F2F23A220382A7E549C17F0EFF43403EE51677A8429CC6D40EEE668EDD572744AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591550, "uuid": "acec408e-9954-4040-9b39-dd220bd6bde8", "value": "768:oQAYWYARxmy9oL05yz63x5qWuqzi4efsQaCfFJgGlzDpbuR1JV:1V5AHvqLGyz63Tq/qzihvPf/VJuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784591550, "uuid": "2dd0e570-af32-403f-9ed9-c099320a3b13", "value": 37112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784591550, "uuid": "597f3cec-036c-4b95-a892-eadccea443af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591550, "uuid": "d8a2706c-8f62-485b-8cb6-0da41065e528", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e8d57e-8404-11f1-be1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784529198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784529198, "uuid": "d08c792c-e43b-429f-9ff7-14181cf30bf7", "comment": "Malware payload (Formbook)", "value": "7102ad31aefa964c627a1d2d2cd5db79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784529198, "uuid": "e719b92a-d051-4e9a-baf2-1ef265cdc3c0", "comment": "Malware payload (Formbook)", "value": "a6604cb175b8b162e4657114ab071ce8e1e04f79e6615201f01f4d16f985cead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784529198, "uuid": "9d709af1-bfe4-4065-baf8-c36e7d5c6a01", "comment": "Malware payload (Formbook)", "value": "14be46147b431e56345a64f1d43b44ef0cb064f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784529198, "uuid": "46470933-4d04-4ab3-b6d4-206b9ff28f6b", "comment": "Malware payload (Formbook)", "value": "a4e4600858b3ccffd4bd293e61f4fa0b75aa9825c316bbe25988a6675b823cdad8d1c37512f029f35580e9327ffdd17d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784529198, "uuid": "b440a2d2-f867-4c7f-ad79-5cf0b3cefa01", "value": "T1332512C5B7E9EB16E6B447F00AB0E13147786C2AA031D30A5DEAFCDBBA75B151810793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784529198, "uuid": "2b41f702-6009-45c9-a53b-bec44886e5f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784529198, "uuid": "aa0d811d-0929-4723-a64f-4e13039d8614", "value": "24576:fYj/Og3PVFoQ/HB+Bc0q/+y9WIN3Dv0A4EZg4IOlwVt:yPfVSQ/h+BcQI9v0A4EZAOlwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784529198, "uuid": "94e95e45-43b3-409a-8991-e2448d6e4b5f", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784529198, "uuid": "b57d01c9-e303-41fa-a5af-8ce875fd5320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784529198, "uuid": "7a0297ff-ce61-4c72-a5d0-684707c940f4", "value": "RFQ Specification Sheet Taiwan PRJ00498736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849e1e61-847c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784580576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580576, "uuid": "8108c057-4137-45de-b45f-5c1b57797308", "comment": "Malware payload (Mirai)", "value": "51d086123dc2ae69563a429737109239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580576, "uuid": "0422c92d-c6aa-4903-838a-8dc6383887ba", "comment": "Malware payload (Mirai)", "value": "a927fe3149e454d08a3a87131ced2a785da121fa879566dbb274aa29d7732eb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580576, "uuid": "a842ee7e-e991-4239-abcb-ce655d7bb7fe", "comment": "Malware payload (Mirai)", "value": "8443c0c133da96836bc84f8de527e4af6e834a50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580576, "uuid": "ae394668-c047-4e25-bcfa-9ef12c5667d0", "comment": "Malware payload (Mirai)", "value": "056a88e00614c6286abe45ae26af97337311ef290984617287cfd41fd753ac79d50d26807be66e084006e990a915a4d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580576, "uuid": "a6449b39-0592-48f7-880a-a9fcedb62ca9", "value": "T1CEC329A9F890DE52C6D526B6FB4E418C33231778C3DE7106CE149E3467FB95A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580576, "uuid": "88089c08-4268-496a-a0ee-86960d35ba8e", "value": "3072:QuIBvPRfsNDUxMa3tIDrcYEEUIAyMW0NwhBigpmqzWNiF+WOuS5mf1Dl:QJ5GytercYEEUIAyMWGwiOmqzpJom95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784580576, "uuid": "114eec36-6814-4198-95f6-b523965f86da", "value": 128444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784580576, "uuid": "52935479-f8a9-4376-a760-793fca0052c9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580576, "uuid": "f6937b27-f39c-41a6-9b33-247f8ea407d8", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc150a1d-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509399, "uuid": "9612fc65-be67-4d1a-bb0e-4a8d3123e5b4", "comment": "Malware payload (Mirai)", "value": "6a0c389d34a8d78404fe82c289ad0417", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509399, "uuid": "3d860d7e-e077-4701-9687-f0aeac3d0cee", "comment": "Malware payload (Mirai)", "value": "a978a84fe498c755e481d161e22ed41087b93100a6b2648943c251208eeda3eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509399, "uuid": "b76587b8-9e7a-43b3-9112-610fe8622e8e", "comment": "Malware payload (Mirai)", "value": "774803d6578cee5ba77c5f47d06f153cb2d21f0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509399, "uuid": "92cfd73f-06e5-47c6-8a5f-430a29c77300", "comment": "Malware payload (Mirai)", "value": "2cf22dbe687f70934e3a3c8524ab656c41a736c6547e3b405812989f4723d44558aec01da746d040a6eb954a06bfbd88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509399, "uuid": "64efc2c3-b1c0-48cb-9c97-cec72fe0933c", "value": "T1C2030217367A4A16E84A403D02EFB1673810DA6FB41769E039F48437AB5CF087D7D697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509399, "uuid": "cddd6fdc-ed3e-414c-a4b3-46ea865772e8", "value": "768:ngQcD4ioAAYVyCH1DIQcjxDyELLLl4bZZxOTOCZVf0FZnNz9Zhi3wnbcuyD7UHQC:g6diVlth2xDNLLLl4bZZxexf4xignoup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509399, "uuid": "bcf41f8d-f449-4545-b016-c7cf0c2c3f5e", "value": 41288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509399, "uuid": "7322ce80-4575-4416-9b2d-f23f0095d285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509399, "uuid": "a692dad4-17ca-479c-b484-443d4059a6f5", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22aafb81-846c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784573539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573539, "uuid": "f8fa12fe-9caf-47e7-ac63-854e343a1df0", "comment": "Malware payload", "value": "5afd4bd0c91d3ce29f4443c3a824cb0a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573539, "uuid": "3205e366-8157-45ce-8bc5-96734823649d", "comment": "Malware payload", "value": "aa7beabc316e7000bfde9d50baac1e044518893a4e36325278519b964652e9d1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573539, "uuid": "8972db8d-583d-44cc-abdb-94b989764e5a", "comment": "Malware payload", "value": "07251993281f07ae10c0ea842532af3fc51691b1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573539, "uuid": "1f0d6123-b7bf-40f8-8fe4-f87fb354758b", "comment": "Malware payload", "value": "f0c8fdec79e7924c24d15ec5a00be5e86471d1d6e1f9ad7aaffffe6ae066adcc3e2531085a226ce498f16fe871a6f61c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573539, "uuid": "253ee955-9d87-47b8-a624-ed131fca889a", "value": "T1ABE6330C66E063EED9765039DEF29999C8B4747503B1CACB27A4C7A9BD237E0483D253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573539, "uuid": "45639fcf-ec7e-411e-85f5-580a971b0251", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573539, "uuid": "8f99054b-b739-4095-ab83-51543c47926f", "value": "393216:t0poq6jWSc171acgISSDEuH93ggKZmXMCHWUjXZcuI3/PGTAI:t0hmcrYGzKUXMb8XuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784573539, "uuid": "b680d42d-9778-4790-8f86-41ced4f3cfe9", "value": 14291988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784573539, "uuid": "4d903d19-76d3-4bad-9c29-a018c8ee80d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573539, "uuid": "34b830aa-f397-44ed-ae4a-1c61804bd550", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f86d464-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784525081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525081, "uuid": "00920776-a29a-428f-b595-75faea1dca1d", "comment": "Malware payload (Mirai)", "value": "81b93993df82135d034f0c6245a801f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525081, "uuid": "4b84897f-6eb2-429e-baf7-61746ffba8cd", "comment": "Malware payload (Mirai)", "value": "ab134dc167d314067d176519369af20f3c3e2524dbb79a8958166a2cb787a672", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525081, "uuid": "e5b6978b-9447-4c5f-ac0c-1bf7bbb62c34", "comment": "Malware payload (Mirai)", "value": "89bbb37773e9a319f136122833b59649d55794f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525081, "uuid": "3e3ff1a2-62f8-44ee-85aa-a3d6cc64c078", "comment": "Malware payload (Mirai)", "value": "7fc867ca85dedd9788d0c713ca176d24abdbac2dcd013efa13f2a074c756094374feaa51834cdda67ca545da88d3ffe6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525081, "uuid": "a82f609e-65d4-437b-841c-2d8d90355670", "value": "T1F0C3E649A9429F01D4D735FAFB9F425833536FACE3F97101DA20AF6023CA99B0F66512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525081, "uuid": "7d5d1fbc-3787-41eb-b67d-4b0dd18ae180", "value": "3072:Qs7xedQ5Ln5D7UxabCwznRfeWaJ/a0IXjjosblC:QOyqb5DIxabCwzteR/5IzjosblC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525081, "uuid": "ceb9b6ba-20f5-47a2-ad38-6bc98a597a69", "value": 125064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525081, "uuid": "f0fd5fc7-b0e3-4671-bb1a-21a539d56a70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525081, "uuid": "466439fe-3bbf-42bf-8e46-f2212b4b066c", "value": "eclipse.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c21b911-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784533156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533156, "uuid": "ecd4b9d3-e71e-440d-bfe5-c735f4262c0b", "comment": "Malware payload", "value": "3d29e472e3a23c656d2255dc52572ca8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533156, "uuid": "6a0923d4-1f95-4dd7-85fc-46f4c1c2942e", "comment": "Malware payload", "value": "ac02050f714750b9bb82b71c689bb48163a27ec3c53d1d92f24fd886d8ebecb5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533156, "uuid": "f44a6763-54f4-4d3b-8219-ceb22eb4925f", "comment": "Malware payload", "value": "d3d21deb546fbb06d4bbce03c5a5979803d02ff6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533156, "uuid": "5d96560f-b751-476f-8194-3d17fe61a728", "comment": "Malware payload", "value": "022a1ad2b1bc622dbfd721f2c08aaf95665b0406b28adb74f64183e8b552da131883c41347a03a85083b880ae24220e7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533156, "uuid": "9ce2ba47-5817-40ea-9132-52a2786e366b", "value": "T1748509A6C5690B439DF0EE318C9BD4A8DFA0943A4CE319E4746CC5F0DF6259B4892F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533156, "uuid": "5d1bbd44-34ca-40a3-ac21-c2f28f8fd7f0", "value": "768:InvATSYN9/VRgKoIyjdJTEpWhh5m5h56OK7YSM8poMiYCeXX8loNKXHAwaUx7C4o:CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533156, "uuid": "36c0c900-4b6f-4f34-bab9-4ce75f83b383", "value": 1803814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533156, "uuid": "8e1e951e-7563-45d4-9ae9-382a073bf863", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533156, "uuid": "d7502030-5e5a-4f36-b551-f12169155feb", "value": "ZJ41-50038037 - 1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16ca8d6-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509462, "uuid": "3d8ea290-356c-4926-8802-dbf02851f155", "comment": "Malware payload (Mirai)", "value": "8aab58e571a6e145139ddb1f3b6fe4f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509462, "uuid": "908fb2d3-d89f-41c4-9919-bd4ee394098c", "comment": "Malware payload (Mirai)", "value": "acdc1b5cfe4a154fd2c3de022622508a402d2d12927f26e67d5e77c3c92e267b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509462, "uuid": "cbacee81-af1e-48a0-8470-41adf1da5e26", "comment": "Malware payload (Mirai)", "value": "91aef41c0fba8e9af6f20a23e9a04dae159abf72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509462, "uuid": "6291530e-25d6-431d-9eab-21fd732f746c", "comment": "Malware payload (Mirai)", "value": "3bb9c45ea26d988218b63500b899c832280f5653b72e96ed7108e5cf8149ec792a1394165176f3ee7e86369d832e7f44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509462, "uuid": "b8d90c42-11c5-44c4-9643-03c76ca92408", "value": "T191B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509462, "uuid": "a7acf035-df69-48d2-aede-2b28a2ec901d", "value": "3072:bdub7djS5HECh6Qb1ShRhFczcmVRh865xP:bdo7djS5ECJSozcmVRbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509462, "uuid": "914c07c1-409b-487b-ae6f-297a11f63ba3", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509462, "uuid": "cfe2fbc2-18e9-4d41-9d82-40654cc0f7fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509462, "uuid": "05852ae6-6d85-42eb-957b-b8d42f62ff64", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e638a55-8446-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784557292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557292, "uuid": "945e2517-a6fb-4967-87fe-510cce412bbb", "comment": "Malware payload (AgentTesla)", "value": "4fa54218c2ed6c2411fd908e62c796a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557292, "uuid": "ea3c2d86-ae0d-408f-9316-d5c927d974ab", "comment": "Malware payload (AgentTesla)", "value": "acdfb377eb9c6e5856320667956513ee6148b6fc1e484cef804ddaceedd7e57d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557292, "uuid": "ce0c3830-8f82-48ed-95c4-784e35a56a3a", "comment": "Malware payload (AgentTesla)", "value": "3e599617176d88335dd5c763a0a6f210e9b06c92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557292, "uuid": "51805e14-433b-4961-bee2-d2b143b37c80", "comment": "Malware payload (AgentTesla)", "value": "278a2ed9f3d40cf835230e1725ae5669041f18c92862b37de82bb2abf317e78090662c32f0a38e1e2c1d645b6c7fa6e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784557292, "uuid": "3f4afa11-1d8b-452e-8854-b0e055cdb983", "value": "T1F8063A00A75CA472552FD72CF636EEAC951E204321C9CF5C306D9A34B66EE47A38D6E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784557292, "uuid": "0c53da51-7283-48bc-a531-1568c2e6eb42", "value": "98304:R6zc7pYmae+aOs9Ph6KbdASANRcj18j2TMWzqV2g1Lwb6xyIWr/x0GJd:ROcSzIP6Kxhs1Lw+TC/xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784557292, "uuid": "e62d2b21-391c-4eb1-9dae-d2ca5f8942f7", "value": 3714037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784557292, "uuid": "99c96947-ac33-475b-a2d6-82f85c0c4cb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784557292, "uuid": "3053a727-3ffd-4b8c-9ec4-5d18a645f20a", "value": "Project.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de924a0f-8427-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784544219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544219, "uuid": "76130d3d-a049-4379-ba00-d21b40c76b41", "comment": "Malware payload", "value": "71ba598a84b31ddcf8d1d6a17b9f9ead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544219, "uuid": "d19acc7e-8fd9-4c1b-838d-2884e44ad470", "comment": "Malware payload", "value": "ae8e7ad14dec25f2ba87cae1510fbba1b46de9d24e967ad92eacc5217301e9c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544219, "uuid": "829d83e9-5069-4f85-8424-70f190108289", "comment": "Malware payload", "value": "d022f6fc21d37f2f7aa1a47496bdc6a2ac8f7e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544219, "uuid": "438f1bbe-b22c-40a0-8a59-d2061b8099f3", "comment": "Malware payload", "value": "6ebe9b5a571d1d8a10264af342df1b39fd9b17068df31135f3aedb833f802c47971097923a9c8c01657665a10a513290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544219, "uuid": "a36d3db0-6aa3-476e-92da-0b80200265bd", "value": "T159F58D07BCA408E9C0AE9371C9B655963B75BC480B3267EB2B50B6783FB2BD05D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544219, "uuid": "9830043c-6697-41f7-b209-bbdc0157312d", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544219, "uuid": "7a0b5a0a-ecf4-4147-9135-96418c94ae37", "value": "49152:/8rfBrvf3l2BiNmWlBJ7bIyYzwCBemWY0HvmGCp6DXBTl:/8FrH17UwPY0HvmGZXBTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784544219, "uuid": "0474f695-0f41-459b-8abe-dd35081fd341", "value": 3522560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784544219, "uuid": "d52a15ba-928e-4c2f-b512-e912a607ed51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544219, "uuid": "271dbe28-dabf-4efd-8581-c606d8823cb7", "value": "005755_ORD_FOR_2026-ORD.F-0001761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43474cd3-8400-11f1-be1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784527208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784527208, "uuid": "e475b745-7185-4dfb-89e6-5aca9b79319e", "comment": "Malware payload (njrat)", "value": "ef7181deee2612dce70f66e0a9cdfbcc", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784527208, "uuid": "52c0941a-7b7f-4ccc-a14c-6746b2c07451", "comment": "Malware payload (njrat)", "value": "aed09e9db41ae8457b5993584409582e6cb6472e4e1d68f92f919a47f553b8da", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784527208, "uuid": "d0a47701-7091-485d-bd43-0bed22c45e2d", "comment": "Malware payload (njrat)", "value": "f3c54f422254584bf28f96fa8bdb621bfa7b81d0", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784527208, "uuid": "898edde1-4d91-44c1-8d65-089631a743d8", "comment": "Malware payload (njrat)", "value": "0456672f0540673dc3a4eface8dffed906680b95a0562678c486d4741aa579be18b1deaa8ff262f7bc67f9c98bbefdd0", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784527208, "uuid": "af302303-2c07-4a8f-8b9d-d387f3e54f62", "value": "T1AD253335EB2C1F61A3830F64DC43151CEAB34F5FC1DE65A19C2E325D336486A62AA78D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784527208, "uuid": "bfefb7e6-2d87-4f57-b97f-aee577d37cf0", "value": "384:PA6j7Dk7Do73K7t737i7Y787g7p7S7J7d767SD7Ej7YDGAgImy:4aKyDJmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784527208, "uuid": "075f83c8-32db-4fe0-a84c-73afe99558c4", "value": 1047327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784527208, "uuid": "9c60a412-2a26-4e78-8036-1c816faaa10a", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784527208, "uuid": "8c8f8247-3f8e-44fe-91e0-fc21cd3f97a8", "value": "z1OutstandingPO06_07_2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71e8367-83db-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784511485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511485, "uuid": "db39e5df-467e-4ee7-bb52-667678c6dc16", "comment": "Malware payload (Mirai)", "value": "38861af6991c63ace92a35f1a3410992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511485, "uuid": "42a87164-8cfe-4743-8e5a-807681909191", "comment": "Malware payload (Mirai)", "value": "aee705055f820ed7147ce7ecd39f293ee56e71a2118d5bd0ca21584bfb89124f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511485, "uuid": "3c03d9a9-0dec-4acc-bdc6-2010c49320e3", "comment": "Malware payload (Mirai)", "value": "15ba530e5450f147f7944ceb1249767bdd99fcf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511485, "uuid": "44aa877c-4093-40a8-a77c-596b9fe0cc33", "comment": "Malware payload (Mirai)", "value": "eaae42059b7e0b1d45b812c4abd66d07f49ebd0947e7379698bfe6b46d70ade4fe2c14b7a6a67416745cff4d81a0de41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511485, "uuid": "24e35950-02a5-4a4d-ad5d-7c6a182d418b", "value": "T14F4302FE9AEA6FF4D83D97367216C3E455A23EC8900606DF45E427368D32506FD28E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511485, "uuid": "59ebaa81-1646-467f-abd1-b932613eff1f", "value": "1536:28GcXsuzYlMP6ck1ndijK/kaHcK3hkKe7s9pY:3BsuzYmSckMsN8ohkKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784511485, "uuid": "64061c2a-45d9-4c39-9798-d8257b72361e", "value": 60204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784511485, "uuid": "7e35a62a-9fd6-4b54-b382-c78f8d4840f9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511485, "uuid": "51e24a49-902a-4fae-9c54-c582626fed46", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91dfb414-8472-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1784576303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576303, "uuid": "92c8b907-52fa-4f21-9870-16bd8eed453b", "comment": "Malware payload (Gh0stRAT)", "value": "76ddd649d116b9b9df218d063580024c", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576303, "uuid": "fdd6c152-574e-46b9-be82-b7c1e86aa81c", "comment": "Malware payload (Gh0stRAT)", "value": "af9a6dacb2a9618866cf398d615b2fe1c1c98ec7254d38a01c7c2d6869821bbe", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576303, "uuid": "45490029-f5cf-4d05-bbdf-a3d72107fdc0", "comment": "Malware payload (Gh0stRAT)", "value": "eb2c53d339d0c893383ed9ac3a33462c6995def5", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576303, "uuid": "3be01491-e475-45c7-b31b-de1cd2f243f6", "comment": "Malware payload (Gh0stRAT)", "value": "ab9d6b92ee0707a3851b6600497e1c56fb2d0f88ccb1710f63e5a4c14cbd1e8fe9dd59bf45ce99be5a0017cb13e6553a", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576303, "uuid": "890786f3-5c98-4bad-83c2-c23fcba90a75", "value": "T15A27336CF4C998F3F816800CBE0899D763C43C2797B952C2A78BD9D9DF9EB259200395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576303, "uuid": "acd7483a-d3d9-4f82-83b4-c2140779049f", "value": "393216:F5leE1/UVJ1iIx9Vh6WTON7qFO+X7rVLjmOfKdW/6NBo6aYyC/osW:zl/UJ19mN7PS3m2KNOZ5Cg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784576303, "uuid": "dcba9847-0fc7-4792-b869-a2cfb3a76f08", "value": 20694154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784576303, "uuid": "86a57123-bba1-4474-8c49-0700791bb072", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576303, "uuid": "a373c7e6-fee5-4f3e-81bb-dc1556e105ed", "value": "moshou-xinshouhezi.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf73962-8456-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784564161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564161, "uuid": "fa10662f-0780-45ca-b8eb-0ed01975eb60", "comment": "Malware payload", "value": "77526447f9a15358ff5d991bed9a6359", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564161, "uuid": "176e1990-c92f-4374-852c-c3d934264152", "comment": "Malware payload", "value": "b30b4b58eb215b60a8526c506d689ffab91ed43124709bc20b4085edf9d5361b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564161, "uuid": "a99e7250-86d8-4d14-a595-41dbadb7f045", "comment": "Malware payload", "value": "03f524001f52f4e6b9bdd0a067ccdf1ba7074af0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564161, "uuid": "25ce6cc7-3633-48db-af25-24f42878c734", "comment": "Malware payload", "value": "5c362ee97b7918c95b74eb46dd746e853ef491f6a384cfccb2637cf911bfa9a1cc94cd9d77c7b97e486f808ff342a9a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564161, "uuid": "ed00b3dd-d450-4793-a95f-76c039947734", "value": "T1FFF42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564161, "uuid": "5498052c-1fd6-418d-b0ab-b66f699e09f7", "value": "12288:WU7wAcpxXAIIETE1UWLwJrr1nuwy1PUcyvmByHaRR1L+:WU7RyAOTt9vPaRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784564161, "uuid": "eb537046-0940-47b6-b0ba-59a99599d8cd", "value": 750400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784564161, "uuid": "335743fb-d6f7-4896-aa07-e201860f8bc7", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564161, "uuid": "c4fd1620-c20a-4fb3-aef5-6d04ce3a2da3", "value": "Vozeyuy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7976f325-83d8-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784510119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510119, "uuid": "dbfe77f7-d8e4-43f8-8e64-9a61391b37f2", "comment": "Malware payload", "value": "c5bc18792e65d0c36225a181dcc1c2b3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510119, "uuid": "e5a5a2c5-a519-4faf-b652-470b0deafc91", "comment": "Malware payload", "value": "b32f71c40fffc53327ca712d82ad9349d2a4f396826fac9940824f48c878461f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510119, "uuid": "f06ac101-386b-4c62-833f-e128506cded8", "comment": "Malware payload", "value": "b1228f2389a84f1b08100b510af2f73641383c80", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510119, "uuid": "1be6533a-7091-47b5-987f-f8b15f4173f1", "comment": "Malware payload", "value": "18baca9315b864b52a3bd18bb1b4fa640d056aeaa481843abb256c1942c3b2df90b3593787afa8af485a811ab906abe1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510119, "uuid": "5a3c2826-fc21-4fb5-b97e-bb2fdde54a55", "value": "T15CC27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510119, "uuid": "30994314-4f03-4cb8-b7d7-b67cafd9f8e8", "value": "768:V18vCB+25j6es8RH9FYpMSUpi+20qUpi+20YQX:V18l25Jhd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784510119, "uuid": "19b0c223-73b6-4cc9-b8a7-35fb950e6f56", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784510119, "uuid": "827a75a7-fd8c-488e-a1c4-5a4d2621cd69", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510119, "uuid": "18780077-ab34-4c7c-977b-1ff1a4413143", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60aa6a82-8412-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784534989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534989, "uuid": "5ed65c9f-ac0f-4021-8348-adce4bdae50f", "comment": "Malware payload", "value": "c27c1adb34907210f68a69483b2a7b7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534989, "uuid": "e9fe0d79-9d7b-4b89-97ba-eccf329428c3", "comment": "Malware payload", "value": "b33314b1f39bccb57eef08a32f7d7c9d2562fd047729aaf184fbd2b0bd3f9927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534989, "uuid": "5fe60656-a611-42f3-8abf-cec54e58289a", "comment": "Malware payload", "value": "8a951cb40eec61b17917de75d8169f20d22d3171", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534989, "uuid": "4a0cde63-5727-41a4-99ea-7f389bc6d358", "comment": "Malware payload", "value": "eeccff65d2d2030462bb424adaaa0d30f13fc85effbbcc3daea5ae187898bf2b00f6b1452af6f3534176dfc31db05d11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534989, "uuid": "5dce794e-217e-491c-babc-7d7c4fce202a", "value": "T1F194B391A4109ADBCE1048BA7B2C4F7463823CB1D35B0F7D5956851DA28F8CBF5CABE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534989, "uuid": "3ab71d65-7025-4199-bfa2-f098bb7ca609", "value": "6144:KTOq5IxShrEmq8Bqd4AaQwu0JodQVQzKb8LXPhXwG:K6qIxMrEmq8IVaWdGQ+b8jhXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534989, "uuid": "a8ff90af-c8f4-4ff2-8bc9-418db4065d96", "value": 432980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534989, "uuid": "1aed521e-5ae8-4925-baae-fa18d56ae135", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534989, "uuid": "d6770acf-a493-48c4-881e-aee7b456ac32", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f117d19a-83db-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784511609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511609, "uuid": "0f0635bd-073d-45c1-8832-b8443a723fe2", "comment": "Malware payload (Mirai)", "value": "d970c128513e30d30a1e170b0c27545b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511609, "uuid": "519f87e9-fe03-4022-8bd5-983355b24473", "comment": "Malware payload (Mirai)", "value": "b3512d6dd71746655648180b30a3812939c7adbcbb2958b3abf6ae004f691156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511609, "uuid": "b5748c38-9e67-4182-a69c-9df34f4bb086", "comment": "Malware payload (Mirai)", "value": "c9525be80db4174aa5b7743c80e7f5c0c6d4c303", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511609, "uuid": "ba5e4781-2fc5-4c09-8ac9-8c550fafd132", "comment": "Malware payload (Mirai)", "value": "f71c664959b85e6d194db5bb2a30de1eb4d322e5ef80b6d3b8eb8be996a31fff5a27906cd432450fd8f4866fe56e2023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511609, "uuid": "3c27def0-f09b-4a57-bfd6-3ca15694a020", "value": "T1FD749D53BBC28FA6F232A5B049F3C1B9A9DA3A4707B7C457C3795B16125C2D07809EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511609, "uuid": "83fefa55-bdac-4f55-b533-2b0b052197f6", "value": "6144:ASeYpUPrvUfFHmghX9t0plAY90EBQ6QlUI+63c9FN4S8q0wMeX:ASeYpgvUdmetteAYKEB+Q63c9FWS8q0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784511609, "uuid": "d5f4694d-49dc-447b-8867-93060daf1da1", "value": 351928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784511609, "uuid": "44a5fb0a-cc27-4958-a408-066ff7270c4f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511609, "uuid": "3bfe3097-ec41-4bfc-9f58-53aebe42f8c7", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3893186a-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784531056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531056, "uuid": "da2cb0cb-e605-4ae4-87a7-2025a2d6634a", "comment": "Malware payload", "value": "f2d78dcbb989020d3be5c400f4f7b3a6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531056, "uuid": "ab549834-7be7-4dc8-b002-054b1429de28", "comment": "Malware payload", "value": "b353170a04c1bcab9e0e30616a5918cafbe8da37bdf5de142c680254785e5344", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531056, "uuid": "79a022cc-d399-4d81-9b47-24d15e693521", "comment": "Malware payload", "value": "75270f361ed53754925fef7eee3bb0e78bd9ba4e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531056, "uuid": "0d8a2100-8df0-4593-95f1-7269519a08d4", "comment": "Malware payload", "value": "a773a2813d3f45b1145b27f26562960aec738c05a883f24b55ab43ce794c42c3bf1583c86e300a2e27329388c3e7284e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531056, "uuid": "a96ba426-d1fc-4b53-a2be-9c6ff6567c4a", "value": "T17CC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531056, "uuid": "7ec70118-abee-44a8-979c-8914ff4297b0", "value": "768:o/N8vCB+25j6es8RZ9FYpMSUpi+20qUpi+20YQX:o18l25J/d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531056, "uuid": "e9265445-2425-4537-b091-ffcbf7c37886", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531056, "uuid": "9839e29d-e55e-4d43-be55-55658f04c48c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531056, "uuid": "00ca6256-04f7-4257-89a1-f66c4ad800fc", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e586af-8458-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784565037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784565037, "uuid": "dd463a63-db80-4f0a-939b-48edff884018", "comment": "Malware payload (Formbook)", "value": "9e9b4bc61cebb52620b08b6c13ceee32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784565037, "uuid": "2b759956-56a5-4ccb-b940-c0bec616131d", "comment": "Malware payload (Formbook)", "value": "b393bd767c142e171dd1b2928bae16fff2f63b3d319b2c1acb37129d8d538cc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784565037, "uuid": "87aeb8ef-6a37-476a-8e72-d6b688c92c8e", "comment": "Malware payload (Formbook)", "value": "4fae97e7a419a298bf6b9b0651f3cec84898d2c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784565037, "uuid": "665d360c-8dd7-459f-b15e-2761a357b06d", "comment": "Malware payload (Formbook)", "value": "ae862bee8f5873682df491ce304f3dae49353875d71f2cf97adfd30158ea4e18927648a54c04631a5aea75e19fedad2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784565037, "uuid": "2243ee69-60b2-428a-bfa8-483f3e4c0415", "value": "T19C2522A46BE98F06C2FA07F04826D23597B57E1CA062D706CFEAECD734657C056943A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784565037, "uuid": "ac3f2139-51d7-4a9f-addf-ca870bbe5bd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784565037, "uuid": "de5f7546-7f1e-42e5-ba15-b32d3905f603", "value": "24576:tO+LXj/Og3zNx0p/2BouN+OhgNjseUaftqO94iF5P1G5nEj2MPC:tO+LzPxxY/2B0aallqZO5PS+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784565037, "uuid": "944c71a2-98c1-4c58-8655-9e365c6b9a88", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784565037, "uuid": "9baa46c4-6aa4-4030-9b18-7edfb6e6406b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784565037, "uuid": "22fa1b4f-e1cf-45a8-8ccf-925d70ce278c", "value": "rconfirma____odepagamento_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77007d0-8449-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784558837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558837, "uuid": "d46a01ad-8681-4604-a9e8-c5380e690d41", "comment": "Malware payload (Mirai)", "value": "e588ae48a1f1593d22f68b4de272d279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558837, "uuid": "5ebcd1eb-afe4-43a1-9643-225ffbd50172", "comment": "Malware payload (Mirai)", "value": "b3fe0576f4e8a73f15d6cb8c0a614dd4340aea525605e2841311a2cb764eb6dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558837, "uuid": "87e07eb1-762e-48c3-97bb-adb8efce3029", "comment": "Malware payload (Mirai)", "value": "5683cc3a6cde32a220bd2f1f04bbb729048a0128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558837, "uuid": "bb2c64de-19d7-4914-afba-572b7340c731", "comment": "Malware payload (Mirai)", "value": "b5f0ccbfb3c8d4e3ce461bf1594085269dfb724e2eb7be3eabe23b92b9daee05577c47d0e1472ce552b90d713d3e191e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558837, "uuid": "b7994283-7a35-47d2-882d-5ac744811c83", "value": "T1E753F19F88843CC9CBBD1F356A2D3A13E844649D74677AC57338CD89FB5122B21A94EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558837, "uuid": "118641cf-ce93-4c83-b725-ee1ea9fccee6", "value": "1536:0ORkFH+GCKim7iRqTgFIXnJkFLGK5TfNrayauqNd:TkFeGRZqqTgFIXJkdGK5TlGyauKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784558837, "uuid": "45696dc3-75e6-4b8a-9a3c-3ffeba40cd5c", "value": 65428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784558837, "uuid": "7ec24cf3-6437-49e2-a364-c7712a904d12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558837, "uuid": "70e7f1c9-85d8-489a-b0bb-44e4c4c10f36", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59e8ae6-841e-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1784540392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540392, "uuid": "0a13d2e3-7c26-44ad-9cd3-51e0c33d1f9e", "comment": "Malware payload (SnakeKeylogger)", "value": "4be889e143b460ccf80fc02e44840ee0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540392, "uuid": "cf866153-192b-4e05-bf67-b5d3f6dc8a27", "comment": "Malware payload (SnakeKeylogger)", "value": "b4991986b29c3882404e7078ccd37954f9f9676bb766f83161199eee1f1b85d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540392, "uuid": "add84be9-9b2c-4d34-a132-a0faf13d76bf", "comment": "Malware payload (SnakeKeylogger)", "value": "f2cf888fb2133a89254455c4f50df81db384912a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540392, "uuid": "7b8aaef7-4c07-418d-aeba-1e1acf07fad8", "comment": "Malware payload (SnakeKeylogger)", "value": "ddfb0d796c88bd3c527cf48efa1ad1515c19a298b46d13c312af5b7cbfe8280e0524c2d60187309a2057d5bb56513109", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540392, "uuid": "defa271b-2d19-46ab-8017-3d3faa64edda", "value": "T13CE312336648C7BFCDF9877866BE8A1411B483506C41EB0867EC536F9F5B30B2985E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540392, "uuid": "77f545e2-747b-43a8-a8ff-f28feb391794", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540392, "uuid": "d77aba26-cd02-4274-81cc-32ac3c306969", "value": "3072:tB7zCbljY9xb9gQhDx+IMdDuR7D3uI9RKPqw9R+w7q4i34SNvEpn/U:/7uxMPgPI6D4DT9kov34SNcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784540392, "uuid": "3f869ae7-f460-4547-be9c-cbf04afa71d5", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784540392, "uuid": "56522d3b-7da2-4f20-a35c-2f213bb0a896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540392, "uuid": "a60174ad-8b94-4d4f-abde-7bb7cb37bb32", "value": "ASKH09876567890.Bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a75ce1-8485-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784584327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784584327, "uuid": "fb0686c0-d4a7-48ae-bb11-2f2c264d8458", "comment": "Malware payload (RemusStealer)", "value": "f7ee082acfd43a938bb8aa0a5f65e610", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784584327, "uuid": "626d0a40-e321-4c81-8bd9-7b4a7d0ac47b", "comment": "Malware payload (RemusStealer)", "value": "b66775e5a6169599519e5b3e035bea6ca2824e14ad59662b9d43d356ba6b3c4d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784584327, "uuid": "7bafdf66-dcd8-4443-8337-41e616dc8bc1", "comment": "Malware payload (RemusStealer)", "value": "317683b99cef6340234e0e65c3be9b1a96ac020a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784584327, "uuid": "0161182e-c68a-402a-ae1d-e771d39f0d23", "comment": "Malware payload (RemusStealer)", "value": "c325142949ff2c820a7897c4d4aff6ccc0ce355a71808f36b5c984a6b26ed1d71996d61fe3a4afd1cd787ebd2ad6dc68", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784584327, "uuid": "460a3de9-46c6-4e12-8293-1d3f4dd4a4db", "value": "T18F75192C27F969A8F1B77F358AF56145DB3BBB72A93BD64E0600420F1532A018D52F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784584327, "uuid": "380b8019-5267-474b-ba40-ff086975a3a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784584327, "uuid": "9e0fa65a-ad41-49f3-9139-76da64976c7f", "value": "24576:PKCKoguYjLBgWT1Jy+RZfjEERR/4OhUrDNQDT/eNKS8gw3gWYvmMBjq:sSWDy+RZfLfhWDNoT/eNKBgQpYuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784584327, "uuid": "75e964f4-f986-4988-8bb4-671737503fda", "value": 1690112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784584327, "uuid": "001a3d08-27cc-4a53-ae18-3f3c5aad89e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784584327, "uuid": "b573e2a9-c2c2-4969-8bbd-3036257a76e1", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bff2628-8479-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784579326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579326, "uuid": "9ee8a740-55e6-4b19-a092-4ba124022fa2", "comment": "Malware payload (Mirai)", "value": "1dd79bd1a6db847df30fd656f2b06dab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579326, "uuid": "57ca412d-b49b-481b-a4ec-14d8c98d9114", "comment": "Malware payload (Mirai)", "value": "b6819af7882a880ab0119b79fa068177570e53cf205653e4091bdfafc7ccf8b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579326, "uuid": "2e591b7e-3b11-4898-8ecc-82a71176afdc", "comment": "Malware payload (Mirai)", "value": "a739d9c7bae3078623945a2861d9100accb0ef1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784579326, "uuid": "82e3b92d-3e21-414a-a13e-1f977cc31481", "comment": "Malware payload (Mirai)", "value": "3c852a6088cc1dcccad6e46567ff973fbbf5814f51e90115448a70ed5132531e2e4b9a5e4fbe12e9c57d2c41473c1884", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579326, "uuid": "8b9efde5-31eb-4c8a-bc11-4660e16c187b", "value": "T122C37DC5B50D7EAEE4D32D7CC20A17176E1C9E519C83410190B5FE031ABB6E72E26AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579326, "uuid": "68fe8641-43ba-42e6-9599-eadbaa20a28d", "value": "3072:129lr4s2FCP0ISEHZ6USxMPWFRSRvtWRhSQLLjyoWBp:129QFs0INxSmPuEvtWfSQXvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784579326, "uuid": "a6931465-f24d-4cac-82a3-4e78cf0d7f86", "value": 125304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784579326, "uuid": "5ff8ab6a-4b00-4215-b894-6bd058e673d1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784579326, "uuid": "341e965e-dcb9-46ba-95b8-f8ca73e47adf", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8aa7f6c-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784530519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530519, "uuid": "d377f111-3e66-4da0-a00c-3fc18c977337", "comment": "Malware payload (AgentTesla)", "value": "a6e8879bf987c597a14a7d7c70f23701", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530519, "uuid": "ab9da8d1-0db0-49f7-8a4b-2c900c0ff778", "comment": "Malware payload (AgentTesla)", "value": "b8c0e5e4eac6e734497c9f86f98bff8bc763d89d6fbbc164f7328618fc78c98c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530519, "uuid": "172f5812-098b-45fb-9324-af58fb424cb6", "comment": "Malware payload (AgentTesla)", "value": "fb589d7a4a82d7da218675baba91d400af4e7f62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530519, "uuid": "3a748bf5-390e-4ffc-bcc5-3f5cbe0b2ec6", "comment": "Malware payload (AgentTesla)", "value": "a2bc2a08dce0282d23812bc574eb66742c6cf1edcb06656f6b42be48d9efab86e747a0f01abad0e24ecd071c1f4819f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530519, "uuid": "18ed5b1c-87bf-4405-af4d-1fd4770dde9f", "value": "T1F7F5D610677460333721E39C613ADE79980E78C364E9DF18345ED628B59CE8BA359BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530519, "uuid": "80498a63-25f5-49f4-8e98-20a421251044", "value": "98304:IYbMQVGrI2PYjanEtX3F71XXGTCIbjuWOjF9z3fBZ6V9:PMQu5nE5axfO5N3fBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530519, "uuid": "3ae34f49-5c3a-410a-85f5-e1c109a5408b", "value": 3592963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530519, "uuid": "1606366c-af95-4c12-a1bd-92e569a7de02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530519, "uuid": "b6a1266d-be9b-448d-88e4-917f2b220e90", "value": "ALBARAN AV 2609943 DE CLOSES 07212026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2dc6ea-842c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1784546314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546314, "uuid": "98b1b6a0-3f85-4f4c-a8b5-502ea0688e7c", "comment": "Malware payload (Phorpiex)", "value": "7560059e7467261dab3d3bccff100483", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546314, "uuid": "6131eb4d-c82e-429a-b1b3-67f14b0f0d5c", "comment": "Malware payload (Phorpiex)", "value": "b95fc6974e1520909056676dc64f68b2c8073b63818d91e47b13c0e1a013bc5b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546314, "uuid": "147a9703-e651-415e-adbd-c0735dde017b", "comment": "Malware payload (Phorpiex)", "value": "4c0a2361e307c9f1d1e25ad61b36d6279c1a5e41", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784546314, "uuid": "d0271d87-792a-4f1b-aa18-dbb9e47d4a83", "comment": "Malware payload (Phorpiex)", "value": "0c9945707c227a024a7442dcf6d700b191df7fc12f4f3e56b2b8931c31c2995a44c463d6e5229e1077bdc77f425db39e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546314, "uuid": "9347aed0-3d0b-43df-832b-cbe7cf0a15b5", "value": "T1C5825B0FB9424726C0E100B49676877BDA78687233C854DBF7948AED0A686D2FC3365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546314, "uuid": "5969ed99-4602-4aed-905c-1ee1fc7d2d0a", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546314, "uuid": "770f5447-7da0-4493-9a04-f8085bb5c46a", "value": "384:ryIqQlV6lOh40uu9JgFtfUqXav8U9cIF:0x0D9kXa0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784546314, "uuid": "d90733cf-7f28-4aa6-b192-7c177546c257", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784546314, "uuid": "7d97ee08-eafe-446f-986b-34e10226164f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784546314, "uuid": "e500842f-1e9b-4052-a842-c37337f567c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc21ab07-8469-11f1-bd95-42010a9c0009", "comment": "Malware payload (Pony)", "timestamp": 1784572535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784572535, "uuid": "081e3f15-ec18-479d-b685-647591118f45", "comment": "Malware payload (Pony)", "value": "23bfaff7aff7af5807bac2244b7219e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784572535, "uuid": "26041f55-9772-419d-b27e-2a4437486447", "comment": "Malware payload (Pony)", "value": "b9622cc44be9b2902beb1c399bcb15b6ee711d6d72ca1a9e82e96e957c231fe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784572535, "uuid": "bc827c52-a7ec-4f4d-a5db-fdbf44900f07", "comment": "Malware payload (Pony)", "value": "e9a2dc6b6d60ea448e7b570bd2893f6efc0523fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784572535, "uuid": "84a32a1d-bea2-4d04-85ea-933bc753bbbc", "comment": "Malware payload (Pony)", "value": "ecea18df0dbaef9ecda25471982df9d3ca96c11ce57a3e330b6eb6c7e1a543116b9ca22d3cdc0725f560dfab6715be4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784572535, "uuid": "9d30d308-5185-46e4-b827-58764d2b4f00", "value": "T1BA54ECC62A72DE2FF84C70F1D028B8629E1CBEA50DA7F6439CF6759D0479A124B541E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784572535, "uuid": "88bd6670-6f37-42ba-9d62-8b7df4e7f4b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784572535, "uuid": "18a981dc-7f04-4109-9f62-6b6ccae969ea", "value": "3072:w9hnBRU+3Aclfnphf/9fZkBY8hk4KFNLtbYfuTJOH:wzBu+Qclrf/9fmBY8hkbFNLtkml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784572535, "uuid": "d4cc550d-bf64-4f73-b4bd-c6139c75e01a", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784572535, "uuid": "c8ebaf4f-9163-4f0a-9a25-6e36e330c637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784572535, "uuid": "6392b008-f892-4f98-9171-2cc8e2e4aad2", "value": "23bfaff7aff7af5807bac2244b7219e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30008aca-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574850, "uuid": "39b45af3-24b9-46b6-9aa6-c268f94b5a9b", "comment": "Malware payload (Mirai)", "value": "add54bd78384715bb05daf9a3d7d7c13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574850, "uuid": "735d2f3e-67be-4020-8e0b-6d37849c2b81", "comment": "Malware payload (Mirai)", "value": "b96fe3c442ff0efc544510eb8c724be73a2eb7f0c21f21b6ba68e678778d129d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574850, "uuid": "987e9c9b-36ed-4a94-a154-6487c53b314b", "comment": "Malware payload (Mirai)", "value": "67aef862e9b89d8c10981adc1c5fdb1f11ccb11a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574850, "uuid": "8b172763-4fc5-4179-8f28-ee78f7e7430c", "comment": "Malware payload (Mirai)", "value": "ce6c78cc82d2edf1f273308338cd7009a400d3ba44041e6be5d47d8eaa88db86243dba7c9e971b4c1118de82bed420dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574850, "uuid": "0c60474f-9a8a-4027-8814-6f16635744d0", "value": "T1BAC329A9F890DE52C6D526B6FB4E418C33231778C3DE7106CE149E3467FB95A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574850, "uuid": "b8beca6b-f2f7-4b04-9394-cbff5a10d05d", "value": "3072:QuIBvPRfsNDUxMa3tIDrcYEEUIAyMW0NwhBigpmqzWNiF+WOud5mf1Dl:QJ5GytercYEEUIAyMWGwiOmqzpJ7m95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574850, "uuid": "846cc5ac-e182-4baf-a5f6-208d32956678", "value": 128444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574850, "uuid": "527c1b57-3826-49d4-90ff-a952da7f1283", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574850, "uuid": "418395a0-3e53-42aa-8253-2e07f39de615", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dba428-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784531139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531139, "uuid": "eeee9c71-d0d2-402b-be75-7f93afcf26c3", "comment": "Malware payload", "value": "9a4f6ad01cf883a727e9c2bf70fc89a6", "object_relation": "md5", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531139, "uuid": "d51b877f-2cdc-42e1-9175-129b820202e1", "comment": "Malware payload", "value": "ba2bb3d3fb5dcfd2ba17e93e86bae3a16fdf373d967d26c537753666abe02aa0", "object_relation": "sha256", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531139, "uuid": "b15cc3d1-722a-47a1-858f-426590e87670", "comment": "Malware payload", "value": "ba702b9115f94d7d1cfb37f0a43124bdda7afa9b", "object_relation": "sha1", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531139, "uuid": "4057b72f-4e55-4241-a6b1-20e56f6250a8", "comment": "Malware payload", "value": "91f3c011c4d73110aa5823d8f705cc981a863f24729e71fd8ce29c9ec857dde62a917b210cc8e25cc816af9af7e44afe", "object_relation": "sha3-384", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531139, "uuid": "9847d7ba-b30b-4a79-8c98-f3e0195f4287", "value": "T1582633E2C62D382EDBD376F1C43720DEBB7256F41461A3969A848E7701F6CE99502F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531139, "uuid": "dc76103c-9fdc-4fb4-80d0-6819a1dddcfd", "value": "98304:txHEoU5/HT7JuqvKmAqGkBKV8TsELicfV2D+MPwywXJRb7d:LEou7JuqBA6BKVBELbfVYaXJdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531139, "uuid": "0dd6abcb-1897-4fbd-9521-13612f3934a4", "value": 4793056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531139, "uuid": "974c2952-a627-423c-b375-2dd0e4afda93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531139, "uuid": "2430cd0a-68cd-4b8b-b8a7-78436d3851e5", "value": "5001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475f6232-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574889, "uuid": "3c77133c-04cb-47fa-8100-1951e1bdbf58", "comment": "Malware payload (Mirai)", "value": "f8522ff2241ace66eeef11a56df6425e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574889, "uuid": "98ed44a6-2552-4c6b-a07a-4a7712e0d09d", "comment": "Malware payload (Mirai)", "value": "baf0843bbc852500c72e11c41c0c279a5d94b1b395ebe6403ed4e68473caac20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574889, "uuid": "43a7a7ab-9564-4e60-8751-0df2979a6039", "comment": "Malware payload (Mirai)", "value": "ed1af398ef03009adc9d3db0d642e44c4ee51c16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574889, "uuid": "a0c0fd3b-076e-4957-8727-8c82bb54ef17", "comment": "Malware payload (Mirai)", "value": "769ed96d7996ddad4be928eb80afc3ffa2a8eee81b04c9e30a7f4924e5ce8ad4711508a0706049d715c3f547bd916e89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574889, "uuid": "5a931b2c-826d-4909-8844-2b21675d8402", "value": "T1AF045C49AE342BEBC05FCE30052E930B11DD945FA2F6B77DA678CD4C399A24859F3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574889, "uuid": "0d3c538c-d776-413c-aa75-00f2a09a16a9", "value": "3072:yd8q5aV2iRkzXzW3OdSGozEwhmpiHigjmZYvJ5VSX5fd1DMkc:ydb5aQiRkzXy3ySGozEwhmpiHyZYvJMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574889, "uuid": "3dc051a4-0ce8-4de5-aed5-812f58e91928", "value": 185036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574889, "uuid": "792c3810-c9f2-4206-8fc9-6fdc18868398", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574889, "uuid": "2030b74e-b535-47f3-a1ab-611c2b8ff17c", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd37b31b-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509428, "uuid": "8c32f8d0-fef3-4ee3-92cb-affc246ccc40", "comment": "Malware payload (Mirai)", "value": "bc437b1fff41b1f5813127327a90a37a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509428, "uuid": "2b4d543f-feda-4905-996b-8ea3af31a09c", "comment": "Malware payload (Mirai)", "value": "bbfec9da453e630b7efde190a50687f3833ffe4725069ebecd42ca7cd06750bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509428, "uuid": "22454d5c-4049-4e8f-97a4-456956691c44", "comment": "Malware payload (Mirai)", "value": "fcb7290c084bebe7e770fd888069c86972b22307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509428, "uuid": "b274bbeb-bf9b-4a12-be98-1f4a7525bb22", "comment": "Malware payload (Mirai)", "value": "0f80058145d66bfe74fedbdf3b5de613c99e005bf84d933e855e4585c6d7e869e05f2f968e87759ba0743057b7cabbcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509428, "uuid": "e862a934-5bb0-496c-b73f-375284993309", "value": "T1E1736CC4FA83D4F6EC130A350136BB379AB3E13E2169DB83D3A9A525DC125C2DA1635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509428, "uuid": "bb7e8800-d8d0-4f71-b8b6-6b64dd2b5a70", "value": "1536:IbMP6X3uwvlzydgREdwHE2N5Xekch3K68cSwv:IbMC3ZludgR0wDN4kM39v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509428, "uuid": "d1073105-a5bb-43ed-96e7-7184f2bd143f", "value": 79412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509428, "uuid": "2fed6045-8119-45ae-8715-b5c52d062990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509428, "uuid": "7b6da5c1-0ca5-49ce-a524-a805640cf823", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e60b544-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784531092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531092, "uuid": "9a02a5e8-d987-4a77-8ad9-ceb3e308e521", "comment": "Malware payload (AgentTesla)", "value": "780da56f1928d333432bb7b3d3d6c5af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531092, "uuid": "372ee3e5-99c3-4787-8946-4c366751dbee", "comment": "Malware payload (AgentTesla)", "value": "bc9d0020f0f565af096ec50d3fc68bcb0d1d46ff20a278d878f7cc16efca78fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531092, "uuid": "056bb176-3f1f-4f61-9279-ea024dcfb170", "comment": "Malware payload (AgentTesla)", "value": "c4dc7af611d1bbf9904063adbed2c82b97acb4b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531092, "uuid": "cb0565b4-83ff-42e0-93ef-edb0217fb5be", "comment": "Malware payload (AgentTesla)", "value": "610b55872f57ac1e3c4eba700ae2489fa1e5f71a3057f20a7690193ba063edac2395ce1591a5a8e2b7a5c77500b48f02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531092, "uuid": "759c56fd-2ead-46f9-b093-97af49b4ad69", "value": "T12BF519019728E5F7562DA32CD075DFE8D74D20072099EF5C74A80A24B2A6E5FA39C6F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531092, "uuid": "a4cf5009-91a4-43a1-92e6-a676736f9604", "value": "98304:DC1Y5nGYTkl5s+E/SCxtD7qyJXjdJKiV9ndzi78AxReamlDKDJ:DwYl1TklKNqCxRqUxJKiV278Zp6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531092, "uuid": "3429481f-7fab-453d-a191-bed86fd3a7ca", "value": 3592963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531092, "uuid": "40898ff6-35ae-4232-a5b8-3530ccd7530a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531092, "uuid": "5710b8db-4b97-48fb-ae05-07c5a8ad611c", "value": "payment comfirmation.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d1013f-848b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784587126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587126, "uuid": "f01b34ff-9466-40a0-8e12-fae116d3fb98", "comment": "Malware payload", "value": "c1972777ad8a8b590091efd3a4dde67b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587126, "uuid": "cbeaf9e2-8db9-4f75-9a3a-52d0297e5f6a", "comment": "Malware payload", "value": "bca78e472cdf94c16fd67cdf2894d7286c17b370007878b988b9a9f9705f99d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587126, "uuid": "99b2ee22-4fea-402c-9d87-31eb2e5597dc", "comment": "Malware payload", "value": "33513fec5b369256cab40980e022ff3368089c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784587126, "uuid": "8eab16a4-48fe-4e74-9173-7a0f119625c9", "comment": "Malware payload", "value": "fb4064d768202c9e7c6d60414bd82200cd0cc8a9a415453aea9571e2f1c900e480c51f0fb3c54747c863ec3f658c894d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587126, "uuid": "788acb09-6390-4e93-a47b-76b0d69451e8", "value": "T1F437338430E1D4BEC11029B953EDD9B3AE35EDE4CB0795FB33C4FD0B61B09986A6125A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587126, "uuid": "d2c5a98e-acad-4c0f-8b07-259e3321c608", "value": "311d1e93d89e02a2908fe4b6d6a25ef7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587126, "uuid": "90114a5c-fc94-4254-8f43-99807c792c7f", "value": "393216:siGrZag/6KiuKk9k9B/yyq03lvGwODuycrJSFuRMYp/27bWPRz9Ftjh1:dGrZl/UBky9B/yy1VLgpop2ihtjh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784587126, "uuid": "96495359-3e04-4ecb-a60b-81b2f7d5a7d7", "value": 22867135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784587126, "uuid": "ba7108a5-808c-4d2a-a384-801879cb4335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784587126, "uuid": "b2a5f8a2-7b74-4810-a7bf-fb47f7534f91", "value": "yuanbao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f11bf53-8472-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784576137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576137, "uuid": "e68b3931-ece1-4a0f-9a6d-5eb7c24c4273", "comment": "Malware payload (Mirai)", "value": "530e7a38fad056db86acc3271c1647af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576137, "uuid": "38ad4a81-c519-4aec-8725-a1768f2679d2", "comment": "Malware payload (Mirai)", "value": "bce3c7ad26433b03c0aeb8d987e9b6b889582fe8ef870949329abfaa175c0e81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576137, "uuid": "740dd8c7-3618-43a2-9f6a-9e74cf4d78fe", "comment": "Malware payload (Mirai)", "value": "9397e678fcd63e9d087a8479e192791e592e41f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576137, "uuid": "1901ead9-80a0-40b7-8e93-968116f193e7", "comment": "Malware payload (Mirai)", "value": "07cc2e5bdae5b43b4e17f3fd96a80815fd0244a892567ccc35e120421237daf291c90fb45496b5de7dad5529c2789972", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576137, "uuid": "28374bb1-1a13-4a5d-a66e-681b3ad92c52", "value": "T19214A65E6E228F7EF76C873047B78A34976923D627E0D684D1ACC2115F2029E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576137, "uuid": "728b1edb-0a5b-4ab4-af7e-fa2b6ee96f90", "value": "3072:+k4b3i76UkkeAnZTnXKOlca2upGfiWUdaaBbY+2f1SoEw:+k4b3q6UkkeAnZ22f8fudtB2NSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784576137, "uuid": "dfa46422-8194-4172-85ad-4022f6324cfb", "value": 203616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784576137, "uuid": "682745f8-80d7-49dc-98e7-ffe23d5ee0d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576137, "uuid": "4619d65a-68f7-4848-b3cb-4957f8d4819b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dfddd3-8418-11f1-be1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784537571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537571, "uuid": "83dc692b-3322-4aac-be87-b552c26fa964", "comment": "Malware payload (Formbook)", "value": "010d62381199e3131b778a19b75d36df", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537571, "uuid": "62832800-e248-421d-bb19-60e866138ff4", "comment": "Malware payload (Formbook)", "value": "bd20fcc313adbb44d82a033fbae527bc2b522b93ed80ba88ec0094644005df81", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537571, "uuid": "19ea0a0a-617b-4545-803e-42e4a59b4d71", "comment": "Malware payload (Formbook)", "value": "84ab41d0563cf7220ee2cef52bc7347c90737763", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537571, "uuid": "06dd21e2-1ef2-4f04-bd7c-6ad05f697726", "comment": "Malware payload (Formbook)", "value": "26fd79cf1a932d5985c41b15fb38e0033bd73902a6e6ca0d9e8ffa0985b35d91d59cce8920fef7f9ee95197e8fd23e25", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784537571, "uuid": "5174cd93-af35-47a0-bb77-6eded3b08b21", "value": "T1417186684F1EE445F1CAD551D18F2CECCAB894582A563C8A31BF93D09E3433D92896FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784537571, "uuid": "013a090f-6fb4-4ce8-bd22-3f671929cbd3", "value": "96:NdjwZzzQP3gegm/Kh3NX5ZMq6RwUrTa1op:NJmQP3gedAtt6R3Ta1op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784537571, "uuid": "1da69678-291c-4363-9d4a-0a96fcc1e5e7", "value": 3822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784537571, "uuid": "37599b37-8cf0-46ac-b740-6670d785f210", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784537571, "uuid": "ded289a1-5220-4546-ba1e-45d12ceb9db6", "value": "FAT-FM_1266595_V6_2725_2026_06\u00b7pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475eb9a2-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784525068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525068, "uuid": "5e08adfb-8453-42d0-b550-0eaa2ee09d36", "comment": "Malware payload", "value": "658b6e7e06eb2266cacc3dfb19390244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525068, "uuid": "b00e8927-4edd-41c3-9609-ad7f47431f30", "comment": "Malware payload", "value": "bd832e4ce87be4010489782aee6fdf8b6c2ff93e70285eead9d867d88aa7f5df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525068, "uuid": "ee7d5b90-1379-4d7c-86ba-cd5e0003a17c", "comment": "Malware payload", "value": "0408eb55e421e1dc51043f4df630ff8485bf25a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525068, "uuid": "5bc7b497-bc1d-4faa-8bfd-7197d710918f", "comment": "Malware payload", "value": "f88739451f9662199d5047cb0091a4da8677887a769da13453d55eb77e2876313649942f36fef1dd1af97e102a57c969", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525068, "uuid": "85e95fc6-6def-44b8-b196-2abf407e6c99", "value": "T13A456C5AB2F370FCD067C030439BDB62A835F46901226E7B65C4DA352D66EB01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525068, "uuid": "a966cc95-b031-491c-a45f-69eaefb52834", "value": "24576:ymiR9l3/1UmQBMoNUUGk1n0I4xVk+6DQ:ytR3/1URBMOUUGk1n0I4L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525068, "uuid": "e1d12d4a-6587-46b1-a945-b6f206784c40", "value": 1169352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525068, "uuid": "5aa8f165-6ff9-4cf9-82e5-4b3986396485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525068, "uuid": "840a04a7-766f-49b7-80f1-0ee52628584e", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a62ae2-8437-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784551043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551043, "uuid": "7a225ebb-1905-4820-b4e0-f0f2eabb784f", "comment": "Malware payload (PhantomStealer)", "value": "29f5dfd570850f374717bb5b79d25a20", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551043, "uuid": "bc0991f7-3f6e-41b9-a25d-6accbf4c5623", "comment": "Malware payload (PhantomStealer)", "value": "be03dd73ba50afc87caf9836b6bcf98ea7f186d92e1233cd4c79ec08040a5344", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551043, "uuid": "1ed42899-9b37-4622-9c0d-2f622c539ff5", "comment": "Malware payload (PhantomStealer)", "value": "11ee6606f701469d68fd12273bb5832438cc896e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551043, "uuid": "ef066c87-b532-4e45-acf5-10acc32d553c", "comment": "Malware payload (PhantomStealer)", "value": "d74ea964a2aa1477ac4bde4870817c4a632490308dcd61b14fa114f2c1215c55eef428ecfc478cfa8bdaffd64e134439", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551043, "uuid": "7761e2de-51da-461c-ab7f-b08300c2bdba", "value": "T19CB51214C61F95860CE3F66F1801FA06BCE9E12D3720C8BDED3EE6C54DD82359A28D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551043, "uuid": "f4614167-97b9-43e9-915f-2c2049766f38", "value": "384:4ADsX6HcTDNsKMsEL+1EwTE3/sXcfM3cENpFP3eMNWcqOA8+PvP873:wOy1zV73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784551043, "uuid": "be3b51f9-50d3-4425-a6a1-592833023675", "value": 2295179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784551043, "uuid": "8501c719-6541-4a83-b230-837e4cfee31f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551043, "uuid": "4b604941-8d2a-4e34-8b2d-5c1df6fcd362", "value": "BAGI CUKAI SST & TTX SECARA ELEKTRONIK MULAI TAHUN 2027_ 10371009_ 20.07.2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc9a2dc-843d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784553504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553504, "uuid": "408e1aa6-c1d2-49df-bd20-a79cb0511206", "comment": "Malware payload (Mirai)", "value": "9ac083a9099ff53769bc2fa4eb006a6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553504, "uuid": "4dc7a6e4-5c14-4128-815c-2b7be8f53488", "comment": "Malware payload (Mirai)", "value": "be54c2c9912cb13527004812b1f60de67657a5106fd15058f75a088914f9a97d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553504, "uuid": "85cfe924-7535-43a4-8ed7-a3e22053c204", "comment": "Malware payload (Mirai)", "value": "8e11a0524c43087346109db87b17d2b2354a3e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553504, "uuid": "f70b5ac3-2d9f-4f87-abdc-6445d14df7ce", "comment": "Malware payload (Mirai)", "value": "75b5eb0622f91f7a2f2d9dba561f4ae772913d04af03310d9f4ccf44766f50d2f8ab885e4ed64d2bb4a954650657490c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553504, "uuid": "d7a4c6d6-c8ed-402b-b03b-d0d1bf0ad993", "value": "T155534C89EA43C0B5F94755711877D7638632E8350034FA42EB66ADB2FC13F016A2B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553504, "uuid": "554286c7-6d00-4b63-bc19-72e2fb0588b3", "value": "1536:6hfFE8ByrHdKfUqMJVeh2LSHFRSWs9yOK:CfFE8BW6Uq4ssL+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784553504, "uuid": "320f1f7e-5d62-4f6c-9145-9518c423ae42", "value": 62352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784553504, "uuid": "e65c3862-57ed-4d65-8c7a-bd75ecc7053e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553504, "uuid": "49356c37-59ed-4e08-b621-e76fe71624ed", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8b1400-83dd-11f1-be1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784512329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512329, "uuid": "969e2fc2-2bfb-4639-b8bb-fd197006233c", "comment": "Malware payload (Efimer)", "value": "f59c96c0279175790adc28261fc77ee1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512329, "uuid": "d3ff1fb1-3525-483a-834f-805c4df12cd6", "comment": "Malware payload (Efimer)", "value": "bec299c617dfa95b0b9ccb083ee9d2510b4b1c8f5785d1d6d9f389a1b9e4f9b9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512329, "uuid": "cf6f80db-eaa7-41f8-9f61-451c0252df92", "comment": "Malware payload (Efimer)", "value": "d9f6cb49425f4cdff58608b2346b66a5dcef48b1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512329, "uuid": "c8243cfd-63b8-42d8-87a9-8245e86e7557", "comment": "Malware payload (Efimer)", "value": "4b1fe39155f6d6e417c9921bc4520a7b5a936c2493baa918ddab03136253df38a0fe6b336f7ef922e8ff7542de3ea7fa", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512329, "uuid": "4f25d388-a183-4e07-bf0e-09e09bf2b32e", "value": "T120E6332C65C016EEEE73417DEEF012B5E5B5B4720331C99B4BA8C366EE231A1493A717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512329, "uuid": "1e5e5dfa-251a-4064-80fb-3ea64b8acdc1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512329, "uuid": "6082f3a4-6895-49f3-b02d-7b948b7bcf2f", "value": "393216:qOT3DlJLM8f+2mM3EksU2bMZXMCHWUjX1cuI3/PGTAI:qw3vLM8f+2mjU2CXMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784512329, "uuid": "f6a406b0-5621-4177-8597-3a41e67d0116", "value": 14302691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784512329, "uuid": "c8caece8-0f53-4f28-bbca-7eef12181fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512329, "uuid": "f58014d4-c794-439c-b750-129b82783bc4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ac22ef-83da-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784511084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511084, "uuid": "68342cbc-1e58-4323-a882-27810e7934ed", "comment": "Malware payload (Mirai)", "value": "4c98764d1898aa764aa2747b18a945e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511084, "uuid": "f4f5e7dd-1eea-4745-92a4-b56824d1d9fc", "comment": "Malware payload (Mirai)", "value": "c0685aa4c68bbecb0bc5a61c3ee46eb9056ae33ded414784761d8ccac48e5bbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511084, "uuid": "6f42af95-f7e2-49a8-af67-0b6f654e741f", "comment": "Malware payload (Mirai)", "value": "3cce0313a7077aa4b8af5ae6bae3b21a7b31880b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511084, "uuid": "94db8728-0734-41fb-98d8-ff3715e5bbb1", "comment": "Malware payload (Mirai)", "value": "911ad2803145c6805710d5d372aaba40f3a4b9afe359d03d78bd1984883f818545730f936b747ab2c329b9aa02721461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511084, "uuid": "8ce786e5-2238-45f3-ad3a-bca7f72024f7", "value": "T181B34B41735C0B43D1575EB02E3B37E583AED9E121F4BB48291EAB5642B2DB3158AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511084, "uuid": "2c3de9aa-a3f6-460e-b35f-d260c3386177", "value": "1536:QtjAm7wENW+dudN24Cz4q1A44fj2X9k1JUDTbCyYUyv68:QtjAm8GW+4vO9H4U9EJn3v68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784511084, "uuid": "16206172-c969-48d9-be22-f608f9e59cc3", "value": 108160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784511084, "uuid": "ca88f931-6a15-46fa-aa41-04ccbb94b8ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511084, "uuid": "2d98b50c-3eb1-41e3-8663-ce343b8f9561", "value": "ohshit.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9462aa-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574633, "uuid": "6aaa012e-ab45-49fa-9c8e-3f674d6f9960", "comment": "Malware payload (Mirai)", "value": "d1dfa1eb6c48674a20e08273cbb5a619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574633, "uuid": "2ea78961-7412-4de7-aec9-f625d9fbaba7", "comment": "Malware payload (Mirai)", "value": "c07ec72ef22c784a2598427a4d168e4e70b700d16006cede6a8539e5756df23b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574633, "uuid": "244ac37d-3b03-4d16-944a-9d7d50f0f2cf", "comment": "Malware payload (Mirai)", "value": "55e193938865c5dea3234852dbe04e2e47e57714", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574633, "uuid": "96054cdb-063a-4bce-8417-93e7a0fee8a1", "comment": "Malware payload (Mirai)", "value": "b652f1da8ce1dc08c7036e05da696de237703a2a7a3a5f0a79b52b5c410df80bbd1b86b414e8fdd5e19ebb685b4bd038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574633, "uuid": "6b4fbc01-ec15-4bfb-8348-4c5b37eaceef", "value": "T1C3A3620E3E258F7EF7AE837447B78E31824573921AE5C545E15CFD091E6028A780FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574633, "uuid": "a444ea00-e131-41d8-bf1a-07189fdf1fea", "value": "1536:294DCtDPEyUIROgEu2Ruvb+qeE/OAmoaynWLo2AfdwTl60DsF:2+DCtDygf2RIleE/dVWLo2AfdslYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574633, "uuid": "990de0d0-2fd1-4d9e-bd0c-f91e78824044", "value": 103816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574633, "uuid": "1fd36f47-376f-46cb-90c0-3cd9ba671fa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574633, "uuid": "fa5a2080-2475-4564-a5cf-22a02bf3eda8", "value": "nullnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4155cbce-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574879, "uuid": "f24adbcc-06c5-484b-9a90-282b97f01e59", "comment": "Malware payload (Mirai)", "value": "50146d257ad2356cdf2066ca699a7377", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574879, "uuid": "51067557-ff29-4f3d-a020-295dc91d8c0f", "comment": "Malware payload (Mirai)", "value": "c1194291bfd88db485cf45f31cb17a04b261de1455047a4a6e330b26fb87877a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574879, "uuid": "47176872-3b7c-45d8-b52c-32bda689405b", "comment": "Malware payload (Mirai)", "value": "3ab485ce98a36e4d61a00b976f5d7c3f37f0a5ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574879, "uuid": "33a7ecb7-222f-4454-9f2b-7895bd2e0f1f", "comment": "Malware payload (Mirai)", "value": "655d95f14dcf61e27edbb7d3d8a025e387a25afdf9f29742954b3ce37f78fb7c20c0f7a2a71a07b8f4427005ea20e567", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574879, "uuid": "8a0d7539-ecd7-4bde-8979-87d3fd263e58", "value": "T1C6C31B99FC90DE52C6D52579FA5E418C332317B8C3DA7206CE209F3477E796A0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574879, "uuid": "2c243c78-3ff7-4e1f-9302-bea7ad60d0d5", "value": "3072:i9Jz4jHUozieUsNUQ4g8OMCBXd6cRWNSFNz+sdw5mf1Dl:iDQHQsNUQ4g8OxBXd6MFNzpqm95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574879, "uuid": "962bd828-7c87-427b-b6d9-cbf9bf570b58", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574879, "uuid": "da23d7e5-7e8d-4099-92ca-616a8de4534f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574879, "uuid": "a657e632-04a8-4a22-97f8-e7dce349539e", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007a526f-83e6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784515929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784515929, "uuid": "ec882679-5d9e-4630-90fc-a5041353fd05", "comment": "Malware payload (Efimer)", "value": "c6e9c0fbdb1865cb396d7d8f9e810eba", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784515929, "uuid": "c190a651-d70b-4caf-ab71-2036c7e15b08", "comment": "Malware payload (Efimer)", "value": "c125bbd2333186b24a2dc74b99c7f3db4fca9fbe86af42e68cc4999252453a2a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784515929, "uuid": "5ae928c1-ea9e-4f60-9840-6cb277bb3c0c", "comment": "Malware payload (Efimer)", "value": "0ae402fdc9baf13b4143c8fe10e90baea060d043", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784515929, "uuid": "6c0a70f1-9f71-4a8f-89a4-b11610ee6959", "comment": "Malware payload (Efimer)", "value": "6e6e60337b476b46cdfb5f21c2ad3a8ec0806a0d4694a820b40e4868d405d6132cff49d668a88e76575d0aeb6a56807b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784515929, "uuid": "47b3ea14-2215-4e5b-8dc5-776f0684e69b", "value": "T114E633685AE052FAE4B7503CEED10696D1AA74604B31C9DF0B9C9AB55F1B0E09E3DF03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784515929, "uuid": "bcd00aa4-1914-4383-bb99-b8de7fc11fc6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784515929, "uuid": "257d39e0-0eed-4b7f-8a75-b8e260a68161", "value": "393216:Fte4wcR8OajKjccqclXMCHWUjX8cuI3/PGTAI:F3bR6jaD9XMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784515929, "uuid": "fa45ca7f-a711-44cb-a371-08921ae3f35f", "value": 14319394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784515929, "uuid": "ff9cf6c8-f9a4-4f8b-b8f6-08548c55d821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784515929, "uuid": "69a95355-9d41-4f9f-b11c-9e14fcd0bc60", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4e9cc7-8472-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784576398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576398, "uuid": "df66f0a8-9421-41ce-b2cf-3cf4356597ab", "comment": "Malware payload (Mirai)", "value": "1c253badd8eb347bb3a9643af1c5ade7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576398, "uuid": "22ac9c30-8775-402a-a09a-b067d8e49255", "comment": "Malware payload (Mirai)", "value": "c165527a2aa356d02f68fd695fbfe5ae9170eb8b6862e48cf9758e0ec6eebe31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576398, "uuid": "e2bb55b8-203e-4898-80af-75e4da014ea1", "comment": "Malware payload (Mirai)", "value": "cf3fcb48d31dd785cda536b15fd6ae8cbe5a0c54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576398, "uuid": "730b96f6-91f6-43bd-b364-b6d4808cc79d", "comment": "Malware payload (Mirai)", "value": "2479762798b90ea53fda1d6393b471dbd42d7c5b4b2cd65d6b7a8255a3f17454a01149b609774adfbcf7836dac83941e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576398, "uuid": "8898ec26-dc05-4321-b1db-19d7348d9f68", "value": "T13323F19CEDD13882DE9A0CFCE3CA04637AE5A054133A1FAE8B60CE45FB6E51DB95C154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576398, "uuid": "895d4328-3cdf-4261-85db-282358234df1", "value": "768:HzqjkFaqefzXE0hpSSyZ7c/49B87YMkAOx/mcgAl/Z58Va/h/Yueo3gQzWK:HzILqyzXMqAnaluIYyaxYulJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784576398, "uuid": "6028f5b2-9733-4592-97cf-1b1faa43c4f8", "value": 49788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784576398, "uuid": "89cca463-02d8-4858-b458-2459863816ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576398, "uuid": "28181d75-5682-4e38-a58a-33454333ed8b", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399a6876-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784531058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531058, "uuid": "90889731-5367-407b-a1e4-ac92ab2bd432", "comment": "Malware payload (Mirai)", "value": "7bbf1787ce0b77aab56bca097d6ccf61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531058, "uuid": "3d71e21d-a88e-4276-b696-2ac56eaa8beb", "comment": "Malware payload (Mirai)", "value": "c1879bbc63385aba9bbc4dfd6386b5a9fd66482060e38acc4f78ce4345104f58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531058, "uuid": "4987130a-9b94-4900-91ab-b3df0bea27a6", "comment": "Malware payload (Mirai)", "value": "b858477dc1a2d5c290d6ff2111899df94923f9b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531058, "uuid": "83a03f74-386a-4fd1-86d2-9fbe5482365c", "comment": "Malware payload (Mirai)", "value": "76c801043879f4498bb7902df76ff2f2f0447081600672d2db06f4372f2d9fe86e0edac548b1d1db7ab3de88e7d3db47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531058, "uuid": "41dfb52c-680d-4a5b-98ad-2d39de01433b", "value": "T146D3120D56E134B984CC7068F0383CC97D854A08624967EFD7C4D998ADBF58AF92B9F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531058, "uuid": "8499e5bd-7d81-48f4-ba2c-721f0cfb8846", "value": "3072:n8dG3DW8EJHcwjYRzxvqo8AsUHSoO60jZPtSBPAkQMb1CvhvqI:8dmgJyzoxAb9O1JtSBP+Mb1ANL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531058, "uuid": "5104939e-3ae6-413e-94f1-234299818fbc", "value": 137544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531058, "uuid": "ffc22caa-36a9-4ded-b34e-42a305325e42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531058, "uuid": "4145d373-f0ba-4e32-aa3e-9f94ad3ead31", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd26eb0-841e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784540353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540353, "uuid": "b6cc2fb0-257a-4d3c-bcf1-4d059d102636", "comment": "Malware payload (Formbook)", "value": "31b0403df3d507f6e8bb233d2e1c0264", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540353, "uuid": "31c55901-f566-4ff1-88c3-de1d2efa3c58", "comment": "Malware payload (Formbook)", "value": "c18dc03e19a7a80431fc2a836500bd97d9b2d6f65d1193735a4a148c4fa1e272", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540353, "uuid": "6a4042ee-2cc8-4fb8-9776-485c5ba916d5", "comment": "Malware payload (Formbook)", "value": "c105439ff996a6667fdbfdb5c2f8d991b931dc3a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540353, "uuid": "10bfdc67-92ba-4fc4-8561-c6e94b7176cd", "comment": "Malware payload (Formbook)", "value": "7d7b523561b381d1ac912f337045dee89616fa5861ab9e44a12c71d95a3f90aa25a0069fc3749d90ea685809bcfe9962", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540353, "uuid": "7d12f405-57aa-4dee-a047-b4e845b99002", "value": "T1D6468F616E5859F5EF8C2A0E90AE6F1D87F042176A33706BFB41DF04BDDA241864B21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540353, "uuid": "bd37f46f-0481-4bb8-97f6-7fb67fd08737", "value": "24576:OweW67lvSLm4pNfRl3TyROs4USJ9VZ2qwrdKPoeXD2isa3H82RK+kbDnvmmsW/LX:fZziWGKiK+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784540353, "uuid": "0b001835-d1d4-4d98-8f53-b13112ed8c09", "value": 5487545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784540353, "uuid": "ff77ce2d-52fd-4641-81c3-4785266b5c15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540353, "uuid": "edbd4be5-8002-4a29-bfb1-bcb196954f93", "value": "Original Shipment Document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9dea45-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509130, "uuid": "f9139250-2301-4825-b0d0-465a4b1fce4c", "comment": "Malware payload (Mirai)", "value": "49fcd5cee7cc01a6eead2a2dd016396a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509130, "uuid": "9a3ebad5-5324-453b-aa38-56cfacfeb5fa", "comment": "Malware payload (Mirai)", "value": "c1c1046c507058c0ca6d14bb5369a84a45791d58475ce12fc6995451f0c5eb14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509130, "uuid": "bd672715-7217-498e-bc0f-4f849be4d432", "comment": "Malware payload (Mirai)", "value": "d16dbcb093f9b1011992d846a232327db13a4ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509130, "uuid": "b63fcee8-c5a2-4e67-8c66-5c04681721d4", "comment": "Malware payload (Mirai)", "value": "7c0ec9672a558a198d3b33b0374402bbe1f7e4354cc8d04ce684988c97974338ac204b68f88b72d2a49d0a0260466592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509130, "uuid": "be83afe3-b71b-4351-a7c2-734bb83f5132", "value": "T1AFD3BFD7B7672499C4A343F047CB678D2E931111CF9BA8E63D0E613B18BE0EB16163A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509130, "uuid": "c6e5e4d9-cbda-4292-9dab-5723e0ae8011", "value": "3072:QRZJCiyi/BvQzXKAgewbtrdn1Mosbpi5knDzxqE:Qzyw4zXKDxMo4DzxqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509130, "uuid": "0a948cd7-6653-4566-a25c-fa6bf4467edb", "value": 140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509130, "uuid": "cc6d681c-ea71-423d-899a-87409505c587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509130, "uuid": "9ac899d8-4c93-476d-b69d-16a2d3229ef3", "value": "ohshit.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabccfa5-8439-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784551863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551863, "uuid": "18867588-b1b2-4af5-b8b9-6e5fab798166", "comment": "Malware payload (Mirai)", "value": "b2365647bb3341412d552e5d68c85f6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551863, "uuid": "532c28bc-8e79-4573-ab36-1c9ae93546b3", "comment": "Malware payload (Mirai)", "value": "c25d365c18c4e79d2bff519e2407fbeda32c82983eae95eafb371bfd961c033f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551863, "uuid": "c47f25c2-dbed-4d0e-af9b-1ceceab8a5e7", "comment": "Malware payload (Mirai)", "value": "9662b141f1f8e688b92515416cdf415648107245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551863, "uuid": "9393f9dd-4072-4e5b-98b7-6c805fa4afb5", "comment": "Malware payload (Mirai)", "value": "6d792a556d87754540cd643b80e77c8298230d033846dc0f6762fb888a26ff17ef56a53cefa4cbb55dac12d682f189b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551863, "uuid": "6cc4f220-3a5e-468e-b403-a77239a2c7f3", "value": "T114E3075AF8829F11D4C625BEFE5E528D331327ACE3EE7112DD249B2532CA91B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551863, "uuid": "912f2e68-bb7b-4984-b221-40c46f29d148", "value": "3072:Qa2UFC05R9YNy24fod629fyTD7euZp7sBy9VXAapoDuqI0Q28E2pKvSaKEnbP:QalFC05R2Ny24Ao5D7Vp7jXXAapoDuqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784551863, "uuid": "622d5992-3bd9-486e-9731-03b2f3dacb03", "value": 157204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784551863, "uuid": "fa531347-c226-4b61-bdb0-779de8883459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551863, "uuid": "c92ae93d-72eb-4219-82b2-d86b741e4634", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8b856c-83de-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784512895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512895, "uuid": "4d1deccc-a5aa-43fc-9895-71247f21d588", "comment": "Malware payload (Mirai)", "value": "bf76fba4e234b4ddb25cd20bbf10476f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512895, "uuid": "b8991291-2e6f-4e7a-9bf4-13499488754d", "comment": "Malware payload (Mirai)", "value": "c3ba74fb10475f9e9db534ad484bbcfaa7ee1fd571639b35f57906e1fca1d716", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512895, "uuid": "d32ce585-f51f-42e7-9e6c-32eec904da62", "comment": "Malware payload (Mirai)", "value": "26c2ebdefb901d3b40c81baadada8213a12258eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784512895, "uuid": "31c7eb83-54a8-420d-a1d7-cb60121deac5", "comment": "Malware payload (Mirai)", "value": "18a87cb65740eed9a453c21d4336c920e6438afa6e97d58daa607bf350bf36b38d24d408afe9bd07f287e8f43307d49e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512895, "uuid": "0700c72f-55ff-4ccc-b51b-364aeac27e84", "value": "T18204E80AAF500EB7E85FDD3B05E93B0635CC755322E83B753634D918BA0A64B0AE3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512895, "uuid": "bd3f8e30-d270-4416-a873-caa88ae77a68", "value": "3072:WeVk6qQDxP/mZOJep4VkEYbOdrCo/lIE7PhGX:XVLPDjVkEYKRSE7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784512895, "uuid": "6a9c7cdf-f4f5-478f-9ccf-19b73cbe9fad", "value": 173532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784512895, "uuid": "7c0eecad-0206-40f4-aec8-fbcf024a0069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784512895, "uuid": "d609acc0-256a-4740-992b-62cc97779bd3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3e2d6c-83d3-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784508057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508057, "uuid": "95fde587-b2b6-4ffc-aa34-13268a15ea5b", "comment": "Malware payload", "value": "838cc2f4736d5b59da1fc6c410d1963c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508057, "uuid": "5748d117-d241-4b19-bdfa-9819129bde1b", "comment": "Malware payload", "value": "c442326ba5603e08ebabb9960cab7567b49ae9d30fad73256d53870322015045", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508057, "uuid": "857633d2-8772-4211-9cf4-2477af89f694", "comment": "Malware payload", "value": "c7e2765d75484fc941f87a7151cb7d14fd8aaeb7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508057, "uuid": "a6dc4eb3-e5cc-47b8-8cc6-ccbed3d06d43", "comment": "Malware payload", "value": "5c522428c5bb51a9fa540390c38b37cb36da088964bc5a334e25001a4b58492b54b5c2e01020aad366b76406ce3cd273", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508057, "uuid": "6ffb8b07-b11d-4ed2-a316-066448b7a526", "value": "T177236D652A817C14AA98D4371D7E2F0CB9AD43E6320492ED7FCF3CF68C4A69D911871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508057, "uuid": "63d94c4b-badb-4655-9191-7e4b8edfbe0a", "value": "768:vXOGVv/9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:PLAcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784508057, "uuid": "3395585f-7e4b-4c0f-8241-e5384d4f2b7b", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784508057, "uuid": "ff51a06a-80d0-44d5-86f8-1600ff1f5b30", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508057, "uuid": "c94291b8-452e-477f-bf91-fb97f353bea4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31b78b3-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784574614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574614, "uuid": "b1590c97-99a6-411d-9472-5224c7d5cff8", "comment": "Malware payload", "value": "c87b00757ee127e30cf0fa7cd06a83be", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574614, "uuid": "7a931b81-f5a3-40e5-a55a-3eeadb5d0ccc", "comment": "Malware payload", "value": "c5adc5f3185170c1645b3c05707848e2f16cc92308535cbffa14c2e87b0130b1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574614, "uuid": "3da97c4d-9444-4da5-9f7c-de16ee811216", "comment": "Malware payload", "value": "d2cff443d729f9d0cfc182c05421fe5bb746d47d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574614, "uuid": "48978ae0-d1e1-4dd4-b8a9-bdd9e2645fe8", "comment": "Malware payload", "value": "0bd037bf81bcfb78cc5c67b72b6b066fd67d91c439fa156c94438fc6389f9a010574a62190fd7681a2a048e437ffb76c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574614, "uuid": "a549dd63-9d79-4bcd-bc62-7f680320d763", "value": "T1BA01ABCA8210AE009169DA5D32D771A0B421C3CE194B4FB87F9C5D2EFB8C808B036E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574614, "uuid": "f8c833f6-abe1-4b0c-9710-28dfe081ca22", "value": "24:kXCKysE2hi0ziQvZohaABmsBFLNU8WQA7:e9Qp+MsABmQpU8WQA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574614, "uuid": "af864b2a-c9fb-47a1-9b9e-7885a184a015", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574614, "uuid": "154a3475-542f-4cbc-86fe-6cb5d9a4c9a8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574614, "uuid": "46349abb-2273-4590-9d19-920fa71581f4", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63205ce3-847c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784580519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580519, "uuid": "3b2aef8f-17c6-4ac2-9092-e0f0a442247a", "comment": "Malware payload (Mirai)", "value": "c206a21430cfb38bdaf2cf88cf436d8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580519, "uuid": "2a59e91a-7c9c-410f-ae97-7beb531229b2", "comment": "Malware payload (Mirai)", "value": "c67577c4771d12285ea8fdca4dc7700f75861f8f74f82f8126c49e86a4b40044", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580519, "uuid": "9cf51352-90f0-4349-a34e-6debd8ce8e21", "comment": "Malware payload (Mirai)", "value": "368ef35693f3fe62f4112181d1c7ccfeaf74948a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580519, "uuid": "9be82615-7179-4ae7-80b5-22f19dd3e1b3", "comment": "Malware payload (Mirai)", "value": "68e839da51bfc0c6dc5f0267a43a437cf46c4639872195cd533792e22c029e0384e74e3bfe470744c9ed5346aab532e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580519, "uuid": "94f7766f-4e6f-4f64-9f80-973c4a3ef1e1", "value": "T1904302F5364C5475C48A0DF028BD5042B34BABDEE9FA25B020BDDAB0BB71197386C965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580519, "uuid": "8ad39008-0b15-4bd9-87a2-5bd5cbb736e2", "value": "1536:YQxgxPJhfVIz2FzQOQRgD3jEShEFENC6+HlEvffF:Txg1JhdIzOQ1RgD34ShcSCmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784580519, "uuid": "10dde765-d4fd-4bf3-89f1-a8911e4c581e", "value": 58892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784580519, "uuid": "9edb5aff-54c0-4e78-890a-0d6027f61b64", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580519, "uuid": "58023f50-4561-4334-8994-7b34fb90ed81", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d7f4af-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509394, "uuid": "eb69d060-11fa-4bfa-bad2-cdf95f60446f", "comment": "Malware payload (Mirai)", "value": "e88de81932e49688ee7d49ce425fe012", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509394, "uuid": "bd0b2598-2c30-4830-b1ad-20c16d34b2d7", "comment": "Malware payload (Mirai)", "value": "c683d44aec123273b706f948e25ac772f6275175479724a676fde168a7d42fa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509394, "uuid": "96e1559f-4888-4038-9110-4e4b563927c9", "comment": "Malware payload (Mirai)", "value": "a1fdaf4217e768e64088165ce1e8efd20d73b29b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509394, "uuid": "1306d445-ce40-4a36-a3e5-b58f5bd0c3eb", "comment": "Malware payload (Mirai)", "value": "78dd803129c96bb18998ec91311d4772e71219b7f68cd7d8e1c56387e3d62ac255bf613a797f6483b66a82495f7c08a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509394, "uuid": "1628359d-4248-4c6d-8220-127805cf2950", "value": "T13273AE73CCAA2CA8D55842B4B5B4BE362773E41466871FF71696CA369007EDCF8093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509394, "uuid": "88440a43-c0f5-4869-ac16-cd5d326d5f61", "value": "1536:P/Q0G/PRRILXNHJKtmmHT74t73RCAZuj8FvgsMU:Po0GXRMX5wt5s73RTZuA1FMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509394, "uuid": "c9a3381c-f20f-4772-b2b6-97437f42c7c8", "value": 80240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509394, "uuid": "6ace05ff-77ad-427d-9c89-15b3c6e0fef6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509394, "uuid": "539e18f7-63ae-4df1-be43-8e27a58fce81", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdec3627-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784533454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533454, "uuid": "de7afa7f-b963-4b92-bab3-74bd8f13ef46", "comment": "Malware payload (MassLogger)", "value": "c66f0a92c3f1a8a5b9e3e64162ec761f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533454, "uuid": "10fd11b4-7726-4081-9d87-60cbbad9423e", "comment": "Malware payload (MassLogger)", "value": "c89dc886211fa450eb09952143e6a289264abfcfe6d4429a4d0259179759fcd4", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533454, "uuid": "b7fcf637-37fe-4718-a428-8640935502a9", "comment": "Malware payload (MassLogger)", "value": "e2e449d80b17a3610bf5c4b8129cd9c93f9f3dcc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533454, "uuid": "b647d49e-5142-41f8-9c95-886cc878010c", "comment": "Malware payload (MassLogger)", "value": "56b2f28f25ccee299885436a060f2e352907139eba57b31ade07b4c6636e274ba8fbfa69e30dcd4e82af9024dff4678a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533454, "uuid": "5845a546-4d16-4abd-a98d-9aa5ae584886", "value": "T12E751ABBC79639DA8230577B4F9EE49ADDA4C47A4C818646BC759540FFA33900C86F38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533454, "uuid": "8ef94e2d-e2aa-4a08-a065-883271dd2be1", "value": "192:wrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrh:CCDgZt2a+5IkC8UbgzgyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533454, "uuid": "b8fbab2b-aea9-458c-a859-ae892e1246ee", "value": 1646855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533454, "uuid": "c69abde2-0cd3-43d0-89c2-826e8af9c65d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533454, "uuid": "67d18379-bf01-4510-8e83-dcafd6a0a7a4", "value": "Dekont.html.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f464a291-8403-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784528794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528794, "uuid": "948c0dc2-17e9-49a3-abf7-9eb553024f57", "comment": "Malware payload", "value": "fa80997bbf42368b2f181db9f8160e35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528794, "uuid": "9cb879b3-28f5-4b90-904d-199a7a2c2f96", "comment": "Malware payload", "value": "c8a5864552ab341135ce5d590f314ac8856c827b6af2745256590d47fb94822e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528794, "uuid": "8aebbcdf-9dd4-4f79-a8d3-d256f0ffc137", "comment": "Malware payload", "value": "6a640829ccca217d47f827affa747cd6b4d81a8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528794, "uuid": "bd2b1753-5383-4ffd-a323-72b31df0a4e0", "comment": "Malware payload", "value": "8bed6c041accbea06622b6d5cca4796f942928ac0349935fb71f5731ea6859ea31e9a8a8835017160c7793a3a0e45c08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528794, "uuid": "9e3dd484-c140-47dd-b920-7ddc3d98b29a", "value": "T1B6C312F0DF59140D8F5DB0B75DAA7D133CA022D468B01BF64AE039B25569F3B29272B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528794, "uuid": "9f0c1d6d-0238-4856-8928-35b85be86101", "value": "3072:4zjYKz/MhXnHOgHu022pY7G4qRvhpnyFSLkMi2nf5cm9xudK8YxToutT:4H5zEHOgHkqGG5vjRLkMbcldmToST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784528794, "uuid": "f4bd0060-23a3-489b-9f80-07ebb8751e65", "value": 119860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784528794, "uuid": "ec97069e-21ac-466b-9e2a-3afd2dc54e41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528794, "uuid": "e3d9eb6b-9101-4e38-87ed-3693bfeefc10", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ce651d-8462-11f1-bd95-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1784569516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784569516, "uuid": "e0c5d750-4c34-491a-9929-be48ae9aa44d", "comment": "Malware payload (RedLineStealer)", "value": "15466030ff72b3d8d13cc121adcd4721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784569516, "uuid": "22ef87c2-80e8-4662-a12e-035bc8d1a0ee", "comment": "Malware payload (RedLineStealer)", "value": "c93919b24e82d7c32d8e9f2fa7fc5e3138d21a6360752cc79c7f3f0543ced50d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784569516, "uuid": "830c9214-1d9c-4d81-b4d6-acdd3f3f2a78", "comment": "Malware payload (RedLineStealer)", "value": "6a5585380d5578bd4f47b3da4fdb40aaf27e3f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784569516, "uuid": "5fe2cf3c-0504-4152-baf5-367e2ed28312", "comment": "Malware payload (RedLineStealer)", "value": "ca7c4dbe28ae48d9de9431e1f3b899b6cfe3d8cc2316c8f7086254c12894ec91dabba148c19d739ea5e2c2b1892ea324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784569516, "uuid": "6eb7e761-a23b-4689-9880-7d64f6554d75", "value": "T1A41512A65AEEC513E656177349E1E6B103B4DF88F123C75B9EEC7CEB3912B120842781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784569516, "uuid": "f32e226e-2a6f-43de-a441-419c24cfc97f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784569516, "uuid": "9ae08ff9-a8ae-492e-9be4-6988e3869590", "value": "24576:xR/TwcWmovlpfPeDoEWR2YCeONIPRXG9o:EllpPezWRe/WPROo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784569516, "uuid": "53afe063-bdde-49fc-9556-c146819db747", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784569516, "uuid": "7b76c7a0-544b-48ee-aacc-72d826a14a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784569516, "uuid": "9493aedd-6a86-453e-9e84-78456b58f82f", "value": "15466030ff72b3d8d13cc121adcd4721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a0ea3e-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784533522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533522, "uuid": "9a290a9c-70c3-499c-bcd8-e93e2b4f1a6c", "comment": "Malware payload (MassLogger)", "value": "cbdce5549da00366805b596bb5c9ac64", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533522, "uuid": "4c8fafbc-dc93-4ed8-8596-d00b974ccae9", "comment": "Malware payload (MassLogger)", "value": "ca62e31191f9abcbf923e723d363b1841ac7b20a6ca9da9345e7d4922ecb8fe3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533522, "uuid": "9d8dd0ca-2193-40ba-914a-0741cb5a9d48", "comment": "Malware payload (MassLogger)", "value": "302b13eb2664cadc40f48e76c6b65f10017ab92d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533522, "uuid": "0ca7ad7b-0771-49de-84a0-05804d70007a", "comment": "Malware payload (MassLogger)", "value": "d5a9737366d56727258a93019d090b93ae72efb60b9f04fd4c61baad2aee9b322655a40cb541729a9dff09fc486b30b0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533522, "uuid": "6f50b5cb-6b14-43b0-8c7c-a594290fdd25", "value": "T19CB58F30D79BD0C03C82C65AC1DCC9E8EFC54B6696FF352AB4DC3EE994D898454986B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533522, "uuid": "02f3103a-1a26-4998-8c0c-b114bac9f0d7", "value": "192:Up+IVa1386RrTGg+Qxk56q6GJsFsnGQGKi8:U3VaN8yrTGg+QkPJsslG98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533522, "uuid": "9619ce0a-eecb-472d-8e44-c4ef67bd5423", "value": 2349715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533522, "uuid": "0e490d2f-040d-46bc-91c2-9f288a03349b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533522, "uuid": "d3ea6fcb-5c84-4beb-b74a-f55dc401c845", "value": "mby77094.pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e689add5-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784530489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530489, "uuid": "104068e3-fe36-49b3-ae6e-9f06981aa99d", "comment": "Malware payload (PhantomStealer)", "value": "2a17eca2e991123ea613fea2c44f0893", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530489, "uuid": "e4d180b8-94d2-4255-83ef-f67fba316150", "comment": "Malware payload (PhantomStealer)", "value": "cae5e8e2fa9cd2078bfac5606196bfb734bae2074289016eda7651dffc6c7962", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530489, "uuid": "6752d3ee-32bf-48f5-b29c-12464b92d992", "comment": "Malware payload (PhantomStealer)", "value": "7fc9df68c7625d6f12c641003781feee9b8dd64f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530489, "uuid": "309d1b49-5eae-41b6-869f-891f126bb577", "comment": "Malware payload (PhantomStealer)", "value": "b6af4e88b88c8d3fe6e44037aeb732723c97d8eddaf10e139f65a41f3e4f58487d81b372c96609a5d7e85121e9cadd5f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530489, "uuid": "1148ffed-1a77-474c-9606-3101dfba97b7", "value": "T1D2A58A58570EA1E10E7A81433547276EE764E0F2F5770236FF7A7B7C2DA15AAA038078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530489, "uuid": "6e84c1a8-ce2b-4302-ad38-bd4d92868af5", "value": "384:nbebmbebmbebmbebmbebmbebmbebmbebmbebmbebmbebmbebmbebmbebmbebmbe6:X2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530489, "uuid": "6934ed37-3e4c-4a87-befb-6dca828f9e6b", "value": 2173588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530489, "uuid": "b3598f1e-88f5-40de-b482-132884efa9ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530489, "uuid": "a46bd5a3-dfad-4114-9ed1-a82bb3918643", "value": "BAGI CUKAI SST & TTX SECARA ELEKTRONIK MULAI TAHUN 2027_ 10371009_ 20.07.2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff32e975-8406-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784530101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530101, "uuid": "baf4bf3c-f022-4bae-801b-99d42564febf", "comment": "Malware payload", "value": "b415f0a71d70b5e2ef0b4d6046fc4e9a", "object_relation": "md5", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530101, "uuid": "fec240bb-fc6c-4476-9e0e-487c17fdc9c4", "comment": "Malware payload", "value": "cb3bab4143f7d138b360856e13aa93cf519fa8b03749f229d0c3ce00c30d5700", "object_relation": "sha256", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530101, "uuid": "5f72d195-3afd-46b9-bf71-13a34871b3e6", "comment": "Malware payload", "value": "9d3b0ea67e3bd03d4b27c8a8e62bd2026603c44a", "object_relation": "sha1", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530101, "uuid": "e80e16df-3d7a-46f5-9ac3-2f0504ffeb9a", "comment": "Malware payload", "value": "e8f331bf7d2fd39b324b5051cc700872150c0e28d1fc8d6dd4733b3758fd94c36e4bc08a697d637cdfff10c1ddee3c09", "object_relation": "sha3-384", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530101, "uuid": "40a58c50-a11c-4cb1-b64e-8a0fd71e3039", "value": "T117749D87B2A1B3E8F1270F388C4546069BB57E716F975B8F62605A563F7E2C01E2D720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530101, "uuid": "0bcdaf0e-7a85-45d3-b524-0b40e92cb227", "value": "08d2e8def3bf9cbd7f590ec604622dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530101, "uuid": "c6abde67-55a5-4f20-b190-2ad24f5227ee", "value": "6144:Cv90q7NPirZ9hlcPLYGBDtt1FAFsIqZcR5H:C1wln4xBJ1AFlScXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530101, "uuid": "dd7a14ee-7e5e-4680-80c4-9a9b93ac963c", "value": 346352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530101, "uuid": "60a7a67b-69d5-4204-88e5-81a3aacbe721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530101, "uuid": "faa85ddb-0411-4855-91da-ed67f087619e", "value": "XinPu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef43f4c2-83ce-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784506022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506022, "uuid": "d3d4ffde-a9ad-423b-9547-3cb98dd562f1", "comment": "Malware payload", "value": "846b24b4c7ded55fd90ccdcaa61bceaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506022, "uuid": "32881960-9874-45bc-ab35-574267443919", "comment": "Malware payload", "value": "ccc0ba109fd1e38f414e9354d5afaf1f32cbef61118517fac5c36b0d3d93a743", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506022, "uuid": "d5019778-e179-4b79-a06d-97bddd114284", "comment": "Malware payload", "value": "05ec4c08fdf0b19290c0c7ddbd5992d0e0f2fb7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506022, "uuid": "a1746fb0-b614-4a08-a8dc-95d5f2d25254", "comment": "Malware payload", "value": "80b6a03b043bd3cd914acccb444c1aa49f3e2dcc9e72be185232c8ed6fa08fcd92c9f292e4347147468a6ca469404788", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506022, "uuid": "48c8736b-fc2f-443f-a77d-547aead54913", "value": "T181B30266A90070D4D79212BE91FFCBC38B2CDF5AC12790A32513FF653B405259BBB689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506022, "uuid": "44f5064e-b19a-4a9d-8fc9-ccab79560150", "value": "3072:oCNTFc0fcbTbY+V3aSm+8TW9Jd4yNjjj37KtkSgb09P4h:oUpc7Y+VK1VTWrf9jf0l4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784506022, "uuid": "5d8a202d-67da-48fe-b22a-3570d6d3d0d8", "value": 114312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784506022, "uuid": "4dde8f4f-24b2-4c10-b157-8bc7d84836c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506022, "uuid": "92f6d5d2-348d-4f47-a6cf-a7c3c45a7a43", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da36bc7b-8494-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784591027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591027, "uuid": "05c54799-4bb1-4c2c-8d92-64c5b8a6a347", "comment": "Malware payload", "value": "10c48851ed02d156cf1b0053f3c660ed", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591027, "uuid": "962bd264-6981-4840-8746-3260c0f439f3", "comment": "Malware payload", "value": "cd4498d39e8126c9779a7d55fc860b8e06d1875d8f6add1ed208698c00c03811", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591027, "uuid": "6276be95-f33b-44da-8eeb-8c5b633bdf9d", "comment": "Malware payload", "value": "b72153e4ab81abb2ec13de8e9198e7f73f814674", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591027, "uuid": "3fd3223e-6e10-483f-8386-0df4a92d2642", "comment": "Malware payload", "value": "61115d427b69ab14d9d5287af099ca87c9d63ed48d95fceb111292c6ce8ca66e070ceb15497045b4f088a47834a84b1f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591027, "uuid": "0ae906e1-3f4d-4918-bac6-29e959086fc4", "value": "T130E60133B28A653EE06E1B365A72A150553B6E616D128D1ADEF018ACCF3D1703E3F746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591027, "uuid": "027761d6-e834-4f66-92ea-7b9736a71185", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591027, "uuid": "4a336899-fa67-4f37-b653-1b98adc3dcda", "value": "98304:ooJJq4BhOFzR0lZj7RWD9DYGKI0MR5vK1N:DhOY7je0QK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784591027, "uuid": "b4eb53a7-95f4-4553-9a91-ebd7afb484a9", "value": 14453784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784591027, "uuid": "ec1ad83c-b051-48a1-8756-f0568ad9c9b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591027, "uuid": "5802d02e-bc11-4398-aef9-1442f1a328a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1e135e-8472-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784576263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576263, "uuid": "9b6b6a16-812e-4c9d-be23-7699b751de05", "comment": "Malware payload (Mirai)", "value": "25d7c97a437df82922b7e2a1569dac6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576263, "uuid": "9861c159-40eb-4335-84fe-6e0c5a529f23", "comment": "Malware payload (Mirai)", "value": "cdf7dbac5c8ca636350541007bf67ac05634ef36dbf64ffd7c73dbc6db5bb280", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576263, "uuid": "29565c42-3246-4095-95d8-82e1ad62951a", "comment": "Malware payload (Mirai)", "value": "86f6ea17c404356f5da710231fa774514750bc23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576263, "uuid": "8e8842c9-f9d9-46b8-b53b-c6af6caf15cf", "comment": "Malware payload (Mirai)", "value": "d042ae1afaf5aa8c47c37ebd6b307e815cc9cc2d4a3f1d2e6722beed4c6bfe0caab9773f643f1283fa19c47e6b3f583c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576263, "uuid": "7ee033cc-d2e3-4fdd-b9f6-6b9794452cbd", "value": "T10BC33B0779C18AFEC486D67803BF7526C522F83E1B36338B67D47D693A09AD42A1D319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576263, "uuid": "84ed377b-4364-4456-b688-fa02e371ca92", "value": "3072:S6SblaZFi4q0KI1XeN31xwnPEbt+uYr0uBtuerGulNpS:tyUFi4ZNEDwPRuYpBt9rGulNpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784576263, "uuid": "f5d1de91-2e3d-4bc3-a05b-1538a4c0f1ae", "value": 126925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784576263, "uuid": "af726614-ff70-4acc-80ec-c8647c5e13ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576263, "uuid": "54b5d9b1-2fc0-4907-9a3a-c1d43092f9ce", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5f8eef-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509485, "uuid": "f0c279cc-bc1a-4d14-9a41-c61ada9b591f", "comment": "Malware payload (Mirai)", "value": "4fbdc1b15f9d1337b711c6b298830173", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509485, "uuid": "e2eb1797-bdbe-4046-8ef1-782d45a11bf0", "comment": "Malware payload (Mirai)", "value": "ce05cafc84ca9fa75f97cc1c857170870252ef286c4940189a3c8499ae00a148", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509485, "uuid": "0dff4daf-5f99-49dd-bf19-51c1ff7e728f", "comment": "Malware payload (Mirai)", "value": "4156be61a91d6f0f96b0573e8b237c3e3e3d1d4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509485, "uuid": "e5491e3d-bd1e-4e91-a868-af6c9e23ab5b", "comment": "Malware payload (Mirai)", "value": "f3b22aba08156bffeee018c7dca8af712dec2aeec73d9201c261f2f127f1ee8105eae2310753c5ff19cf6b87f86c50dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509485, "uuid": "a99c8d6e-3f72-4685-94dc-ed8de834e6ad", "value": "T1A0A32946F8814A21C5D512BEFA1E318E331357BCE2DE73229E14AF3173865AB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509485, "uuid": "4aa6acda-8b93-4b3c-bfca-cc037348084f", "value": "1536:gAnQiGQoOTk+5KqmLUEqg/qSapwAo1MKb3TOaew4oXBDsRiciWRkOg8S7vJ5DYW1:JGKXg/qwSM3TOae6WRkOgJ7JJL+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509485, "uuid": "c46c379a-c461-4c7c-b058-7a22d2f28c70", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509485, "uuid": "de9c95eb-fbcf-4da8-9a75-de9fcc9023a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509485, "uuid": "296d9546-da34-4a8b-a346-c13d9e5844b2", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d37b4a7-8432-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784548754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548754, "uuid": "34d74130-cfbc-425b-bf84-d6e0b723c786", "comment": "Malware payload", "value": "1ae6912b102604463d69abcc4800b09c", "object_relation": "md5", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548754, "uuid": "9188df37-e859-4898-91ba-4397529e0cff", "comment": "Malware payload", "value": "ce0ab5b6fa2a9d0f6bb5919c4fe00e316344f110303c9d3cf70bf63f03e0d570", "object_relation": "sha256", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548754, "uuid": "8765d659-3cde-46b5-a3a6-8c483ea461eb", "comment": "Malware payload", "value": "f1fd40d751fceefc76673a773901bbae6088b605", "object_relation": "sha1", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548754, "uuid": "b2687d65-6ab4-4b59-8dd5-c21895d6a54a", "comment": "Malware payload", "value": "4971c25b2d6e1f890a01f259eb206dc3c2cb3b73ce32b022ef4d8a6087763797b1d726d35e6392eaf803c27511a05bb9", "object_relation": "sha3-384", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548754, "uuid": "c67fad33-6beb-4c67-b3ac-8f37f825501e", "value": "T18EC02BD05E5B83607031333790E9C201B4604419C013C4FA070CC73F7145482402D1FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548754, "uuid": "0f78af45-07d8-458a-b752-22ec05997f55", "value": "3:lP/ErUnzEmuNJbZ18P53ydclV7W6WXiRyVQRlXV:lP/ErUnzExZ2pyilKQTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784548754, "uuid": "4fb883ac-ace8-4bb0-9277-91baec327cbe", "value": 138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784548754, "uuid": "2b6086bf-0a0e-4cbe-a040-141df2d3240a", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548754, "uuid": "4ec88dcf-4ff4-4040-8310-a86e52bb88ed", "value": "rec.wsh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16917ae-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509381, "uuid": "97641771-81ce-439a-b400-d65a05f18f1c", "comment": "Malware payload (Mirai)", "value": "8ebb8ce66dae2910251bbf008a94adb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509381, "uuid": "8d743847-ee9e-43b3-ae83-7a2b5499a08e", "comment": "Malware payload (Mirai)", "value": "ce23b01e50afa5dd35213b5cb7198e677e32adefbbf3ebd735e8a0a440d40bbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509381, "uuid": "019968b5-30e4-4334-8e82-1a5f89c15c80", "comment": "Malware payload (Mirai)", "value": "72d458062613eae8fb74d1d6c808d4f5699ab0ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509381, "uuid": "2e683d4e-96d6-4834-b61c-8409ce39ae51", "comment": "Malware payload (Mirai)", "value": "a9b583ee5c1a64827b4888048f95129473c7a6d3f76fa1b09ae7cd73f34516e29485c03ab9adc64e9b9de33a50c7275f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509381, "uuid": "1a3f4d1b-55d2-44b5-bb94-d6fc4fd7a399", "value": "T11903F1C5D4CC7D35E49D21B01CF9EB4F5810E68CD0F889EBDEC9150B2BE5A693A28A17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509381, "uuid": "59e8af95-9df5-4dc3-8416-58550018678a", "value": "768:JpDDQdmx3ELhtPG5AZhTHgQtiLDPNie3Asw64gE6nBjIfqlwXvnbcuyD7UHQRjY:JpfQdmx3EdtPnZhrft+Me3Asw6C6B0yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509381, "uuid": "3ec94fd6-f932-4732-936d-a66f7b0fc42e", "value": 39692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509381, "uuid": "30583088-66a1-4d45-86d3-0aaaae73f214", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509381, "uuid": "de81fc05-8ac2-4ab0-99ac-6600d6a1e68d", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c6592f-8426-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784543565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543565, "uuid": "8bea87e4-0db1-4a41-84f1-53b023b88028", "comment": "Malware payload", "value": "94e5a298366a98de051ae736777f54a5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543565, "uuid": "d0e4feae-9aea-49e2-94dc-bff7ee22eaf7", "comment": "Malware payload", "value": "ce9d8426753fb97ae12903ac06ae37074b29c1aa157e61424cb64655dd657c32", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543565, "uuid": "80be2abf-c0ce-4f26-bf84-930f94707ba3", "comment": "Malware payload", "value": "1df08b18c9fab6847f66efd18d04688dda402509", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784543565, "uuid": "24d7a1da-fa21-4c01-b192-38b83ab5b587", "comment": "Malware payload", "value": "93b999d51ae8bbd8eb651f3e0a4cb60a7ac5a5e28b4b13635bf759557f9c375c2184ec3de27dd4501c59fba20e26f3e6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784543565, "uuid": "cca5a716-46a8-48db-89b0-814a5c29d6e5", "value": "T1B3128541B501C176C055AF318AAB979507BA7C00DFDB2207BBB1738D5EB31D0BAA63E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784543565, "uuid": "ec68cc58-fbd9-40da-860d-e5fa81a66c88", "value": "96:XyWVNmdQhGAsFCwQfpTWv2L576wURdxU2vuyB9dwUo+R8Q+FGJ3bQsn4LOG:LSAs4wCFL5uwYdxdu0+E8qJ38s4Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784543565, "uuid": "3e212036-3e1b-4d61-a2d9-5e66462dbb5f", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784543565, "uuid": "c34d2d6d-5445-4e38-84f0-bb43bbdaef05", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784543565, "uuid": "9fb97c49-5ad9-4b82-adba-868ac28582f9", "value": "Adobe_Reader_Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f4a934-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784574592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574592, "uuid": "7cbe44f9-78ac-43bc-92b5-60e4ae2c35e2", "comment": "Malware payload", "value": "5173bbe6ca350f5f3d5e1e6436b740fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574592, "uuid": "da61a474-cc5c-4c92-a0c3-7d419cab5234", "comment": "Malware payload", "value": "cf7d7fbcee1f958e55d3c0ef34c49df6b9c78baaed17bb39096c9c1449427c3d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574592, "uuid": "10de84f6-1f54-4be5-9377-02e21e0b82d3", "comment": "Malware payload", "value": "fd48d2da59aa22a1073f8440a21b048a6d43f6bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574592, "uuid": "5e6db942-0a7c-43a1-95c5-945058fd3a7d", "comment": "Malware payload", "value": "ab8e6f81b261d9738907c023fd42164a01a58ee96c79d846615e031f02379046507b7b4b3960566f972851a7b653c71f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574592, "uuid": "1c294095-d7f9-4073-98e9-f5983cbecf97", "value": "T12B236D651A857C14AA98D4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574592, "uuid": "213622ee-eb6e-44c8-9235-54b6d0d9bb08", "value": "768:lrXRWNGxVK9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:lllxhcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574592, "uuid": "1d7216cd-289f-4e87-9007-a05c12f93bb7", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574592, "uuid": "7e282336-4b7c-46e1-84aa-9207e52eb61f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574592, "uuid": "9b64287b-c99b-4e2c-a9b3-496d831ff723", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0035ce1e-8457-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784564462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564462, "uuid": "953d235f-7d8a-46ec-8ae1-9450900d5856", "comment": "Malware payload (Formbook)", "value": "0aa20e5c37154e9a9c7c276e6a52f6ee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564462, "uuid": "c95ff297-dea7-4bdd-aa6e-e8aa57416800", "comment": "Malware payload (Formbook)", "value": "d08cf8c8f95b4df31198be8583cdbcf5f8e5beda95487e4aaed26cd2529e255d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564462, "uuid": "8aa131b7-000d-4bf8-aab5-d5a30f4c15fe", "comment": "Malware payload (Formbook)", "value": "17c4c3c5bc44c92f127ace0a410b974c26dc104d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564462, "uuid": "b25cb6ae-e022-4401-9d2d-3e6eb59506de", "comment": "Malware payload (Formbook)", "value": "2f40dbda4b34fcb804b0f6da996b0907ce1f56e7003299097a537260ec1ba0a7ceaae763a63b3fb8e52ca9121c7c8d7b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564462, "uuid": "f517f2bb-81e3-4448-ad9e-499f76c1f37e", "value": "T1EEC512934A6A7A47DD04F0BB0CFCB1D1C774EFA4192B1F2E2E855783945693DBA2062C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564462, "uuid": "3dcd7936-9eb7-4fdc-9191-3ce6f44b3c11", "value": "768:vPePePePePePePePePePePePePePePePePePePePePePePePePePePePePePePek:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784564462, "uuid": "da69bf02-099e-47e4-8807-861b4249d02d", "value": 2560271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784564462, "uuid": "51460c69-f3c3-480b-9eb0-2cccdc0ecafd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564462, "uuid": "51b8e99d-27d4-47c7-86c3-f4fcf9321967", "value": "Justificante.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6236d54e-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784533273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533273, "uuid": "83250402-3060-4753-a170-cbee9ce8df3c", "comment": "Malware payload", "value": "0086f5aac18cccfdcd711dcd1111a23c", "object_relation": "md5", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533273, "uuid": "1c098d5a-99d5-4457-976f-4961f048e041", "comment": "Malware payload", "value": "d12447bc79fd6fe4548193f49cac80ce4f5adae8e52061621f2a82ce5d0a0693", "object_relation": "sha256", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533273, "uuid": "e4740255-fee6-4f50-8ca3-fcee31253d91", "comment": "Malware payload", "value": "5ed8200b2a069567a18040935105052c05de718f", "object_relation": "sha1", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533273, "uuid": "ce243658-3a91-429b-9932-f037ff15bfdb", "comment": "Malware payload", "value": "a73e9e78171b54186e315c858e564f58fbc00974f8156fd8bde2d3c181e2662dc6da15d6b80f64dc91814cde5c113ff8", "object_relation": "sha3-384", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533273, "uuid": "e2e08b18-3a38-4040-bd7f-a1aa018843a4", "value": "T1160371AA29F720166903E5B56B7617473B70C003D10ACE283EAC539C8FC6AC4DDA379C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533273, "uuid": "8b95b842-a9ad-45fd-b0ef-f26714843fcb", "value": "768:gh33wpP6fV9PGjJ4cp0uAf/ni5eBLStX7QW+2CwDMfjyRpV2:glrIZp0uAf/nIQLStXcW+2CwDMfjyfV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533273, "uuid": "f8f9bde9-563c-4c2e-b897-663df687bdcd", "value": 40379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533273, "uuid": "07e6a5cd-48db-44ca-9c08-f7d2760c9dbf", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533273, "uuid": "e4b72855-b5a6-4089-8291-8c16af2fa0f7", "value": "index(2).html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928a5d54-83d2-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784507585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507585, "uuid": "7fe39f04-6e63-4adc-bfcd-53c36d889214", "comment": "Malware payload (Mirai)", "value": "2a07aa832791dd5235d65a74374d7731", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507585, "uuid": "88be4844-f9eb-4d10-941d-01f6091560ad", "comment": "Malware payload (Mirai)", "value": "d1e7bb3d3a56b3fa0810838df4885c5c3c794519502f3bc7ae335c9720099215", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507585, "uuid": "3d04003a-cde6-408a-91d0-be1dbd6188c5", "comment": "Malware payload (Mirai)", "value": "3130a48287f4408df677cac03d5fc2c211e78647", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507585, "uuid": "8e5b175b-0edf-404b-b2f4-6875a3a54585", "comment": "Malware payload (Mirai)", "value": "80e2b081874e966563f29b9701e8d2fe2308dc0dc68af1ad4c9e454ddf39f715030fe933ac997008a0db5ac9497e1e9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507585, "uuid": "fb856f15-1be8-4810-8013-006e4140913f", "value": "T192D31955BC829A16C6C2167BFB5EB2CD331733A8E3EE7107CE255F21378B51A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507585, "uuid": "25acb563-8b02-4643-8d76-ececaf0f2d96", "value": "1536:J7lXIgZgOHjkk5KYawgYApJrXCW2xZ8ylwmciCVZJcE8TZ8vqNDCyBhPB7ejYgau:JWgZTHwk58rXCW6QiCptsPB7esPcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784507585, "uuid": "a14681dd-cc92-4be2-b9e4-f184c0db8a4c", "value": 132428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784507585, "uuid": "de09269f-c299-4ea9-8227-f1cff44244c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507585, "uuid": "7fb622d4-df6b-49cb-b847-dbd45ac6345f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e1fab5-8438-11f1-bd95-42010a9c0009", "comment": "Malware payload (Hydra)", "timestamp": 1784551177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551177, "uuid": "39e97a75-5f15-4593-bd1f-066c694f3872", "comment": "Malware payload (Hydra)", "value": "cac86d5d2fb145096d2fef5b0bc7e804", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551177, "uuid": "601a0fe5-2a87-4138-b793-6e4462c64f8a", "comment": "Malware payload (Hydra)", "value": "d300e348a236c6fc23bceae84fdbd6deecf8f41565c032c0d062733fcb066a6e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551177, "uuid": "f53d5300-e3d1-4213-b8f0-89f42c8fe517", "comment": "Malware payload (Hydra)", "value": "af23b7ba2519413606ce5fcc97453ffb6104b725", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784551177, "uuid": "a4e4e529-48c6-47d7-8cd8-fbd0ae2364e9", "comment": "Malware payload (Hydra)", "value": "a569f8dd820431b4dd8f0676bb07fac0ffec59d94747f10f19c8102f478f436817ef1baea9a6a46498993e07aff5bc08", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551177, "uuid": "aaa44054-b428-4a07-986c-9b83f8fb9ec1", "value": "T1BF56336446C64717FDF3BFF55AF9928A8ABC8D89C2C6C99A052C763638FB5D11F00482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551177, "uuid": "88b7964f-d81c-4557-9b3f-8cc870742b5d", "value": "98304:4kLipe0/65Kh2SAwxKFzNPy4Qvu0rwd6xnDZyzzBpY017J+euA3dUne9EWzrfG3W:fLz0SJZ+AzVy4qCzjn1AzA3dU6Ecs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784551177, "uuid": "70c2ae62-f353-4bb7-90f8-22a2eab3954a", "value": 6464527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784551177, "uuid": "b8307b2e-3704-4b57-a9c4-8d093913dbcd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784551177, "uuid": "ac0e6efc-4a9e-4893-8e82-b3ad97a320ec", "value": "bawag.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad90e92e-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784534259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534259, "uuid": "5adf0b22-3275-4110-9ead-8d42b39c854b", "comment": "Malware payload (Formbook)", "value": "0c9381cfd85e2d1aad8ccbe8bec861ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534259, "uuid": "8edc84b0-5ecf-4234-840b-155eefcd5676", "comment": "Malware payload (Formbook)", "value": "d3adedb75d5f43ee0a1400fa5be76e4f734ec031d40b426a390ec5f453a40859", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534259, "uuid": "e489644c-df2c-489a-950b-3dee0179b99f", "comment": "Malware payload (Formbook)", "value": "6f1cc02617b24127df7fb482c2e1c9496c0aafbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534259, "uuid": "13661039-33ab-4788-b0c1-4dd8dc2e6ab8", "comment": "Malware payload (Formbook)", "value": "f3f2d6d2f15387a79e2dbd4bfb33e64acc9fc72b304d84992b49afed0100f320b1f72e82281a7d39cb903b662e531e58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534259, "uuid": "d3fc48f3-7e1d-4341-80e2-f9fe8db599e3", "value": "T195451264A301E606C5416735C6B1E3B923B96EEDF500E7838FEDBDEB7932B420C54692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534259, "uuid": "226323be-ad21-46d5-b201-c1e4f5df7e8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534259, "uuid": "b7cfc7ac-7eae-402d-81f7-95636d14c7b6", "value": "24576:SV/YjO95jVXtUxdC/bVgc9YuuqyHgNiULtycpy/FAj517DJ+RL:jKb0xdGpgSYuFyHgNdprpAmjP7DaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534259, "uuid": "162b4c4e-ca84-45c5-b99b-31d324665b2b", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534259, "uuid": "618f3569-88dd-410a-a601-c288dc2ca301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534259, "uuid": "a53552b6-e076-45c0-b834-9300456507fe", "value": "RFQ_VIET EPC12 & EPC13 [HDEC] RFQ_VIET EPC12 & EPC13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137bde09-840c-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784532282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532282, "uuid": "fa8a674f-df44-48b0-84f0-362266c7c6b9", "comment": "Malware payload", "value": "ca7e23cd62f3e23e62955c120083f5c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532282, "uuid": "1a6a64ab-9b42-4773-bda6-5ee0e4f95988", "comment": "Malware payload", "value": "d5d41bf6ec3d3bfe82546234a095654cfa4200fefec12889689ac4d609076a95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532282, "uuid": "dbe2d27d-170c-4f09-9c9b-d09e7fa3c0c5", "comment": "Malware payload", "value": "b96c7a602aa45f8dc830108eb45cde67ab915a17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532282, "uuid": "88515533-b1f5-4db9-b37f-92dc2611358d", "comment": "Malware payload", "value": "2eec4b4c7fe70d0a0f3a956ac6a4d4607ac545e30bf0f1b63fcdfdefc95b695ca83bc6f60ba3969d7eee2850b76a5fd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532282, "uuid": "29db91f4-4a77-421f-a1dc-81c3722c1adb", "value": "T14DC312D0129098A5C17EF6751E30D8AAAC2045E4F13E66AF33982258EA767CFC7D44DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532282, "uuid": "1ca3c8ab-37c0-497b-bb3f-964d35761d41", "value": "3072:O1bVze+3AgBlyokvITBG60iqMiqj31OiM9MrHiC:uNVlCgTBG605MTjFOiz7iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784532282, "uuid": "dbddb4e8-4e3b-4807-a017-ff1eac311382", "value": 118220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784532282, "uuid": "095f268d-6480-494a-bbc7-698de802bcfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532282, "uuid": "2db42226-c582-4658-b051-9506f744b4d4", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82592e7b-8429-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784544924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544924, "uuid": "a89e26a3-a0ef-4dbb-8eeb-0baeb31373ab", "comment": "Malware payload (ValleyRAT)", "value": "3270606f7138f08b0c4e051d0a9ebc2b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544924, "uuid": "03dba8f7-dc8b-4fcf-a7b3-6fa2a4cbf843", "comment": "Malware payload (ValleyRAT)", "value": "d5e71f60f77f8f7853d80ff308d7b0420e20600fe03af2529a2c8e740ed52943", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544924, "uuid": "b763ab7e-be95-49f9-835a-1e34c06b7e01", "comment": "Malware payload (ValleyRAT)", "value": "da7422fee4ab158c1ffb61b901e854fa375d57c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784544924, "uuid": "46bee798-40ff-44bc-98ef-5e88d02ff7bb", "comment": "Malware payload (ValleyRAT)", "value": "6e4572ebdc0735028f651c0e1b9d1389f60b2b87e306dac6dc490f7e46e08dc8c208604a93447b43867003afdb58c3ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544924, "uuid": "28a6e789-d2b9-45ce-a3f0-a4bc9b4a5228", "value": "T18A348D15B7A50CBAED778539C9530906EA737C4247A0EADF03904AA6CF2F7E0963E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544924, "uuid": "cd0b6ed7-4102-4601-8727-2b3169de43c1", "value": "8e2d33ccc73ed51abd14b6951ffbefa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544924, "uuid": "4c0a94aa-2282-4293-8ab5-1c9c4db1a7db", "value": "3072:sz7FXq1GEfQw1ZWafRk0r+Ki/qs/ZFVIK5DUdp5nAzC6KTgtuRghqStz:LfQw1ZWaJkp5i0nTUCogqSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784544924, "uuid": "401ce969-d327-4a80-bb67-07106994f40d", "value": 242944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784544924, "uuid": "cb90547c-9c0f-4c43-bb5d-65d648f4e5ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784544924, "uuid": "ce3924b4-0680-4bd0-bcae-f1129df465b7", "value": "Notice%20from%20Tax%20Departmen.iso.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a6b794-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574637, "uuid": "5a456e73-e552-4bbd-b39e-d72f9c83a4b8", "comment": "Malware payload (Mirai)", "value": "5ad8d52e73acaa0f9c304eb7fb4fc8a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574637, "uuid": "633f28fd-2b34-428d-b9a4-8accc1a6a75a", "comment": "Malware payload (Mirai)", "value": "d6d3f9403a96a39ed50405fd6a20ec2397a351ca65c768ee9905afba8f318fc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574637, "uuid": "e9ff54bc-5621-4489-b2be-1c9b0b1d3fe3", "comment": "Malware payload (Mirai)", "value": "d83d432384906671ac42a775d65528670f44cc7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574637, "uuid": "26e51442-f040-4926-9446-a87390d01631", "comment": "Malware payload (Mirai)", "value": "c4e55f19e2845c866e2167cefc6e419687f7ac0a14d85c53365b016b6ebd0f34bafaed84accf6ffbabf66e26ece0935e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574637, "uuid": "8f066e60-9881-4346-9ebd-f8ee2cb4b18e", "value": "T1E6A3610B7F606EF7F82BDD3745E56B05248C741A21983B767A30E958FA0A24F45E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574637, "uuid": "7560f508-fa8e-448e-b479-4e7f55fded9e", "value": "1536:gbkrERTG7Mpi4Uvo+Ey3znU1jv8pHyfGYXsZoPMQodr3R:zrUTGGi4y9Ey3znUt/Xsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574637, "uuid": "bf9e2a4d-b7e4-4b3e-9d18-b91c46dcd62c", "value": 104920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574637, "uuid": "164f7f49-320f-4b1b-924f-64723a0dc259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574637, "uuid": "3e3911fa-db7d-41f5-8836-4f3d64833225", "value": "nullnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd458e84-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574658, "uuid": "a821f786-6246-4ab8-8c5a-103b643fd43f", "comment": "Malware payload (Mirai)", "value": "0521ae8287614c340a73307fb82e06e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574658, "uuid": "8bc6c408-f113-4723-9571-7a34222576b5", "comment": "Malware payload (Mirai)", "value": "d7095a429463d5b5934f6820d35f575300f635a7819bdf43a74ec9cff84e66fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574658, "uuid": "8323123c-b859-4eaf-9b37-ec3cfb7e12fc", "comment": "Malware payload (Mirai)", "value": "b8a6bc08563264ca67aff41865385faf4ee61a23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574658, "uuid": "2804f0fb-eb83-46c9-80bb-14c119b3a4fc", "comment": "Malware payload (Mirai)", "value": "759180fd2926d6452592cbe090b015072429a2e4313d5e43384672285d58394bfe332a98589dd824c5e4fdd4179d01ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574658, "uuid": "79c44828-052d-404d-8522-9cfe4a46b5f9", "value": "T16743F2B1364C6436C5490CB068FE6141E38B9BD9E5F722A0A0FCDA74B77218B7C7D929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574658, "uuid": "135ac0f5-1741-454b-8c58-c44670780667", "value": "1536:YQxgxPJhfVIz2FzQOQRgD3jEShEFENCD8vwfLpfp:Txg1JhdIzOQ1RgD34ShcSCD8veLpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574658, "uuid": "95e6231c-f1be-4a7c-802f-0e0d14a8f3a4", "value": 58892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574658, "uuid": "176a54a3-1fb6-4062-97e9-7057c0dc19e1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574658, "uuid": "6539e6a7-1fa4-48d8-a5c2-12dc46502d85", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd627caf-842e-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784547224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784547224, "uuid": "9fc67ec4-745f-4e2f-8e7e-ca95189166c7", "comment": "Malware payload (CoinMiner)", "value": "b40172c56ec9d3ab8cf49f16b64bd7ac", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784547224, "uuid": "b4db1a85-0213-45ad-b64b-5defa94974cd", "comment": "Malware payload (CoinMiner)", "value": "d7edbb3e6ef59d56861f4bd4e5be6fdf5a954c0fb745ef79289815832f4573c5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784547224, "uuid": "a36765f5-c4fb-4ffd-9c32-e0e1661ad139", "comment": "Malware payload (CoinMiner)", "value": "b0c2f947dafb494d6bb15eede1464d38767bb88e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784547224, "uuid": "e8de60f5-9de6-45d4-a1d3-1422d3191727", "comment": "Malware payload (CoinMiner)", "value": "ab466c10ad3265a4627313c30d6ad722d30f927b46043d8eaeefd2abbdac6d9329af88361f5c442e7febe42d074fe136", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784547224, "uuid": "4705791e-4fee-4435-b521-9f88bf89fe74", "value": "T18522292E7E450231E7A049B456B64A8F553D553363CBB3EBF333E54C0FA92498010EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784547224, "uuid": "5b3bb402-87ae-4ed3-b347-c7679c9a4d94", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784547224, "uuid": "0949e404-a546-48f9-94a1-a551feea0b92", "value": "192:EMBolW56BJx+e9vd2TdfPFJxTEZmFhSmcBs:EUoyawQ2RfPFwZxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784547224, "uuid": "c69b5242-40f6-4e21-a131-5ad7c60f5388", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784547224, "uuid": "922f031f-0b4e-4672-83cc-2a32ed4d78a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784547224, "uuid": "ef94a316-4970-4a93-860d-d37efb481101", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21dbe107-8435-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784549916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549916, "uuid": "6915878f-8fe4-4425-94d6-788d369c27f5", "comment": "Malware payload (Mirai)", "value": "5360ff788e8509076f522b4a62dc8686", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549916, "uuid": "e40e8161-2053-4fcf-849b-49cc39e2926b", "comment": "Malware payload (Mirai)", "value": "d83f3d3b1a09de298b3f62a480f6153342811ed4a367e1a2adf989388e12aaf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549916, "uuid": "ab9d182a-d4bb-4794-89f8-de51a2710032", "comment": "Malware payload (Mirai)", "value": "fe3dedb4db6770416e7ff5ee0fd408aed135ec1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549916, "uuid": "14b39916-9b9b-4b61-a59a-cc13933a4b1d", "comment": "Malware payload (Mirai)", "value": "02d5d2d841a0c0d24265108a1750add3510fb2749ea0272264554bde5a3ffdcce6c32c4b8a0eccb58708d9c44916d8a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549916, "uuid": "3328ac76-6183-4256-a002-74b71119d249", "value": "T182D32A59BC82DE12C6C2567BFE5F82CC372723A8E3EE7117DD155F25328B91A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549916, "uuid": "ffe67a0b-3696-42c6-826f-deded6b44ce5", "value": "3072:5nWcJ7M9RO7WqvTJwFieCbyl6t1ywdp7dKbnbj:NWcJ7S07Wktnj+K8wdhsnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784549916, "uuid": "58d20686-17dc-40bc-bf77-4416378e922d", "value": 136524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784549916, "uuid": "23749b1f-08a6-45da-9078-9859961f8738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549916, "uuid": "e06a27ef-ffca-4222-aae9-625eb4a212db", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1be450-83d3-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784507815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507815, "uuid": "26a65077-4ffb-4d68-81a1-d81112474173", "comment": "Malware payload (Mirai)", "value": "c87935d34c8fefd8c41da2d57cab535d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507815, "uuid": "a3eef8fe-1be4-44ef-a568-7478da33db47", "comment": "Malware payload (Mirai)", "value": "d8a8cea14b12aa75047979f929bdf10b9003884580398c3c13d2b4fb04209410", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507815, "uuid": "cbac2256-c838-40ef-9e1c-81df6e4bca26", "comment": "Malware payload (Mirai)", "value": "f2dae90dd8269af3942a69394a576b8f4a772334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507815, "uuid": "35b01d4b-e2f4-4ebb-801e-ccdbb88341a6", "comment": "Malware payload (Mirai)", "value": "14258f3b6a1be96b778e30dd1c13c5a2806298cd39a18bf2aa5550f1b1b05cad8f1fbeeebab063581f5f191038e348c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507815, "uuid": "2d4ea15c-0ae1-4f8f-8197-e7fa18671ac9", "value": "T199C3B70A3E218F6EF369C23447F78E25A75927D617E1C686D19CD5101F603CEA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507815, "uuid": "4d342e0f-c0f9-42e3-8729-5fbd686f31aa", "value": "3072:Jo9hmbzIWIj3KQc7mda1XijmYewRlqSO0:JoPmHIr6QraA9HlqSO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784507815, "uuid": "e1f4aa98-d16d-4d40-b9bb-d2fe28d1ea8e", "value": 121632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784507815, "uuid": "7bdb7110-fb33-48f3-935c-5ee416f305d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507815, "uuid": "fadd22cb-eaab-42e4-bc28-26b474d347e1", "value": "tmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e82104c-848a-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1784586605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784586605, "uuid": "f8d81845-f91b-41dd-ac59-6c15fa26a7d6", "comment": "Malware payload (NanoCore)", "value": "4357b7160b0765b1714a08aeb54c2dc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784586605, "uuid": "8c00a702-e1f9-4da0-82ec-182be32a58e1", "comment": "Malware payload (NanoCore)", "value": "d96fc5f700b931e47dee0b979f267ac803f02a6726a4cb6464daf7dd17bc17fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784586605, "uuid": "cb6dcbbe-34eb-424c-a842-d4503314787e", "comment": "Malware payload (NanoCore)", "value": "e2b2fbef3bd3eb79866be82629fb802542342120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784586605, "uuid": "a34b1085-f2e8-4b69-bc1f-db5caf361888", "comment": "Malware payload (NanoCore)", "value": "ad6a1908414411af48a06803147866ddca543fd2cc4ba014a0f619e831393e5904e4bedde435883bf6730583c8cfca90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784586605, "uuid": "8077294c-81f0-444d-84eb-c38a3967e20b", "value": "T11314CF267BF98A2FE2DE86B9611212028379C2E399C3F3DE18D455B35F267E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784586605, "uuid": "f5b178ad-57fa-485f-9aa7-71f4782c7758", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784586605, "uuid": "7a04b7c8-e616-4e01-85ea-ca35fc5651ca", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HINDP+1Nda82N+xdkv9iRLGeQLX:MLV6Bta6dtJmakIM54kAgNpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784586605, "uuid": "2366271c-262a-458e-8ec2-7ff09170a148", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784586605, "uuid": "aa4128f5-3f80-4360-aaa6-2980422269ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784586605, "uuid": "102f4a4f-bac5-4339-a9d4-46cda64af05a", "value": "4357b7160b0765b1714a08aeb54c2dc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47f7f51-83fd-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784526190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526190, "uuid": "749d3b3a-bb21-4288-8a91-6aa67dd639b6", "comment": "Malware payload (RemcosRAT)", "value": "38980bf417e0229a030c9c0a62daf889", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526190, "uuid": "24fb7ed3-785a-4b64-b888-642acd3a28df", "comment": "Malware payload (RemcosRAT)", "value": "d9a93a5a89a6ad4dabc9611fd379dc2e67f8e95dc1f88395acf22123985e6b87", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526190, "uuid": "3dc88a6a-f455-4eea-989d-a701086802c4", "comment": "Malware payload (RemcosRAT)", "value": "eb7c5eb4acccdd0f1c31c9b23c9bcab20ad0ab71", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526190, "uuid": "e29f5200-a8b5-40ed-a1bc-77ee754d25bc", "comment": "Malware payload (RemcosRAT)", "value": "bbdd8780b41ed0af9ab23a46d09d15b63e5d000a7f6d640d3200a0204250287f79e63aa9f8eb38401ce7ebcceff26c4d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784526190, "uuid": "d581e4a6-f850-4d59-b36c-ffe301d9d824", "value": "T1CF133E23AEC40D3B1D4742DEAA784B53C8B8C5194132BCACE5ED7B1E9403A58B77E319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784526190, "uuid": "cc24659c-6381-485a-b94c-35831b0ccc14", "value": "768:xQBd3JxBfW2gnSZoYo/4mR9AxBVnCOVsUIrwmZMk5Grhx79liJLQ:xQBdNePnS8pMxBxDIrw5rhHliZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784526190, "uuid": "b5fe297f-8ed4-422b-8ce6-ca811a923bd5", "value": 45536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784526190, "uuid": "c58bdd5f-ad6f-4443-9541-7a74c0d0c45f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784526190, "uuid": "29c80070-79f0-4df1-830e-fefd2b98e3bf", "value": "CITI-Payment-Swifft-0009488938839-PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8124cae1-843a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784552223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552223, "uuid": "c2291c31-ef4b-4b59-947e-c5295a64b875", "comment": "Malware payload", "value": "5b3509bd9def26fc9d0cea9a71f4ca18", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552223, "uuid": "fb671850-ba0f-4934-bf33-53e9f5e970b0", "comment": "Malware payload", "value": "d9baa884000876d55467fa48668b9892fcde73a654ea9a7bb329acd22e1afba5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552223, "uuid": "b0a69f37-8e8b-4be4-a774-caa0f393e9e5", "comment": "Malware payload", "value": "128409fcc3637f0ed7e4315d47bbc041202fe537", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552223, "uuid": "202e0b2d-9f95-4b51-a616-55e650767018", "comment": "Malware payload", "value": "23005f5fb7ef49a41af34fea8d08efe433ce1e6f982aaaa68f2b51764f50598c8f6912b8545cf1294799880e1bc36bbd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552223, "uuid": "cdc280f0-ecd2-4c03-b301-4b0f9524a9da", "value": "T1E4C27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552223, "uuid": "2455a0e5-296a-4707-bba8-4d78ac1e93c0", "value": "768:k68vCB+25j6es8RZ9FYpMSUpi+20qUpi+20YQX:k68l25J/d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784552223, "uuid": "a55b16d4-7219-400f-bd01-48b171939d14", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784552223, "uuid": "e8d04777-c865-4968-9f6e-4d8adebe38f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552223, "uuid": "3138b551-5d47-49d0-b216-e9a032c2b56e", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563c1e58-83e0-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784513496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784513496, "uuid": "cf7a509e-6caf-458c-b7ba-fae3f255afb4", "comment": "Malware payload", "value": "054a878b0602e90b03be851d84fca1fa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784513496, "uuid": "91d63754-e2b5-486c-92ad-d783ae743ce6", "comment": "Malware payload", "value": "da49d5a6abbb96438cd2daecd2643fb5f38122ce4d9cda6d072704e54c17d3ed", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784513496, "uuid": "bd48526a-38a2-4b77-87c0-9c5844c195c1", "comment": "Malware payload", "value": "d8f022c3628f7e33a173054793c81a302946aef2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784513496, "uuid": "ff1c8457-dc84-4242-bb13-2c7e65f735e9", "comment": "Malware payload", "value": "89dec56bf1d09ee2a581ebb5cbb50bae31c9c021507029ce19513c6df7f8ed45c8b2450d5a355d441ee5e6b20695ef16", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784513496, "uuid": "403763c2-8cd5-481d-aad9-f669877a8975", "value": "T109236D6516857C14AE99C4365C7F2F0CBDAD43E6314492DE7FCE3CF28C4A6AC920861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784513496, "uuid": "0d5126b0-0ffe-4309-b27f-f71055c28917", "value": "768:Sr9NyXsZztCBZ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:8HusZhcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784513496, "uuid": "43d22af3-55ee-4f67-88ff-4170b771624d", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784513496, "uuid": "bfed5037-e903-41f2-9f4e-262ed56fb637", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784513496, "uuid": "20c6c333-ee68-41f2-8596-ffda9a0b5d0c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7358621e-83fe-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784526430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526430, "uuid": "0f274fe4-560d-4de8-b427-3f76f89e6252", "comment": "Malware payload", "value": "ed70a797fe27c749b027aac25782185b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526430, "uuid": "c04f1750-9246-4d45-93b7-d2bc7c21395e", "comment": "Malware payload", "value": "db281eccea7165538fb5cceebd9fa9f338dd435cddba4c6bc00ad335fea29456", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526430, "uuid": "b4e19fa8-ee3e-4015-a62b-37d2a7289ea0", "comment": "Malware payload", "value": "f73f43b0b78dea3a7cbfe400c1d29c0de6b59f06", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526430, "uuid": "fb430110-f007-4b88-baff-f0a3688395ff", "comment": "Malware payload", "value": "47dbaab2e1dbc0e1dff50f4e5a120fae280487dc4ff5fc0a6267cf19bbbdda9f0528849330f2a8693d96a3af11813957", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784526430, "uuid": "99d96767-26cd-4410-97af-862953d39534", "value": "T1B72733AA6C262E83CA5126BB23521342AF311DB33B1187112D7DF92D1C7D1FA4B5D39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784526430, "uuid": "3e015601-c0cf-4233-976c-ea5333d48e9a", "value": "393216:xXc/HYS3glFQv87upC4GCAKUd2Cu3et11GSazIHiY:xSYpi06RA7dpIevCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784526430, "uuid": "a4a2069d-f86f-4091-9673-10d3e5c581ff", "value": 20365312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784526430, "uuid": "9e0f6811-a971-4ef2-8f33-84412fb0a915", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784526430, "uuid": "cc25c018-c860-4ca6-bb8e-48782d60141e", "value": "Setup_app.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e084e25a-843a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784552383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552383, "uuid": "1da5cb0d-fc0b-474b-93c0-8bb845f11faa", "comment": "Malware payload", "value": "af859b6ba2f4b4316b9afda3659d5d9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552383, "uuid": "8eeb46a9-62ba-4c0f-9461-c30effcd6040", "comment": "Malware payload", "value": "db6ab3a42131bb24be34abbde57bdc3e3b189b7e9801a3e4e30c7304367fd507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552383, "uuid": "22684c0d-adb2-4818-8a9c-df051918fe1a", "comment": "Malware payload", "value": "9e3838e5853c833ad923689f76606ab367bd85cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784552383, "uuid": "cc593fa5-70cf-452d-9ac1-f10eb94ee722", "comment": "Malware payload", "value": "5aea8254b07a35dc3ea0e9187b7882254fc68ee13019d7d6203b62f1d791a01a0c8bc2db53640c34cf2f1a3cd12e1a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552383, "uuid": "72b37e6e-4016-4c35-bb4a-a3f445e3bc42", "value": "T1185633EC3651BACDDDA3E4328DA51C60E6712EBF1317CB2B9613515AD85EDDACE000B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552383, "uuid": "3175ae54-fd48-4dd1-b0c0-7633f77c362b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552383, "uuid": "132e7a8f-d87d-4411-895a-3a06cd954a37", "value": "98304:+FWAf2wVDrS2Zm2e/yXwRYhTex8JZbBZ6mJy8TxijMkTMQKqp7U3Sk:gWO28RZmPyXweACdZFQ8TxV+HJgSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784552383, "uuid": "d2b74e9d-4a28-4514-9e00-0a72df5337c7", "value": 6251008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784552383, "uuid": "29fe3f8a-916b-45d1-9b73-170ee71874ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784552383, "uuid": "b77661be-adbc-4560-84e0-2cc6fe3031f4", "value": "conf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621ae32a-8434-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784549594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549594, "uuid": "062ca5f8-a663-48e8-b9bc-7932fd6ee04f", "comment": "Malware payload", "value": "0ec0bfda51eab6521a022bce2da61bde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549594, "uuid": "3377d70c-c1db-4e96-8c84-4dbae5a55fcf", "comment": "Malware payload", "value": "df0cc324b9b82c68eaf3650446bb8985a4143ceb2c2b19c269949175e84fd6fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549594, "uuid": "75b2b4b5-f7d7-4e6d-b364-954a4f5faf61", "comment": "Malware payload", "value": "839c4140523444faa1410a452a0cb372391d8bd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549594, "uuid": "78007d4f-aa00-4106-aa22-ec1f8467fe97", "comment": "Malware payload", "value": "0dadd1b9007858fdefb2bf37cf3955fe8eac7bf930a3f7df0a010e63013047b6797c75842215da45e4ee0df9f9126616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549594, "uuid": "17418456-2ed2-472b-bd71-a6aa4b2f6d07", "value": "T1FB060A01AB1E50B1522DD32CE276AF6855CD500330A8DF5C38BA9768F566E27B38D6F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549594, "uuid": "6c2e841a-0420-4e03-b3d8-e7fa6e51817c", "value": "98304:K8op0X18jdHPIjUUhB4gq650n4HZEirnSPQyYT:K8oOFYdHPIjb5qUZJrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784549594, "uuid": "c0f4d779-d5d3-47e7-a891-04f00d2451ec", "value": 3693881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784549594, "uuid": "f871dd98-ee90-4abe-be82-9ea8f001f201", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549594, "uuid": "e7c87295-f65a-45ed-b762-c1f3d79b241f", "value": "DHL Shipment Waybill No 005107085566.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805cb69d-840a-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784531606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531606, "uuid": "b2117050-c47a-49cc-862d-6be053d838c9", "comment": "Malware payload", "value": "b8b99cd18d8266292e1fea8442bb9278", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531606, "uuid": "f137596d-27c9-4ea0-91d5-69676874db68", "comment": "Malware payload", "value": "e02677a974156dcb7abc01062dfd71cc9a705360a5eb24805a708666c9d79d6d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531606, "uuid": "657eb063-9136-48a3-bd7d-5c349b4dd396", "comment": "Malware payload", "value": "fbe95e9fd654dec25cf2029d09defedfae3aff47", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531606, "uuid": "0b658c40-2ab6-4a3c-b051-7cf2e38b781d", "comment": "Malware payload", "value": "f658272f0bed07e9a14993161c1707b4384bc9fa88c471f635c25b7ba36e5dd312f7a53ff707239da78ad0bd7303ec41", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531606, "uuid": "79c30ed9-af7e-4ac9-a57e-14d0ce0cb245", "value": "T17865D43213CF3156A43679CE2B757010AB4DFB70096B64DEB147078E9995E8D8EB0BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531606, "uuid": "1347d0ab-c8af-499b-b11d-da5472fa3681", "value": "3072:jrmIk/hP5snaTyWZJVeXxtMxYMIjphLaZXXxcCn4OMcTzfZVwVRfdZRE2Tx+neA9:isn+bnVehwYDjWJDLA4nA4shLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531606, "uuid": "f444382a-efd9-467c-acdd-0c430be6eb1b", "value": 1531064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531606, "uuid": "45a3b8b5-2688-407e-be7e-5a3a081da01b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531606, "uuid": "429cd43a-984f-44ea-868a-ac209a060581", "value": "orden de compras____pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b821e59d-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574649, "uuid": "f7f21add-4b01-4e16-bc9c-c39df35f06e4", "comment": "Malware payload (Mirai)", "value": "354786fef6acc0d871f96c3df1095b03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574649, "uuid": "2396e4a5-85c1-4bb7-9944-1fd65fd47a07", "comment": "Malware payload (Mirai)", "value": "e0c6b4998e0c8c5e1a18f5af13c236809df2c7b281e8dba1038592c3e6e752f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574649, "uuid": "42722e90-a07b-46ee-b8b8-ad36c1dc94d2", "comment": "Malware payload (Mirai)", "value": "70e6b4925507759343029e720e9cd6f62c9c5138", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574649, "uuid": "a9a171aa-7725-4803-bdc1-a655321a40ca", "comment": "Malware payload (Mirai)", "value": "e81546b6e10e6dd1fd524bc4518b8cc6b6c554c8171cfdf59728f9dd99f14866ce25b58aa01aee1b4b7541ef8d0fc50a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574649, "uuid": "cf3c068e-9abb-4d2b-a5e7-495bd665b61d", "value": "T1B8E39EA49E0FAD83D2C3E3FEAD590FA7303734B44511D1F74D00A69DE59EED988A2522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574649, "uuid": "6c2b4aaa-53c5-4896-8b5d-04402e6c838b", "value": "3072:880lpByQgHdQWk2ZOEc4ps0PuNLFW3GCkqx8s6sKhRcLA:8fNjoQWAE5ps0mNLXCQsbKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574649, "uuid": "b2e02371-162b-47bc-98ac-4d1b0c3afb8d", "value": 153464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574649, "uuid": "e719d605-ad28-4707-9944-dfbbd8cb490a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574649, "uuid": "7d99cf2e-9777-4c94-9131-b0a209937ac6", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855bd302-83d4-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784508421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508421, "uuid": "ae5394ea-e8d1-42d8-988b-e97e9f6eec5c", "comment": "Malware payload", "value": "c33b6d076a762fdce6f982c00841feeb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508421, "uuid": "181a719c-37b7-49f1-80e4-d113d2b3422b", "comment": "Malware payload", "value": "e0e2e7ce1b38f04d6e20e22cb25915bdc4e1cc90f08e7114243ceadffa9e4a59", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508421, "uuid": "ac4ff434-561d-4245-970a-34ff6a0ffc5d", "comment": "Malware payload", "value": "f95ced71807acae9f84e03b71163d1c6e900d681", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784508421, "uuid": "4581c7dd-cac8-46d6-bc96-17e9af2d630a", "comment": "Malware payload", "value": "41b907a147e74d1087b2423bdbaebfb8a541c30046d815b698aa92ebcb7f5989ba5b79c949fa565b00921110fed2e7a1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508421, "uuid": "c1d2b960-486b-449c-8ed4-9b5efb1fccee", "value": "T116016BDA8640AD004019D95D229B5194B821D3CF1A8B4FB87F9C5D3EFB88814F06BFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508421, "uuid": "ce8ca45f-4b76-4fa2-bd6b-63ac9635843f", "value": "24:kXCKysE2hi0ziQvZohaSEDq/9aZD/PI7JmUwwFY7:e9Qp+MsSEK+3KZY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784508421, "uuid": "44f3c15c-b2a0-4b12-90b9-c6b09654fa21", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784508421, "uuid": "08ad906b-66e4-409b-99c6-ce5b17e8dfdb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784508421, "uuid": "9626301f-9e47-4b11-8d56-48dac488a2eb", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f73346-8470-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784575211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575211, "uuid": "44e22e81-7717-423b-8397-0d8f40e5ee83", "comment": "Malware payload (Mirai)", "value": "ea82bd83071b5bca3a41d96cdd8e3a64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575211, "uuid": "4c548087-d832-403e-ac51-16c00de4a0db", "comment": "Malware payload (Mirai)", "value": "e10229824df64c0d22d67af78f9be8649429cdc3858fc905aba4bb57a98acb3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575211, "uuid": "dac4f154-f5c7-4c90-8ffc-90e3d7324698", "comment": "Malware payload (Mirai)", "value": "5b53f67d338b7356134e404658d65c46db8ab52a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784575211, "uuid": "767711ce-a4b7-490b-b6c2-578a5252a6da", "comment": "Malware payload (Mirai)", "value": "fee2435fd5216863410aeab1651887f1da331aa773ddd395608065b0b5a18717ec3bfd587868dbc7e2cdc8f286e2e00a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784575211, "uuid": "d7ac2152-649b-47ed-9345-95dcac12ae9c", "value": "T14CD3AE97F74724A1C86302F40BCB4F9D2E6322829F5B98D77C6F2A7719760DB4906B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784575211, "uuid": "67ca3627-611a-40a0-85cd-90ba9516d967", "value": "3072:CQJsSSQvhYt3VV+Xt9Pb80NSTiBhluyngDcwq:CQLNmtL+Xw4acwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784575211, "uuid": "fd1de9f2-112c-4984-a866-b7decc47e91f", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784575211, "uuid": "dcc44f9c-d5d2-4ea2-be17-a4aa3c47ad6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784575211, "uuid": "fad71295-5664-47cd-bd4d-0516435dd219", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d82ae0-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784534251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534251, "uuid": "ec303ab6-b2ab-4048-93ab-f6afa71f771d", "comment": "Malware payload (njrat)", "value": "b3f9d748284ba06c5f74c062b11c6066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534251, "uuid": "0864d443-5740-479c-9633-874e9fb579a3", "comment": "Malware payload (njrat)", "value": "e16ea5b5892442616eb4b0d8e53a242e6532b77db42202d33b78ef9461745cc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534251, "uuid": "c4b74b7d-e5cd-4e6b-a05a-247e62334f48", "comment": "Malware payload (njrat)", "value": "74983470e89aea81c6f0de3a50616b5ddd1988fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534251, "uuid": "dc64324c-2446-4164-a1ba-7806646f3ee1", "comment": "Malware payload (njrat)", "value": "121e2879e7e22fa63c8c783a3479dbda3fb54c5d78b4bec74360db89c2930c776e994f1eef3477bed8f5e4799855b041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534251, "uuid": "37f03433-7308-4111-a053-70f9223d7cd4", "value": "T1F015F1086BACCE06C46E13B468A4D2780B799E19F511D3174ED8BEFFBD76B118C19287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534251, "uuid": "4890c04d-b79f-446d-aaa8-34f256ee3637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534251, "uuid": "c0bd0636-1065-4b90-b07b-5e552d575bca", "value": "12288:YLYkXA5P5q5wd4OhHXUTXHsGS7MdRI/aD0TgOAUnivKZxgmTBLzXMU3oF9LsDNZF:6Ap5nJHTnR/C0UOA16RI9LsDvV0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534251, "uuid": "ca53c248-b5e0-48ff-a46d-7c7d25ddf1c6", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534251, "uuid": "45b8390b-1c0a-458c-9363-ca4fda42d7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534251, "uuid": "1775da43-7968-438d-bfde-e2e456fed160", "value": "QUOTATION ZBS260624 - PO-Q260706 #TEPLESR00-1 TPL-ASN.PDF(865KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f714dd48-8406-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784530087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530087, "uuid": "b95cb951-179c-4e10-ab9c-f7d5e9c7d37e", "comment": "Malware payload", "value": "e402dff93735410ec72c80c1033c5267", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530087, "uuid": "545fcee6-a4b6-4932-b035-82355699a533", "comment": "Malware payload", "value": "e17faa631422da5dcae6d99e0bebee6925b8c091188ba95a0dec5e7ffa77793b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530087, "uuid": "8348442c-35ff-43b0-ac5c-62d20c02d62d", "comment": "Malware payload", "value": "2f20490be87aca6613afbf67ba2cdab9e2275ed9", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530087, "uuid": "2c1729f6-6847-4e72-a0ea-3b9b781a1f7d", "comment": "Malware payload", "value": "44cd94df3b1e1478be8a500b672679fc8118fa70d727ff9163a8f09311862ad82dc88b24e692e88e8a279e42641f54c9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530087, "uuid": "fc3c156b-cae0-41ef-aa53-a35ee34b1ad9", "value": "T1CBF04C5208162501CA358679CB4D43A5DD8AD3C0FD1230813F74C5C5300A1E3B79F4CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530087, "uuid": "4509e31e-d633-432a-ab9f-7df9b1987f50", "value": "12:pM2muRyCp0CgKCU81k7G3apw5JV8aiOX81k1ViYMVwbskwq88ibn:q2JRy/PKJi3apw5fiOX13D43q88Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530087, "uuid": "5e2db0ad-99c3-4b5a-af59-8b8cce861a0b", "value": 549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530087, "uuid": "20cfa57d-eec3-4127-a969-3f6e462df1c3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530087, "uuid": "52d97960-75b8-488d-aeb7-2df38f46a4b8", "value": "run.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29cf6eb-8483-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784583632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784583632, "uuid": "0a37ea58-9007-4367-9bba-7689ed9d7b7c", "comment": "Malware payload", "value": "0dfa5975722cad801460d770cea685ca", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784583632, "uuid": "50d55869-ca7b-41e4-bbad-5dc19b5297fb", "comment": "Malware payload", "value": "e1f122c6154e1ec48b09f423d59b2f007751bb70f83fb37967d8263526045358", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784583632, "uuid": "5e916206-f3c1-4ff8-987d-33e3f60e09d2", "comment": "Malware payload", "value": "de6b9d9790a493b3d69f694281fd368ce8e73931", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784583632, "uuid": "7f20445b-147f-4c6a-a5ca-28b9874c0203", "comment": "Malware payload", "value": "eda4c0a921a1bdbd17405ad22cce1e8dfebad6692d64c7a2dcdf4a4eb38b323aecc2203f58b69b92586ab4c2f4141dbb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784583632, "uuid": "f43d3a4c-11ef-4d12-b032-a0e72ac7d24c", "value": "T1E9235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6ADD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784583632, "uuid": "b6f1ac30-7351-47f7-bb00-c1f017186502", "value": "768:++39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:++Acr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784583632, "uuid": "cf389f5b-8e6c-4458-bce3-84b6fa85f8c5", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784583632, "uuid": "1dfa0bbe-8865-4923-8842-c5ec7e927206", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784583632, "uuid": "0c1388e1-e4fe-4ab3-85b5-5a286ab051c1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02be0e2c-8407-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784530107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530107, "uuid": "241a58b8-651f-4b9d-823a-1d13fa467103", "comment": "Malware payload", "value": "355d1a0202c0b92390a84d53ca1fb2fe", "object_relation": "md5", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530107, "uuid": "d72a6607-36f2-4694-b810-ffd9660c0ea4", "comment": "Malware payload", "value": "e22d5731da82b2583a5b79112eddfefe2577f96103e89e4a1cc883d30a0cc5fc", "object_relation": "sha256", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530107, "uuid": "386a6e65-4e95-49fb-a40e-039ae72dea26", "comment": "Malware payload", "value": "8b9e0b4facfb2071cb4d4d6ca8b45f9a1cc4d8ef", "object_relation": "sha1", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784530107, "uuid": "1ada0ae5-6483-4b07-a4ec-a4a813ff44dc", "comment": "Malware payload", "value": "24ff74ce3cde74e4447c3fa89ef1edcd309e4d3a4b4e8cb2386ab61481f9dd859ced2610d67a5c5675cac99601ab3877", "object_relation": "sha3-384", "Tag": [ { "name": "bitbrarwser-com", "colour": "#6697B3", "exportable": true, "hide_tag": false }, { "name": "www-ndiewh-com", "colour": "#586E94", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530107, "uuid": "d45a6532-dbc1-40a2-830a-6a79842a6e67", "value": "T1AD142361F3A71B243A5FA36A2FD13058A781D83113BA8EEB37C520FB54055E23FA4817", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530107, "uuid": "b095f11b-f705-4019-8898-c0de299356d6", "value": "6144:zHtsBWrG2LY+ix5n9VbDZ0lBSqlXcKX/it7P0:TYWrGCY1DEcKPit7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784530107, "uuid": "297991ad-e688-44c6-a04c-22ec8364cb55", "value": 204598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784530107, "uuid": "7aacb8d1-559e-4f02-b437-bd47e6243fe2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784530107, "uuid": "597231ec-53fe-480c-8b56-81840d6986b3", "value": "Hello_World_ver331_5_x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4501d5-845e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1784567868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784567868, "uuid": "bfb526d6-6d7a-4a71-92a1-5c131c8864eb", "comment": "Malware payload (Phorpiex)", "value": "91931cc7a3ca8f7ee16df00dfd9753d8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784567868, "uuid": "1f8e0f9e-164e-4f1f-b186-2bc1a1c31c55", "comment": "Malware payload (Phorpiex)", "value": "e3556790c7b8f21611dff494bdfb52c3eea4a0ebf5f28b5c5c6b810bf949414f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784567868, "uuid": "d3c0b8c2-394c-4ab6-9d77-51915f3bf0e9", "comment": "Malware payload (Phorpiex)", "value": "09029d7f4c3803073e3d04ce245682c52091c1fd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784567868, "uuid": "d755a46e-4bc9-48da-b11a-604d6d6b8529", "comment": "Malware payload (Phorpiex)", "value": "5617ee8187a56f8df5739f81ee8e531a2f44eb6cc1aa53e0ab02bc2ea3f2fdb4082a2c63e883879f12abaf407907726b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784567868, "uuid": "c8bc62bd-34dd-4aa7-a4d1-0d095b3d8782", "value": "T1B4824A0FB9424726C5E11074A275877BDAB9A8B2338814EBF7D089A90B786D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784567868, "uuid": "7ae59aa3-7501-4792-ae35-314584d9e9cf", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784567868, "uuid": "39e40576-d607-45ab-938f-30973906208a", "value": "384:iIqQVVaFYFKUygZu94gNTcNQav8U9c2rF:ItUyV9da0UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784567868, "uuid": "738d065f-7635-4298-bbcb-32e6b4dc8e96", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784567868, "uuid": "6af9ff51-a5d6-4f6d-8496-5eda1a1769b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784567868, "uuid": "604f27e5-fbce-4d37-99cc-b6aa470f13a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dae9056-8496-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784591624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591624, "uuid": "7ce307b6-b94b-4e59-b4a7-f31a10af9869", "comment": "Malware payload (Mirai)", "value": "aa7fe519d1900f92b47ac8ce8db0769a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591624, "uuid": "8a103972-17ad-4d6e-ba95-e8b53bbda08f", "comment": "Malware payload (Mirai)", "value": "e3950c8a20d06ad26ea0b0b9662479bab92ff2459a92eccf80e9546b10da793a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591624, "uuid": "c3c78c80-1dc6-463d-b6ee-7f3d105073b3", "comment": "Malware payload (Mirai)", "value": "12c893fc5106919d4da767aa1b08dfee98ac0723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591624, "uuid": "6cd690a3-35b8-43e6-bf9b-034849cd5455", "comment": "Malware payload (Mirai)", "value": "1718b185fe4b12ae62a538a9fe0b542d806572111069475cbde287d6f4a146c2b4f7c722200c79ec97750fcaba3dd48f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591624, "uuid": "cc07c942-f406-4016-b99e-41531bf9810d", "value": "T1BEA3C91E6E218FBDF769C33047B78E21A79833D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591624, "uuid": "d8f130e3-abd4-4f1f-975d-5e2c0aaca5ce", "value": "1536:Gk8NZJjWAaRmkGMvAbNVF1F5pzePQvl9Leq8kwmlas/wdo:CZJjBaRmvBwPyl9Zluo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784591624, "uuid": "8a4efa60-b891-42cc-8570-9eca2262a4c8", "value": 97832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784591624, "uuid": "2770a9a0-7fdc-4e40-8242-c77394ee4293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591624, "uuid": "bec693a3-5f0c-4c99-ae42-99a852ef1588", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869a8e26-8414-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784535911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535911, "uuid": "3af0a907-006a-43e4-9ef6-0857b51def43", "comment": "Malware payload", "value": "5c31872c30af2135aed943d4f9296a6e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535911, "uuid": "79ffd77d-70b8-42fb-badf-67ab75b35b01", "comment": "Malware payload", "value": "e3fd36c9bb894f174b11d785e5b000d82ead1e303feff9b0df5697fe764d6b68", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535911, "uuid": "71d9a525-c15d-4562-a70a-dde4d8ef3a1a", "comment": "Malware payload", "value": "44541244a86d4311f9b2c966282c92b67f572d82", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784535911, "uuid": "60e31b8d-294f-464f-9de4-7b6d7eb7bb9e", "comment": "Malware payload", "value": "1e33317a7ed7f8dccbd05b2cf39d343e2f1484c68b5f1757b14e77b171842c433708e2db055b4daff41ea672e47dc357", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535911, "uuid": "c5a80183-09ed-48d1-807e-b6fbd513ab4f", "value": "T1B33533E3113BEE1BD94319F7CCB5B8DF8A71E6BD6081450AB4BBB1C643B28C41A4651E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535911, "uuid": "2c6b99f6-e223-4a53-92f9-e9b00bb7215c", "value": "24576:UhiI1V8+Mtpi+FElnxSp3LgMGMag7RDcLIaocTM:kii8+Q3dxq87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784535911, "uuid": "b1ae3dd2-bb3b-4940-97e2-34267e010fd7", "value": 1095944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784535911, "uuid": "f0dc65de-88af-4717-98fb-96ad77e56d2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784535911, "uuid": "99101117-f0a7-41ed-9f24-f9a92b93face", "value": "cache", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951fefe5-844a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784559128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784559128, "uuid": "cf81750b-0786-4c0c-8d13-5a63a754590e", "comment": "Malware payload (Efimer)", "value": "28f9b094bc04d85b8338013f3f64ee2a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784559128, "uuid": "de327387-30a0-491b-8bd7-c46cf72084a7", "comment": "Malware payload (Efimer)", "value": "e471b7a12992dc0d44743f6aff67fd96dd30d045399143b8c8e4042653748326", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784559128, "uuid": "4e0c44b6-ba18-4844-9f99-8ddf4d5b78cf", "comment": "Malware payload (Efimer)", "value": "0884ca68703f930b84520862bb7d6df84faf406a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784559128, "uuid": "19a351d2-7c77-4dee-99c2-44f619aa9d35", "comment": "Malware payload (Efimer)", "value": "586c58d2a9bf2906d64522fb8d11c75ff0e63cb44da8820b4bef54fcb7621f72fe2355f12e4c093e0b5461df7be616ff", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784559128, "uuid": "cf327023-beda-4fa9-895a-629f5a89e45e", "value": "T150E633A822E013FAD973A03EBDE24251E679786907B3C5DF578402E26E231D04D79BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784559128, "uuid": "83a0f34b-82ca-4a3b-b81f-001279800782", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784559128, "uuid": "8d87c72c-9ee5-4312-9148-053259ac1adb", "value": "393216:+bWtxb00Ob15DEINNlNlXMCHWUjXrcuI3/PGTAI:iebfOxZEklNlXMb8XIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784559128, "uuid": "351932af-aa83-4a1f-ae0f-90e549f8e264", "value": 14233936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784559128, "uuid": "52ece94b-b942-4c78-93e7-c31e982ed192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784559128, "uuid": "f5ecb1b0-4e97-4d1c-b89a-d98daad52530", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7da0cd9-8402-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784528236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528236, "uuid": "e30a8731-6e61-4678-a22b-f67fa732af86", "comment": "Malware payload", "value": "4127d1d27efbe766fab22a51b47a2291", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528236, "uuid": "9e75deed-7408-4242-b1c2-5389962203f5", "comment": "Malware payload", "value": "e5597c19f2a8a7c1ee77801a26b2da4611064e97416b5645f2f0ddecf6c3652a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528236, "uuid": "82992bd2-cabe-404c-91f3-2421814ecabf", "comment": "Malware payload", "value": "d3f8442cb21efda71d96686dff1ac810d4c8c1fd", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784528236, "uuid": "7c40c466-8fc2-40fe-8943-f71a9069edfc", "comment": "Malware payload", "value": "4b2512ffbab13a0ea8afe3185bac525de3fca1d95c7c23ba02a8d5726d6914502a4a24e78d8b510ca6623cd54847828d", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528236, "uuid": "1edfcb57-e1ee-4405-9697-1bd0d254b766", "value": "T169E42246B5EDFF63D6A362B08CCC80DE156DFD725FA6D627B600730F40342E6A90A259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528236, "uuid": "99d6a8fd-f9d4-416c-b404-adcc06d53ffd", "value": "12288:4qGfwI82fIh55TEYeSYCN0WMdcj1dOhw8NQElgdnfzywRs8si:QfwI/QZXPUcj1Yhw8KESbDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784528236, "uuid": "8bf9f421-0077-4953-9a43-108b5d144913", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784528236, "uuid": "6bf2001e-9f0e-4631-9316-bb6e3eff3914", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784528236, "uuid": "6e1b1f7f-654d-4fb7-b70f-9b6908eb1825", "value": "New PO0032939384_Specifications.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4322b2fe-8417-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784537087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537087, "uuid": "038649d4-820a-4130-bab9-fc56935a6df5", "comment": "Malware payload (AgentTesla)", "value": "a757a8b09d99acc2835fd0d26541e46c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537087, "uuid": "387b9a05-b079-4d02-ab3a-9603c55ec481", "comment": "Malware payload (AgentTesla)", "value": "e6290924b6e7a434776239ae19e79b02e88c3a6bef1b0e1d61041cc4176dec6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537087, "uuid": "dac48662-e4a6-4da9-afbf-6814a998b4fe", "comment": "Malware payload (AgentTesla)", "value": "ea9efc587962f4a1286aa26d274354039472d436", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537087, "uuid": "af042007-82dd-4f3e-b7b3-5d44b5781b57", "comment": "Malware payload (AgentTesla)", "value": "f2cf2fbbbc5a6e38dc96a103e4d240a5ad3e72583b393f87ffedfe8e071d1d0d3e351a02530a7f33c9b98d4f61d7e23c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784537087, "uuid": "1488880b-37ad-4c63-b74c-a740b49c5e5a", "value": "T15C45F152769DAA0AF93603F2381BE1310761BF6C3418E30E5ED67EDBB8E4715186A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784537087, "uuid": "18cb69b9-597c-45e0-a2dc-3e195c8985de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784537087, "uuid": "ab150089-4a01-4d68-a5a6-5061d478d863", "value": "24576:fu8j/Og3mZmhSg2XtKOm6Us1jpNPToW2+clSgSblOmf6:fBP2YWhvPToWASblOmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784537087, "uuid": "1f046596-9d93-483d-9845-abad2a264466", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784537087, "uuid": "b5402221-1c94-4122-8b5b-0fac6a98be94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784537087, "uuid": "140ee64e-854d-4549-849e-577fd50b8fd9", "value": "Invoice 19365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996832b2-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574598, "uuid": "82fe4796-9d80-4f5d-bf48-ac483cce8244", "comment": "Malware payload (Mirai)", "value": "26cff5646e2d8bb427a372bf58e06c02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574598, "uuid": "a1e82ef0-56d4-41f3-b7fc-41d4501d925c", "comment": "Malware payload (Mirai)", "value": "e683c5a347b7d050332d69dfe349654df129496e442ef33ee19d66555db0cab3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574598, "uuid": "70f341c2-5767-44c1-9134-cd80758fe18c", "comment": "Malware payload (Mirai)", "value": "eb88523da6e9a214adfde12de258a1c8aede9837", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574598, "uuid": "6ab2f174-196b-431b-90a9-a7b630bed868", "comment": "Malware payload (Mirai)", "value": "f4628093ad78c1fe5a17b83b15aac7dc5fdeee129bdf9497e3fd141911f69285b45e11b726de7204e5fc42b969aaad35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574598, "uuid": "5d1db96b-52cf-4ee3-bc72-711137e58424", "value": "T1DFA39E32D81A2998C05A45B465F4CE362B33E6807A631FF715EBC776A083E99F405BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574598, "uuid": "a506ff8a-8a7d-4ebe-b9ea-6e449e8030ca", "value": "1536:n/O0rAuENbCKGqwrayzUaHUKF7N77/1nouhCKXpbg50Gio:nm0rxYirxzUaHbFJBnouhplI0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574598, "uuid": "cf437438-776e-4f73-843e-2f9020355ed3", "value": 99876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574598, "uuid": "1d2cd7b3-c183-4e97-8793-b4ed59b231ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574598, "uuid": "3e27126b-dbfe-4f17-bd16-c66a31a9f687", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babc93f5-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574653, "uuid": "96aa286e-120a-4115-8608-378a7eec39d9", "comment": "Malware payload (Mirai)", "value": "7d633518480ecbbf529e76750274554b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574653, "uuid": "27dcc6dc-5600-42f1-9e20-f7f63e94b9bb", "comment": "Malware payload (Mirai)", "value": "e6bd4b63a777359c073ed7fbe804371323ed6ce826af601f44c4061622856e34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574653, "uuid": "39475718-c323-473c-8baa-e79ecab4e25a", "comment": "Malware payload (Mirai)", "value": "19fd2dd8cc6e054e66e90a607f5f75fac5f84f53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574653, "uuid": "5c0d878a-fe0f-48d8-9229-48e1a81a66ca", "comment": "Malware payload (Mirai)", "value": "ee8e343322c91bf32c2d6c89784c20366dbe2825384529e067335d4c4a3574304e0d46d9d5656ab92b3b48ae3889d486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574653, "uuid": "052df4fb-ebd1-49dc-afa9-15e961c09094", "value": "T12AB36D21B43D1E3BC5E0657B12F34726B1F657C910A8DA5E7E720E8EBF211502A07AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574653, "uuid": "52fb80a2-2e78-4099-a4f3-ff4e2487583b", "value": "1536:VXHucL7qmMHdNS9+DfMMpR7ogT90LHap60nfeaOtnaBYm5zbBW2RtaMZsk:IIMHy3TGnWZRYYOPkMZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574653, "uuid": "611a6699-4ca3-4d2e-af4e-6375c3876ec8", "value": 111208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574653, "uuid": "9acfb0cc-11f0-424c-a4a7-aaa6af2c3b21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574653, "uuid": "df13ee00-6bf6-4cc0-aca1-3e02b29c7cb4", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd1350e-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574628, "uuid": "7e432dff-fc79-4197-89d2-fa1eb35e0a30", "comment": "Malware payload (Mirai)", "value": "f7d2032db8c0051a41008fd83c5ca318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574628, "uuid": "8bc7ccea-ad69-4686-8a38-7e534b79854b", "comment": "Malware payload (Mirai)", "value": "e6c55915ef40d42bfbb8e0436e2fe5addb647800dc5a5ca4b32288f1ca08a7e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574628, "uuid": "a02dc05c-a9e4-43fe-9b4f-1bbdceedc03a", "comment": "Malware payload (Mirai)", "value": "8da6d4af0c4d74ea4f515f2a4dc8dbd997711ebe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574628, "uuid": "809c2efd-2b54-46ba-ab27-d1bf8d02c8f7", "comment": "Malware payload (Mirai)", "value": "17380b63165df011757104502882890958dd38faeb2e9b7fba4c075774fe8edb6fda4176a626318dbbce10bd516042df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574628, "uuid": "c17b9bc8-307c-465a-a8a8-b9b9432e73aa", "value": "T1E3530A82AA13EDB2CC1230B816974765CA35F9723C727947F7A93EB1E8466C1D90339D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574628, "uuid": "9c29e7f1-472b-41b1-80b0-90bc78f65041", "value": "1536:u17bNHs0TwUZYMdK+PrTigI+8A3ylgaKEigqjnGcC3U+Qf:yHsKwqw0r9AlgaKdgUGc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574628, "uuid": "4d925d18-4e5f-4730-a960-1bee869a8388", "value": 65756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574628, "uuid": "77c5d9dc-5d59-4b75-b8f0-5eb892d8ba5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574628, "uuid": "30377eac-d5d9-4f1d-a2f6-0c17854477fb", "value": "nullnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba85f47-846f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574789, "uuid": "9895db52-eb98-4fad-903e-90a2bfc4b4e5", "comment": "Malware payload (Mirai)", "value": "9e260c74e8ee5a213abbab2edc21a65a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574789, "uuid": "cf7f0ea0-8634-48bd-b819-1eefefe23f39", "comment": "Malware payload (Mirai)", "value": "e706cc6ce9f500e179b0cdebca1f60462591f4d67a54cc785c2217d3665100fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574789, "uuid": "93ff774d-7bf1-491b-a745-5a705e3fa816", "comment": "Malware payload (Mirai)", "value": "8d8a3b44a2f13c366011942bffa6af4e9a50d177", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574789, "uuid": "7c0685f1-e193-49e8-98be-47ad66de2893", "comment": "Malware payload (Mirai)", "value": "bec60ba476f15aa086c641175628a4f3698c6644b7155d5155d9ec4ae8500e0a89763cba5c1088475af7daea483aac3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574789, "uuid": "f1952af9-ffa2-4a68-8536-91a766b1d98d", "value": "T11823F2112BB62FE5A2201C32CD8ACE5BE7F24DF99DFBF0411615878066E45CDA5BA313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574789, "uuid": "f8c7bf0f-b96d-457a-9bdc-92096a9209f6", "value": "768:uXhkmzAEmsQHjPG2HZ7/QhejrHSzJXNUtXi0ElyhXH6lFDApJEQVi7Is3Uozc:uR8THTRHRrjrHSzFR0ElEaD0AQoRzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574789, "uuid": "c4d00f4a-dfc5-411c-8a22-4aad602ae863", "value": 46888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574789, "uuid": "d6f08941-32d4-401e-8004-fce2fb17a2d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574789, "uuid": "e8a7092c-01cd-428a-a486-9949235cbe1a", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf76bb4-840f-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784533853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533853, "uuid": "d3665c43-eb32-4dae-aeb4-c2528a9febc3", "comment": "Malware payload (AgentTesla)", "value": "21edc8839da40e71e2003013db5ceef6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533853, "uuid": "fa915edb-c176-4f31-b6af-98a0f3768292", "comment": "Malware payload (AgentTesla)", "value": "e71e1bcc0bd45ce8fa03241971c1847b1b19b223b20b167e11f35df520e1d403", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533853, "uuid": "5b8ff2b1-6f3b-4dac-975f-ad194b5129ed", "comment": "Malware payload (AgentTesla)", "value": "4e9e132fe20804d89d300087fa565a7b3302557a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533853, "uuid": "83575a84-bb2a-4040-8231-dcd74100255f", "comment": "Malware payload (AgentTesla)", "value": "daf138a17b4f09fe8476d86687637281f2b1ebab0c3951ff1ba3632f3aa4d51efbbb72aac6bdf6b3893f1f42d7007ee6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533853, "uuid": "dd2e3978-3870-48be-9008-28b768b4b359", "value": "T1B0052309F9D5BE57D263A2B09CD5838C5118FC432E0BEA2B6DA1335D543A0BCB6C752B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533853, "uuid": "2421bdd7-b82f-49c0-829c-71ff6c5af50e", "value": "12288:DxgRAPXRC5Ih55TEYU+79QG0tGT3N0WDsE/o4iNJoQ3xurptkvBoVMyqCCt4gKV:1gRA/EyAludP4EgNNJTAp4BoVfX/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533853, "uuid": "c3f49a61-5c3f-4976-b142-9c9253dc3403", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533853, "uuid": "c0e100aa-40cd-4d46-8683-9e54c457c979", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533853, "uuid": "a33b7936-613a-40e4-a98d-b54e5e6bf8eb", "value": "SWIFT0073941_Return_Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145fe467-840a-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784531425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531425, "uuid": "7f0ebaaf-50b5-439d-b51e-2be1ee35e60a", "comment": "Malware payload (AgentTesla)", "value": "93c49fba767285eb8823109004319aa8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531425, "uuid": "444a610a-8c06-4204-90ac-573480f11eca", "comment": "Malware payload (AgentTesla)", "value": "e74ab444591fded2b8ed58550a089913d2faccc628745b86f70901dea8b4d0f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531425, "uuid": "32ab1a12-bb03-44aa-8672-283eba1f401d", "comment": "Malware payload (AgentTesla)", "value": "f9887715b750d287db9eb4660f3565aa4e23f9dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531425, "uuid": "a02444bb-2c39-45dd-96d4-e7df70c38a72", "comment": "Malware payload (AgentTesla)", "value": "f7259d2a10e203688ec91b9485db60714da5bb9c71596842af763352e819366b38ebba92d145171095614f71d21b9397", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531425, "uuid": "276eec37-f86f-4141-a6ac-47a111f87023", "value": "T1C094734523C4EC9447CB5B3B3B2BB5DAF86A0CDC76548849F244FC91F4A8706E9D2A39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531425, "uuid": "89a853ba-daa2-4dfa-abfd-5bfd603de7af", "value": "6144:swK0ZJrDUxaiJNkqHXhnRznP+pK4DIK6IMNtSrZis2o8Mmh+xT:O2DUxpJdzaK4EDIAta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531425, "uuid": "977d0144-0f92-4bb3-af3b-4d7c0594f349", "value": 442654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531425, "uuid": "3cac9c26-7dd0-4bee-a94c-842e3bbb15a6", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531425, "uuid": "d3f05990-9f92-4430-98bc-5340dfcebdc1", "value": "Comprobante de pago.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a940ab-842f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1784547556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784547556, "uuid": "7c548875-5582-4c16-b213-5a77d231acbd", "comment": "Malware payload (Phorpiex)", "value": "2652d563c690f145fabcb5c69e608358", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784547556, "uuid": "17da94a0-24b3-4d57-a5e7-6a704aa90c39", "comment": "Malware payload (Phorpiex)", "value": "e782d8798869aaa480b27689ee49ace9ddcbfc48aa2de4a6dc618aea67716a7a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784547556, "uuid": "c4cd3e9b-1861-4c3e-97e1-b27845ae2888", "comment": "Malware payload (Phorpiex)", "value": "bdd8fdaab69b2ad05f9632a466f11027260d4d04", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784547556, "uuid": "3e2052ac-0d4b-40f8-8a2d-fbcfebf162e8", "comment": "Malware payload (Phorpiex)", "value": "3531d99cd662a796e35c2f9f1d97183fe185f4f83618ae38c5f2e855a37ff2314717782ccb7ba2f20783e2f881d259fb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784547556, "uuid": "d10c644e-cf5d-4cf7-9834-ee66d66b5878", "value": "T14A825B0FB9424726C0E100B49676867BDA78687233C854DBF7944AED0A686D2FC3365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784547556, "uuid": "de3444cd-ac7b-409b-bf02-c613a65188ca", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784547556, "uuid": "237887b7-9723-4b77-9244-c9352f1cecdb", "value": "192:EaISCngTBvqQ1jV6lXwIXZ5qF4le6qo/fKUSiu9zw+gj5tBOgbOBqmEdBTFWEo/M:kIqQlV6lOF40uu9JgFtfUqXav8U9cvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784547556, "uuid": "33509b99-9964-46f8-a2a7-711e05ac7679", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784547556, "uuid": "cdf90cdd-9e85-4288-8281-a444a5ccdf27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784547556, "uuid": "2d58c384-38a1-4e17-9893-376dcf9761cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849f2f4e-83d7-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509709, "uuid": "f670d34c-952b-4d7d-bc5c-1517bc891df3", "comment": "Malware payload (Mirai)", "value": "1b63faef998f2b9c03e5be0e5f5b1de7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509709, "uuid": "3b6c5bce-112a-4651-a5a6-0632693cd5bc", "comment": "Malware payload (Mirai)", "value": "e7889354c0d2cce6cc0c6a34ec13afd79bf361388e76ed2b3b987e0613d9c6a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509709, "uuid": "be772b4f-17f1-4c87-96b4-1ab362408532", "comment": "Malware payload (Mirai)", "value": "d8b49ec3c5f2bcd30a0a9452456a56cb8df34e58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509709, "uuid": "909e995d-a0eb-4118-8478-5519a11ada18", "comment": "Malware payload (Mirai)", "value": "eeafcad8ab2669e5da786e6708a51e6cc82ddfb98fbdc145013328323a01a649146953c49f5d9e74ee533787dd0367e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509709, "uuid": "f4fc00c4-bd48-4ecc-bc0e-4e26b8cce5d8", "value": "T1DDD3D70E6E715F7CFBA8C23447B39B25A788639637E1C585E19CD6012E7038E681FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509709, "uuid": "a8e87946-b77c-4edc-9e94-6ae3669ed2d6", "value": "3072:iuXLQcSHo038hz7OKuXGo/icO47xQw/vah:McSI0Mhz7OKuXl1z71/vah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509709, "uuid": "1d0dc1ec-745a-4ece-bf74-bb9215fa1a46", "value": 140328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509709, "uuid": "f3618f75-5fc0-40d4-9960-1e773589b207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509709, "uuid": "4ec52ae8-b690-4998-9c0c-4433b5a051c4", "value": "ohshit.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c224d607-8452-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784562640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562640, "uuid": "3ebe7152-69b2-4dee-a0e1-d1a6d0d9b94e", "comment": "Malware payload (Mirai)", "value": "f803716b92eece4d609a35b10d3a4e3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562640, "uuid": "cfb6eca2-282f-4975-a34a-8584d465d64f", "comment": "Malware payload (Mirai)", "value": "e88bf785ff3ee84df31a16ce5b6f9ecfc38cce7e5c01bdfb2dcdca21f33dbbf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562640, "uuid": "a01c6ad8-07c8-483b-b85a-7e87a100d133", "comment": "Malware payload (Mirai)", "value": "4567e1ec732920e5a03e12770bf7dd994675b8da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784562640, "uuid": "cc4653a1-1523-4d20-b491-2f5c4131070e", "comment": "Malware payload (Mirai)", "value": "784268dc1c6be7d62513aa116e625bbf1aa54640983664cb436011e1d5704e42e806409d5ae9c7939dcaa4322ed541e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784562640, "uuid": "f24c0d5c-1509-4fb1-9dd9-870faf89cb90", "value": "T1EA83022282A89EC3ED02BD799473CD13B0D9170B7FE86F64B3E82062EC655A6411965F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784562640, "uuid": "ab51ada8-f83f-4870-a60d-a82d5e1ca601", "value": "1536:HpxQVPWuBrGm8zlR0VqLZQQF2FLaVavXOPPCHZM4k9RitMip2i0C:Ul00VCZQmoLI6rk9UMit0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784562640, "uuid": "371add41-2570-431d-8cfb-8ac92a90ae13", "value": 85496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784562640, "uuid": "a00d8502-8f70-4e7a-a6f8-81b2c04e1825", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784562640, "uuid": "9bf974d5-19b9-4b63-8001-a9493db7df29", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a06220-83da-11f1-be1e-42010a9c0009", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1784511047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511047, "uuid": "9a7b9167-5cee-4357-ba54-48eb9f96edfe", "comment": "Malware payload (MaskGramStealer)", "value": "d60750568e3e66fbf3eaf27daf14df83", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511047, "uuid": "53197d32-9e21-4df2-889c-1559a6a6a61b", "comment": "Malware payload (MaskGramStealer)", "value": "e8c73ce5eb660ea6570b5bf5f560eaf994394da02148f7df10aefac1fda8a756", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511047, "uuid": "5c8eb9d9-b2ee-418a-945a-46b48793f1b4", "comment": "Malware payload (MaskGramStealer)", "value": "904a17f3cf30e965029aa8ead1350e4cbab70f2c", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784511047, "uuid": "e1d74c83-a0f3-47f9-a819-aa88d73867df", "comment": "Malware payload (MaskGramStealer)", "value": "260dce514cdde0da1f59b3771d7642f8f5c4a6c0ad62dbbec7985eae6053dba41eefe85f005026bfbd38c765160751f4", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511047, "uuid": "487557b0-4d99-4fcf-bc29-d07fdc3c458d", "value": "T151144B1BD4D540E9EC1AC6788A59E237A4B2FC5A1936B64F6BA0DF061F90B30B71DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511047, "uuid": "4d3855be-d351-4c7e-bd7d-cec616a79c54", "value": "d1c35276ff2b8e9d448afb940bccb1f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511047, "uuid": "7ce2c2ab-cb7d-47ed-9d55-7b8c7a63dec7", "value": "3072:iHfoDhOAuLOM6mABtOoRF/UT8ekQJzit+EMTKhpx11Q7qk7g9/t:N68BMoRF/MWQpIXhpGJg9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784511047, "uuid": "63147cdb-dff3-4db9-a103-008aa3586b92", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784511047, "uuid": "8ec7ec17-7022-44d4-91bb-218208d312ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784511047, "uuid": "5e95374b-269e-4584-99ca-f79ba20f791f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0db38eb-8418-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784537673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537673, "uuid": "789af174-5175-46ca-9a62-74b451b0b18f", "comment": "Malware payload (RemcosRAT)", "value": "8f35d30706a9a3f07b769308a9927e42", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537673, "uuid": "fdf62cf5-8858-41f2-ad2d-667050493c5b", "comment": "Malware payload (RemcosRAT)", "value": "e940b8b7a202521e1627074dae16f0edc7f1760632e962c92b5747cf18ff8d7a", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537673, "uuid": "f0c17493-f161-49dd-a331-3ac93ecc6bc1", "comment": "Malware payload (RemcosRAT)", "value": "f225f5c967addc039c4721b5ce64b204b6181fbe", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784537673, "uuid": "4610098b-8af3-49f7-95f1-748d7b4fe023", "comment": "Malware payload (RemcosRAT)", "value": "2c90c916e918a27f3124bda84a72cb4ac212a067e3c4ddad7b18ae2b3ca123b6da818af0bb6a4a72404492dfc39d4cc3", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784537673, "uuid": "857e56c7-2ef3-469f-b398-170edcec4f4f", "value": "T19895CF3B194B3FFF7B764E8692503A010F682D8B16456D4A39EC39A2EBDDD180F18539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784537673, "uuid": "38e2db8c-9c61-4730-8fba-a258c362292f", "value": "24576:34PCbMFJqtrlpknHwABmhb3hBuN8Eal2heOiGWb:xbMFik8rBuOgE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784537673, "uuid": "862fa504-0b93-45fe-8a40-c61d6e3e7a60", "value": 1912823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784537673, "uuid": "6d2689f4-12b8-4388-a6bd-f0eb2ef2193f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784537673, "uuid": "3a3ea49f-0295-45ac-bfb2-7822d99f683f", "value": "Bestellung.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e32f44-8414-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784536012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536012, "uuid": "984872d2-228b-458d-b535-ffc78e1584ed", "comment": "Malware payload", "value": "9d880e0807495a2b3582d3269e7df711", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536012, "uuid": "f6982840-507f-4276-9f98-5bb8e8d3730c", "comment": "Malware payload", "value": "e9c2928799e295313cbdf0d0661e36f42ad55cee98e685c23bbe334f160af137", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536012, "uuid": "7ad3af43-34e8-435f-bcd6-ad44565ef7a7", "comment": "Malware payload", "value": "fb96ec9285c2bd146960cce185def126d295e702", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784536012, "uuid": "6aadbb81-b9fd-4957-bb44-fa4d39bff078", "comment": "Malware payload", "value": "5a6003834135c8fe144f152118233cb8cc1e6a3a94b866bf5cbf9aaef47bd43aaa0150a26f36ac97ecd879bc200b7997", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536012, "uuid": "9457c57c-0229-48b2-967d-1e8aabd676ce", "value": "T14E052308F8C4AD0DC13320B489D5828E111DFCE25F9FE75FAA85B32E50745B675C6AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536012, "uuid": "a42942e0-cbf0-474c-bbb0-762eef6bb04c", "value": "12288:2APXRC5Ih55TEYK+79QG0tZN0WDv9B1SN6zRUXro/oNp4YL3LF4K8e2qAdMt:2A/EyOlrPj97SN8AVpNVoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784536012, "uuid": "b64d1eb7-97a0-419d-8ac1-8265943bad73", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784536012, "uuid": "34d1a1d2-d9dc-41bd-9320-97e6de2ed5d5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784536012, "uuid": "f614d996-bcf3-4a2b-8fbc-832ea12f4153", "value": "Invoice and Packing List.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04eef422-8457-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784564470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564470, "uuid": "78094ca1-783d-436d-8f84-8a632507ce84", "comment": "Malware payload (Formbook)", "value": "22b0a687a3130cb683e619d80320412f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564470, "uuid": "6a794bf1-1f0e-4428-97f8-7d7bba889a91", "comment": "Malware payload (Formbook)", "value": "eda99519f7e5ef015a4450927bc96f26f837f07e54eb692eaa4ad12ed2a837a1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564470, "uuid": "27e94927-11dd-4f94-861f-2d533d9b1cd4", "comment": "Malware payload (Formbook)", "value": "d996f063f45b201c337b2c3a2b4c66773bb080f3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784564470, "uuid": "9284f087-03cb-4573-9b91-0b6fef2fb0b6", "comment": "Malware payload (Formbook)", "value": "f99970b12f1321f59a5c41ba927ebde044c4a98f2910ad9665042e30d613a52abaa7c2535825226142745746d34703c2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564470, "uuid": "434b6cf9-ab1c-43e4-a59d-1b20f84f14e6", "value": "T13AA5029973A71112D29F22420BA80C2DD9417C2F3EFB2EDCBDAE41D934117689E9DC75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564470, "uuid": "532ec87f-552e-43c5-98ea-e3e9c60261b0", "value": "192:ncmHEviuR/HMjxhUsMaW8+sM3+ajEqcDqmyLlq7DP0MzluFF3d:kvE/BaViW3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784564470, "uuid": "facac5f7-ac61-41db-a640-41c04469f574", "value": 2085213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784564470, "uuid": "bb406ad9-e1c9-4027-bc9c-41851a72e3b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784564470, "uuid": "e5bff2f7-d63c-4e61-b9a2-e5cd992ddd1c", "value": "Pago (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228bd24e-83d1-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784506967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506967, "uuid": "c2bd60ae-4fbd-447a-ae2c-a75e4d147471", "comment": "Malware payload (Mirai)", "value": "43560d06730f2937a40717f4c654500a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506967, "uuid": "d39d980b-4ffe-41d0-be69-9979232a0e2d", "comment": "Malware payload (Mirai)", "value": "ee44fb0df1cf9740c5779bc5a811e4d1c984365fd5e0482434f58fc1cc54d638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506967, "uuid": "fbd447f7-861c-456e-9a69-796d9236b0a2", "comment": "Malware payload (Mirai)", "value": "9c0f3349e9b30284687d010805af46db8e3a84fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506967, "uuid": "9a18518c-0a6f-4ad3-a50a-f906ba6f937e", "comment": "Malware payload (Mirai)", "value": "f18befc5105c76fc3e52179f848bc243a107593fd698d867a045928e52c99a40a9eea27e3f2bf9ea2cd1278ee7e59af0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506967, "uuid": "97a34165-a5b4-46ea-9fd0-9a9323028588", "value": "T13DA34B07B9C098FDC459D13847BF713AD462F46E2239728F27C4AE27299DED02B193A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506967, "uuid": "14877c51-d78f-4205-bb6d-3bc40bc9ff79", "value": "1536:GTJAHeDvngiZi3INrBuXuV3Su6YLNQWgU7L7tWQJgu1K9ik5v:uAHeDfgAnNtueVJ6uQWP7wQJ7Y9is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784506967, "uuid": "e2c3fec8-5280-4d5a-a7d0-c8b4e35e846c", "value": 104528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784506967, "uuid": "9e2da733-7499-4677-a050-0c81ecb8e77b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506967, "uuid": "30f7bea0-8506-4186-aeb7-0411d3ac9d0b", "value": "ohshit.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e48bf40-8432-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784548755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548755, "uuid": "769eed92-963b-4295-ac20-096188a8e2f6", "comment": "Malware payload", "value": "f3394aad85efefa775f35db43441d5e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548755, "uuid": "0f7b5551-3e89-48dd-8dac-0bae15d4bfc0", "comment": "Malware payload", "value": "ee8736333d8c2c203e6aaa43cac0ddf429bbb5793968074baf12d3ef5318f754", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548755, "uuid": "6ebef1ec-3d20-450e-bcaf-b8765052183e", "comment": "Malware payload", "value": "3f90ba3e3a5d1bc03e11820b0522e20691776515", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784548755, "uuid": "20ccbb61-9d6e-4246-bce5-9df522c7f8ff", "comment": "Malware payload", "value": "57faa4abf9f516de254dc7726ec94ccdd427e2ffb9d451f32cdece8b0987bd289831687e4aa67ae73857a9d3a4ffed23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548755, "uuid": "6d6e6c79-0be7-4659-9efe-dd5cb52f6a6f", "value": "T19E2103151BE54B25F3F64A321477A733DA36B804BA429B2E00D29148187AA42DE39F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548755, "uuid": "03f677ef-08ca-4012-ac88-88148103af42", "value": "24:8qSIJtFf5el6y6CbUzU6d+/x4dLXWOYqVegEEZqhWlrcmN:8nI7De1Wo4djfBMgEZhW5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784548755, "uuid": "b9392044-b447-4576-a574-8e33385de25a", "value": 1369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784548755, "uuid": "e108661f-e27f-4895-80b8-60bfc9c22111", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784548755, "uuid": "6349cb4d-ffbc-4348-b09e-584aeb78cb34", "value": "Rechnung_2026_07_46220671079901.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660752b0-83d1-11f1-be1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784507080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507080, "uuid": "979da331-e8e9-43eb-83c9-c66a1c1772c3", "comment": "Malware payload (Formbook)", "value": "06d9071ed8b15a6d9871f47b311f3e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507080, "uuid": "f5aa0df1-a8f0-4172-a8e5-ddf2d4286fd1", "comment": "Malware payload (Formbook)", "value": "eef5c5fa574616e79c45b3901e6d843172b8c7bebed1fd797c35f23155b7db9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507080, "uuid": "72455b3b-3a24-43bb-9bc4-d5dc45807246", "comment": "Malware payload (Formbook)", "value": "fbd17a868c8ec29b54c77fe504a8647a27c00131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784507080, "uuid": "7266165e-ab23-4820-83d0-0d56f07e203f", "comment": "Malware payload (Formbook)", "value": "596b68240015f0c92ccdb42b73ed191230441e486b9bdc4e7e717954b1decfa6e96a4f12a75ea6265d9eeecaaf7b8a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507080, "uuid": "cb7b5256-5138-4b2e-bc71-16d24c9a84cf", "value": "T12F45F11523E89A68E4FEA73167B5002187F2F80A9735D71E795C51EE0F32B819927B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507080, "uuid": "4b43740e-e1c2-414f-b64e-514fda911e8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507080, "uuid": "d97ff743-041b-464f-912b-7ee21ec5f81d", "value": "24576:gEOF8HKLZ4e2sAh8cYH4QoDPHk/Sf4iS:gr2HKtH2t2cYYQoDPjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784507080, "uuid": "ac640e00-a261-4fa1-8691-f9a44a0469cc", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784507080, "uuid": "221ff9b9-93cd-4f4e-b6ef-f40ea7dbfb3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784507080, "uuid": "151f1074-b408-499e-9964-ed9cb8fa5875", "value": "Dolphin 06_Q88 V6 (Oil and Chemical)_19Jul2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d1b7a9-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784531212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531212, "uuid": "c1878b07-8950-4a89-b563-5e9b2e4ba057", "comment": "Malware payload (AgentTesla)", "value": "c515fe7f857a4371d2e7e0a9fe208e1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531212, "uuid": "0de30b8b-bb01-4e00-9102-dedc3917f8c9", "comment": "Malware payload (AgentTesla)", "value": "ef7cde803fe8ad9d10d7fd19ade3a024b1d559ba5c954d192e97924f47eb8df0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531212, "uuid": "d1d44a35-9af5-4430-bd99-671a4652f565", "comment": "Malware payload (AgentTesla)", "value": "ed2ef04827ee843f98a806f7dde4779433c6dc9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531212, "uuid": "26bd251a-6937-496a-8a73-4b78636733f6", "comment": "Malware payload (AgentTesla)", "value": "0eb6f1ac1096ae00e783ed34757aa0db6510e91f00bffa8acdf5b1aaf011ef62046aac84f39acfc05696764d662cbb9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531212, "uuid": "7eb8f2af-d62d-4947-9b47-83f48aa049c1", "value": "T17DE53A10CB3865B1652ED32CD0369FB9054D300361DCEF9D39B92628BA5AF47939CAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531212, "uuid": "531754a7-7c49-4327-9853-a9444d660c92", "value": "98304:Oojg09rBPzuJzFmTmmJES0dJhTMSWxV7qFhVrP:Bjg2r9m4mhTMJVohV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531212, "uuid": "fa719ea1-063a-4321-8630-d4d376aaca0f", "value": 3293663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531212, "uuid": "244ae49a-7f71-4744-a2d5-de4739d5269f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531212, "uuid": "1e819dbc-d421-40ee-ab39-1a1b8e578025", "value": "STEEL, MACHINES, & INDUSTRAL CHEMICAL,.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9797b9bd-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574594, "uuid": "4a07ec6f-3d52-4040-b0c6-27f3e45782a8", "comment": "Malware payload (Mirai)", "value": "d5155dd62f9bc2c135690c858fa73cf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574594, "uuid": "2d121010-9df5-456a-88f1-fd72270dca15", "comment": "Malware payload (Mirai)", "value": "ef9abbab39834d9c48c32aa42db14eb42b312ecc9d2fa236cf7de12930259e6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574594, "uuid": "d14a35f0-c14a-4578-b496-a201f45b8fcc", "comment": "Malware payload (Mirai)", "value": "193d8911dbe25370ccf5136f96eb8ac9356361b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574594, "uuid": "1b2adb5f-1ffa-4e93-b096-894f78668fa1", "comment": "Malware payload (Mirai)", "value": "47f9162b558ef5ae23e95ce389894c83fcce7ca09bad99cdc23ac4d30faf50dc3eb68a3d1c54642ad3cc6215d9e6fe2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574594, "uuid": "46fbb673-43d7-49c9-bca7-19c7ae361882", "value": "T14393B64E2E328FADF778C23587F74A209768638527D1D689D26CE5061F7024DA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574594, "uuid": "45a5f4de-00a8-4c12-aaae-7fad1d9c133a", "value": "1536:HHwCApwWuBtsQSlHYu81o2KiEQXyx0+MtFl2ceDpw4bttIHVAeeu5UFHHcn5ZLCJ:H1ANuBtsQSlHYu81o2KiEQXyx0+M084T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574594, "uuid": "d64235e5-ad40-45b4-a275-09b3edf4690e", "value": 93820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574594, "uuid": "9ed922b1-efb0-465f-9b2e-3272f24d1361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574594, "uuid": "0c0bcaf1-50c5-4e02-ade5-41d438ed1ba6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09640517-841f-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784540426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540426, "uuid": "18891ff3-8a35-4754-9d8c-89549610e315", "comment": "Malware payload (AgentTesla)", "value": "3cb5e2d4baf59a7ae99743b9cebb22c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540426, "uuid": "6c0212e3-5f8b-4bfc-b283-b75a6553db60", "comment": "Malware payload (AgentTesla)", "value": "f14655228657a022190bb4c10effad9e92f2c5b77e14f56ee2b747129dfd047d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540426, "uuid": "267d0d57-dbc7-4a96-9107-c0b392005ca2", "comment": "Malware payload (AgentTesla)", "value": "a911c630cd03e642fac70d5bc5a164456fd315bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540426, "uuid": "285665f2-8859-4945-8713-c713c3d2d1bf", "comment": "Malware payload (AgentTesla)", "value": "a24271b7af27f1a537ece5b9c0210efc58f07951820a2ec8951ba25a72e3b15a54ede0759e6e3f134db3cd295347f245", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540426, "uuid": "30c18775-498e-4f9c-8b45-cb7affc8a357", "value": "T101061A40A72D5879602FD32CF033BF9C454E20076089EF6E38695964BA56D07EF5EAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540426, "uuid": "38c25931-2588-486a-b2b3-da8bf00f4290", "value": "98304:qk7IVyPGlTIbeZ1UcEafaWyajBk1qWvkH089zZuk9omjUf8:+ogcKQcVf33tk1qW80A59NU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784540426, "uuid": "d26ca8b7-f985-4a98-93fc-abad3faf8370", "value": 3714037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784540426, "uuid": "fc7d4db4-0eba-4a49-bbf3-b255534f9960", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540426, "uuid": "0c8f4501-e8ab-4708-83c4-b200e914c465", "value": "Request for Revised Quotation pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3cad7d-8448-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784558070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558070, "uuid": "7e34b790-ff86-4488-8de6-2fff0715e71e", "comment": "Malware payload (Mirai)", "value": "cd33e42e1fe594a5809abf566f8ebe08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558070, "uuid": "e17e86af-dec6-463b-b185-6aa85ad72a6f", "comment": "Malware payload (Mirai)", "value": "f1beea11c6352d8079caa47b7f1b3b9a7c44e3e0708d9c585c9a00564432e975", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558070, "uuid": "90d6ce36-0e70-47f4-aa8f-ed32a1b6e7f6", "comment": "Malware payload (Mirai)", "value": "78f1c5640d42137128e6095745ff40e2c268984b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558070, "uuid": "e70c94fe-f72d-4c97-a696-94bd3ce83ee1", "comment": "Malware payload (Mirai)", "value": "5644aeb3250077a1d1d99b941266ab9fa41ce87b21cc927be31e30e7dc6649081a9656b4900f0a089a31d1295deb5bc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558070, "uuid": "9ae775a8-e35a-4a24-aa93-bf15f9ba87a9", "value": "T1FC4302068382764AE9131970D55D9760CB030BBCEF57B970D83B8F14A3C7E916BFA949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558070, "uuid": "239dd0a4-2da2-48a4-a473-7952eb62afa1", "value": "1536:jQxg7CwkPcbWzvWPgvi+NqxaTijd7fHG+dfE:Exg7LVWDcD15fG+d8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784558070, "uuid": "87f8bfd9-385b-4fba-b94a-55bad907d9b0", "value": 58892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784558070, "uuid": "557a2f97-1829-4c2e-a890-7f31e316c27e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558070, "uuid": "6849a4b3-2959-41e4-a5e4-98f3308d4acc", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58442888-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784531109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531109, "uuid": "683b8598-ae59-46fe-9687-f7695ef918cc", "comment": "Malware payload", "value": "8b8ff942a44319c67f83c385dfb33942", "object_relation": "md5", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531109, "uuid": "00c68810-d69d-4286-9e87-033a4aeaa21b", "comment": "Malware payload", "value": "f1fd75c04548bb1db08a7a628130de2366e0828bc5aea714143e5ca1245d1426", "object_relation": "sha256", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531109, "uuid": "66902a7e-cdf2-48c2-83e5-0885993e19fa", "comment": "Malware payload", "value": "a6a5880dff4bfef1902424d2ff7db96a89224449", "object_relation": "sha1", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531109, "uuid": "99795655-d93d-4539-8da2-b41ccb59b957", "comment": "Malware payload", "value": "fa72be8fe5190aec0d8477db4ab200674252117051a52365f941291ddce9c1b1e222f4dcc71dfc3e35146e7281ad3f40", "object_relation": "sha3-384", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531109, "uuid": "121bda5f-54e1-4f08-8f50-9033aee4c8f1", "value": "T17A218ECB715E168378B54594DF9D20C03535C1C7062729AFB2770A20B5EAFC8BE4A3A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531109, "uuid": "58dea908-135c-4a11-aa7d-3c0b7322c140", "value": "24:2sUL15o0AOzBvnjs3RVt1A2zgJA2zVygA2zUt1APFVAlTyAeEt1A/HAlrWA1dmv:2VLYOzBfjsBVtzzMzVygzUt7TKEtXr7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531109, "uuid": "40eb74e8-004d-445c-b834-6800654deef5", "value": 1358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531109, "uuid": "67c51ca7-6113-47d5-8677-3fd793aab429", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531109, "uuid": "d4c44a52-4e87-4cd9-8efc-aa43836ec7d5", "value": "menu.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae35fa88-8434-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784549722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549722, "uuid": "e292d6e3-8f73-422d-b54c-0ce9ee8b8760", "comment": "Malware payload", "value": "ba79bcf4038f46565b50d2dc83574e9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549722, "uuid": "b4ce23ed-572e-4b1f-a09f-c1fff9c5a818", "comment": "Malware payload", "value": "f264f04f597a2bdda372a27ae701c18d4036175b1eb8722db5f8531615b38788", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549722, "uuid": "d18566a2-26af-45d4-95ba-bd2b576e81e8", "comment": "Malware payload", "value": "72d2c3530467fcd01b225307d265dbbf0db3e682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784549722, "uuid": "3feb8a6f-dce9-4957-b1e2-3972984961e1", "comment": "Malware payload", "value": "df0f4f0ea098e623fd8f006f69614272f4aa3514525d68d39c4a0e543c052d3dc2e61b88cdcd38572fd2e964be9c4807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549722, "uuid": "5555c6c0-ff49-4065-b237-3e694672c792", "value": "T144052B07F2E264BDC1DAC474078BD6B37D3078A502252D7F66C5EB312A7AF205A29B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549722, "uuid": "58c5600c-45ca-4e0e-969f-bb014b041d0e", "value": "12288:O8CEfpr9O/HPdRrhlNWdO84Z9wNS+D6uq2XkQMYK2hEoHRMce2Q/kD/EPBCiVl4:OXEfpyPdRrhlsODwNS+lK8RMH2QcYPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784549722, "uuid": "117b3495-1225-4c57-8f56-8d4efcc15530", "value": 833264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784549722, "uuid": "a262cde5-9927-4ef1-b2e9-a646e503a23e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784549722, "uuid": "4d19a3fd-b03d-47bb-a0cc-515a2762f875", "value": "gregbfdah", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df138ea6-847c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784580727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580727, "uuid": "fbe9f09b-5a57-459d-927f-23774b3e8879", "comment": "Malware payload (RemusStealer)", "value": "dde34c83191460a74b0e6cd489ea6d4e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580727, "uuid": "dae95c42-91d7-4319-ad19-9fc54b675222", "comment": "Malware payload (RemusStealer)", "value": "f2796171d51454389ccb9d26a65794a030b1aaa80dbcb79a99153443c3151e40", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580727, "uuid": "a115e011-1ed9-4735-87b3-50e338938714", "comment": "Malware payload (RemusStealer)", "value": "7edc5c6f7a2b5c0b30cda37109a462da536e1c29", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784580727, "uuid": "097f170f-026c-4c4b-9f6a-49940117756c", "comment": "Malware payload (RemusStealer)", "value": "493aa6433cbfc068aa4a13de1478565dd28512c270f7f11c18905dd50e6b9640a284ff5ccd3154412d3bf6b261a9edfd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580727, "uuid": "b3d3ff00-09cd-4442-8dd4-00ea75977169", "value": "T10E75292C27F969A8F1B77F358AF56145DB3BBB72A93BD64E0600820F1531A018D52F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580727, "uuid": "6a58fc35-8ccd-4f3b-8622-dc87cd542807", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580727, "uuid": "f9bf8134-4615-426f-b4f9-681ab0c1239a", "value": "24576:4novWxDuBgWT1Jy+RZfjEERR/4OhUrDN59sW929AzmtjvmMBjh:KXWDy+RZfLfhWDNkW9qFtjuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784580727, "uuid": "d1dd6a93-71b1-44d0-8b42-b100ae231c38", "value": 1682432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784580727, "uuid": "375a0cb7-32c0-4c30-9d42-d4b1283bf312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784580727, "uuid": "46e0cfe8-12d0-4f92-a18a-d485b59f261e", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090c5e5c-8472-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784576073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576073, "uuid": "3e05184b-f4f5-4230-8c77-3cfb4a898217", "comment": "Malware payload (Mirai)", "value": "f918ecc354aa32b346c0a8b660fe0023", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576073, "uuid": "a7c7a8f1-baa5-4a3c-98eb-6c64f9fe3e15", "comment": "Malware payload (Mirai)", "value": "f2938a785b50c89b61abcfe405a5ecececba42d259eba1ccceed5e32821da33d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576073, "uuid": "7861e0cd-805e-43e5-95d8-739d2b2213d4", "comment": "Malware payload (Mirai)", "value": "80641950e1215dceb92d3a54df9a327a9a30d2f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784576073, "uuid": "f4b3bec9-14e7-47b2-b3ca-a7cf679eb478", "comment": "Malware payload (Mirai)", "value": "5002d493ef6ba8a2da3fd7ab48848dee3bea035b278e576a3ed2db68db4ef8507c1ebb31452194fbf3678adbb3f2b2e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576073, "uuid": "697fe7f2-766a-4c7d-a92f-da3173628d34", "value": "T1D953022C0104D9E9CFFF36B5118A02551C72CFBBACA1E9063C47C95565A41EB889F9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576073, "uuid": "068df0a7-0e9a-471d-ab96-fc84abe03739", "value": "1536:mGy7yunA6F/c2KbJyx09nv578K5sG3Jt8aVEW5:VyPnl9WBJoaVES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784576073, "uuid": "dd84a2b8-5dee-4786-ab2b-95ab407c562f", "value": 64148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784576073, "uuid": "f097d469-7b29-471a-820a-080bb7cfa502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784576073, "uuid": "272236e5-0e6f-4658-8302-49fa9692a2f1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490b0a88-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784525071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525071, "uuid": "fd5a8916-ef58-4f29-b639-28361fc9384e", "comment": "Malware payload (Mirai)", "value": "cc57c7d3dd38fea9f7389f2511daa413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525071, "uuid": "77cd70f8-1618-4db2-bb4b-70df89387f75", "comment": "Malware payload (Mirai)", "value": "f2d73d431f55ac2be584a065fa95dcab7a242d6002420bf9939736efdd8e432b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525071, "uuid": "de517fbb-68fc-4d70-963d-cdef514021a8", "comment": "Malware payload (Mirai)", "value": "7999210806bad616d17f9eb30f21d2d87edad277", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525071, "uuid": "b9d6e146-93db-485e-a12d-2709ec9a2faf", "comment": "Malware payload (Mirai)", "value": "f8a35d68912166843ca4ae378d2dfd5cc568cf39f0bd747c1bc30db2939b3ff3452a920f545cd5c7e7adcd59fd816f9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525071, "uuid": "be6b0b82-60d0-451d-851d-72516ce15026", "value": "T170E3F906A941DF12D1C221B9FF5E425D37132F78D3EE72029D24AFB0278A4EB0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525071, "uuid": "9977a15a-55cc-4643-a83b-a9e92517b48a", "value": "3072:97UedBSNXUKj1Vqa6bzJraTEdGrvU8KsmKT:97laNXPj1EamJrxdGY8KsmKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525071, "uuid": "978443ab-d9bd-4e9c-9233-f379248df96a", "value": 147444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525071, "uuid": "8327a7df-6926-4bcb-8a41-71691975c0a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525071, "uuid": "94285af7-0ded-40fa-9825-e2d78965b0b0", "value": "eclipse.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad33e7d9-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574631, "uuid": "4f0a116f-5e6d-439a-b331-5ac53f9c4fb2", "comment": "Malware payload (Mirai)", "value": "2658d7fde33ba2980c2104aba90b8ee4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574631, "uuid": "eec8f056-2f42-4f37-b1a8-3bf530728c9c", "comment": "Malware payload (Mirai)", "value": "f33157cd97c4841832edfe1ca7aa9ecc73ca7e8dd2e5fb734fa1b2ceda822023", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574631, "uuid": "ecc08215-6500-4e42-9a6c-6e82e4d98ca7", "comment": "Malware payload (Mirai)", "value": "a589052f0be2544d010174ad75dbdab20b990f82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574631, "uuid": "00de76bf-78cf-4bbf-a067-cd8cec5beb3a", "comment": "Malware payload (Mirai)", "value": "f6510af68c9a6da75bbb47c6639c7a5225a96ca012c7760513a8ef999d1a4976261403242b5b3debf0c38fec16cbca71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574631, "uuid": "d30c5af6-07a9-4bef-9d16-56af0debb496", "value": "T16D830786B982DE15C6C216BBFE5F018D3312BBE8E3DE7213DC245F9037CA49A0D66516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574631, "uuid": "e078568b-a029-4871-a0a4-c14691c6918f", "value": "1536:1cnSxBa4XuGTRCDVlxIw+yPhL6dhrc4FlwzrIjiv6SLmJHiDb:d4fGTADVUaV6dhi6SLmJsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574631, "uuid": "6da1a01f-535c-4ac1-aa14-3a6748354ec3", "value": 86884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574631, "uuid": "56b47774-2518-4558-9912-ccf594ed6835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574631, "uuid": "80eb24a9-d4f2-4105-98fe-f7936d82a4f8", "value": "nullnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e579af-83ff-11f1-be1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784526728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526728, "uuid": "6c2258f5-ee99-401a-8f0e-09cddca33bbd", "comment": "Malware payload (Efimer)", "value": "133e12e9755f957f75e28277225b016e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526728, "uuid": "5e5e3ac4-bd84-4ec5-a7d9-3572068f4f10", "comment": "Malware payload (Efimer)", "value": "f336a28ed313e106dae3e39bcd22a4c677506091512c5d4e335eca0a271ea7af", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526728, "uuid": "b48c8637-0e37-41eb-ad9b-2769e4712de5", "comment": "Malware payload (Efimer)", "value": "8efb1f0a53c34c03774359283a40c411af9d02b7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784526728, "uuid": "63611855-af97-4998-8845-64c6c8625a0e", "comment": "Malware payload (Efimer)", "value": "780cdc84629fc7f1cbdad574f2939915129619219bbcc6a4774a27186eb2c2c1ac7a6fff9f0349d4ad5a38eae7f3fad1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784526728, "uuid": "a9a8cb7b-30a3-44a8-857e-4b4e6fc97f82", "value": "T1CBE6339877D112FEDAA35039EFE341D5E9ADB0760B72CC9B03B84295BD172A10E34B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784526728, "uuid": "8e14c907-e215-49e7-a115-6246049f0730", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784526728, "uuid": "b9d2588c-f626-4cd2-9d48-07fa41e979ba", "value": "393216:urlayST2iF7lxl1n972d0GXMCHWUjXScuI3/PGTAI:Sl+F7PDn972JXMb8XvH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784526728, "uuid": "9b36890e-0b78-45da-8217-ea250e7d50b2", "value": 14317671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784526728, "uuid": "4c6ce109-3971-4928-ad42-9dce2854f7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784526728, "uuid": "f6583435-cd9c-45f7-9955-ee9e076dfe95", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc8b703-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784574608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574608, "uuid": "e6c2cd10-99ba-4671-97ac-96711419d8d1", "comment": "Malware payload", "value": "dda0235be8a0d1750291ce86ba416c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574608, "uuid": "7722292e-de92-42f3-a2fa-25f59a5fbe96", "comment": "Malware payload", "value": "f399ed1609cf09e2477b7187331b65552b3931f12dbe2429176b07eeb8b412ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574608, "uuid": "45d1e6af-6cfb-446c-a1d2-6ca4ce7fbe32", "comment": "Malware payload", "value": "56f53f98e9aa9f8c237afd44d2dc996644387fdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574608, "uuid": "7cd792f2-833b-4825-aad7-7a1ba2eb2ac8", "comment": "Malware payload", "value": "b36271cadda76ca02930a1a7d06e6a466ca11dabc44f46bbd5ad7f4629ea6745d82c43dd464ad52db2016a332d0ce66d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574608, "uuid": "c8138eb1-aedc-4f00-b42a-61d75242c9a3", "value": "T10743F1424139AB60D634A833D04DC543DF2F7BE4E799BBA7C430425CE6433A757AAAD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574608, "uuid": "7f97b136-0c80-461a-a73b-34701edbb9cb", "value": "768:y5Cd1YxvsFpN+izh6a1X82b98x8BBWDR2ZJl/DerzQuIAhQZRdDCMbsq3UirX:sCPRN+iUYse9cCWF2iMcQZRdxbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574608, "uuid": "124a3d8d-0fda-4ad1-bdba-e375049a77f2", "value": 55628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574608, "uuid": "9cf3e9a7-1cd5-43e6-966e-95c8e3c699e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574608, "uuid": "bf275861-0a3f-4d69-bd59-fd9057aea179", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0511edaa-8496-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784591529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591529, "uuid": "c459331d-0b41-44f0-bb63-f2c2f22eb1b2", "comment": "Malware payload", "value": "b13e4898c4e966997b6ba6f435a38b21", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591529, "uuid": "e6c34979-aa38-4a62-af57-f6ab05dfb4fc", "comment": "Malware payload", "value": "f42cd03d9db9469b3cc83f8a3ef36a9e72211fb6b481456b1e199563a523dc87", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591529, "uuid": "e4466726-4530-437b-8226-2cec8de9deca", "comment": "Malware payload", "value": "cd590dd5f717eee538fc31ddec189a02e8713a3d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784591529, "uuid": "9b64e685-2895-4786-ad95-0e5ef776f6d4", "comment": "Malware payload", "value": "855f9fd2c691f3c02b724e7f096a6ccbfb458bab01ce7a7cfcdf987ceb9fa365890481744b88c9e9d7aa5e602408ceb6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591529, "uuid": "3044b11a-41fb-40f1-9a3a-edcbcc3b664c", "value": "T1D8E63394AAE015ECD2BB90BDBEE18951D554B4BB0F73CAEF03AC43651C270B1493E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591529, "uuid": "1df7ed69-9961-4a95-98dd-528778a494f6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591529, "uuid": "a3f1a6e5-7e09-45bd-9de0-ef94f79bb488", "value": "393216:iSeJ/d4XnsRIYETZ6dp19pBitO0JXMCHWUjX4cuI3/PGTAI:iSs4XAIY40dp19pBitrXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784591529, "uuid": "bc8379dd-32e1-4213-bdc2-3a966220edad", "value": 14289667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784591529, "uuid": "a880047d-b25a-465a-a244-bc14c997843f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784591529, "uuid": "631b733e-702c-4e8e-bac8-34ca17ddce7c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbd9894-8409-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784531117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531117, "uuid": "ed9f2fff-06b1-4d9d-88b4-8155f51b1bda", "comment": "Malware payload", "value": "1e301892150a5598f66cbd58c149c904", "object_relation": "md5", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531117, "uuid": "456fdfc7-cb55-4c1d-a89c-cda6d83f4f5c", "comment": "Malware payload", "value": "f45dbec4b8483616edc0fc85a90ea97d5497fbbe3e7e9a7f2140ecf87d7f46f4", "object_relation": "sha256", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531117, "uuid": "36f5b4eb-5bae-4dd1-bd6f-4592214b2d50", "comment": "Malware payload", "value": "beb24f1996b25cfccac7638762b4424cdbebfea5", "object_relation": "sha1", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531117, "uuid": "b35d9f43-3bff-4449-b614-ee5c98337532", "comment": "Malware payload", "value": "cc424b4e7d49dab0a9e2bc40df030fcfcde612ec16fac77734533ea5a38f11e28fb1eb1254d9f04190636868e8221835", "object_relation": "sha3-384", "Tag": [ { "name": "47-243-127-162", "colour": "#4F874E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531117, "uuid": "90e6c0c3-f9ad-4fa9-acd6-f73a69c67751", "value": "T10912E961304A2CA941728A764D7901D2F44D41878B1968FE312EF2785F2E3D9E7FED8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531117, "uuid": "0e39590d-cb17-448c-a7d0-0bdc91fe9e57", "value": "192:i+GOaGhjSGgIjECD6aDWpjOCqs7IGBwpOdm5zJMc/cpKGhQyDEwZTZLWMgn3v2Jg:i1GhjTFudrqwBww85ztiKj/pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531117, "uuid": "35bee86a-9f2f-4b4c-9198-0c7d213f6bf6", "value": 9476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531117, "uuid": "55d1e7a3-6f65-449b-affe-7eb214b50293", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531117, "uuid": "e81d9727-eab9-4cd1-a601-3578720f6d19", "value": "1_drv.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668bbb8d-840e-11f1-be1e-42010a9c0009", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1784533281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533281, "uuid": "cc2fee9b-ed4e-4de3-835a-cbff26ba0df7", "comment": "Malware payload (Rhadamanthys)", "value": "159e06ef198371caf78e9a168b5ef4e9", "object_relation": "md5", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533281, "uuid": "ac83cc71-c806-455c-8ad2-9af83e5e8ae1", "comment": "Malware payload (Rhadamanthys)", "value": "f47ac99afe9dbccccf308de99a8c791c675810047d11bd4613c5a4a4f08568e7", "object_relation": "sha256", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533281, "uuid": "cd8172a0-e00f-4803-850a-d88968f4af2e", "comment": "Malware payload (Rhadamanthys)", "value": "3a838467763d722b11890d0cd331144aeac5f8f9", "object_relation": "sha1", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784533281, "uuid": "06a8c0db-f4ba-4919-9004-717794de5aa8", "comment": "Malware payload (Rhadamanthys)", "value": "c23307b0df5f86b42d7d7ef493891233181f3d91e1afe39fd4bd8a226a5e4d76810bdbd392fd4320f815f8d4f51e6c03", "object_relation": "sha3-384", "Tag": [ { "name": "Chrome-security-updates", "colour": "#ED7D62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533281, "uuid": "1a2e9e16-70f0-49ae-8462-61bcf741160f", "value": "T102851206F083D033FB532470263EE694682EE973AB151DCB3384A6755DB5EE18A3563B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533281, "uuid": "d0bb06ec-07fd-4057-a1f9-4a488f7a30b2", "value": "acf8678f3931e34a1f5fe2fcd28efca9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533281, "uuid": "4f5f5ce6-05c6-4b60-aba8-e3c1f9fe5052", "value": "49152:Oj5PZBSEOTtLFZIofu2IlkMP7fu2IlkMPN:OZm9qofuRtfuRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784533281, "uuid": "3ce6ce38-1397-4c2d-8193-6d67473c1d8c", "value": 1741824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784533281, "uuid": "8b7f2cf7-fb86-4e8b-a985-f04c73812e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784533281, "uuid": "53d6a698-922e-43c5-ad01-c9bc265a574b", "value": "f47ac99afe9dbccccf308de99a8c791c675810047d11bd4613c5a4a4f08568e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd3f9f8-8404-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784529028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784529028, "uuid": "4fb1cbbe-de69-4b74-96bd-91896c850aad", "comment": "Malware payload (Mirai)", "value": "a5884580147d81661de11ae459748b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784529028, "uuid": "812af579-512d-4ace-9f46-5b8514edc2e4", "comment": "Malware payload (Mirai)", "value": "f4806381ad322bf97c3a943e7659b8d8df20eee28d8919c94b0876d31b614f7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784529028, "uuid": "7c73e6b7-28d5-415f-9534-f76a948d58c1", "comment": "Malware payload (Mirai)", "value": "8c181f7681a8b00645af8a00dca23fd8409f4ed6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784529028, "uuid": "9259f6cd-e515-4e37-9d1d-bd5793c4dd9d", "comment": "Malware payload (Mirai)", "value": "f9b72e70e8d71320306abed4261cdde35de8e66d45e003f1c178dc1e709bcd4b6f34fa72c889bb38e594b581900bc309", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784529028, "uuid": "942bcf6d-579d-42e3-94d7-0439224011b6", "value": "T1D8747ED3FC01D97EF87FD732C8138E04B531E36158812A3A21A3B779A92B1595973E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784529028, "uuid": "9d136789-556d-4099-846d-0af6395c2d19", "value": "6144:r6Id/Ee9aWdkUf5Gf5fShbGWK2hfvBotzkhiFsrdmqyDzqLa8K9ew+Lks2X:rnGf2PvBotzkhiFsr5KDs2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784529028, "uuid": "be3786f7-ef28-498e-b13c-c2637e464ede", "value": 369324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784529028, "uuid": "73a0d558-af35-4e11-8e5a-dc5f74b2cafd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784529028, "uuid": "cc817f28-fdca-4755-a44a-8e70cad27a72", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f8b54a-843f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784554462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784554462, "uuid": "c088fe06-b771-4ccc-80a2-0b00eccd0083", "comment": "Malware payload (Mirai)", "value": "b9634b7eedbe93c8bcce5650e7c19b6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784554462, "uuid": "730665b4-4a30-4405-a920-0c553b8d75a4", "comment": "Malware payload (Mirai)", "value": "f61da9f4b26d57e5659ff399913313cfa85cd4161a124da2fd7caedb8246b954", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784554462, "uuid": "d2ab4b63-680c-4504-98b1-4cbd9cb40a7e", "comment": "Malware payload (Mirai)", "value": "7a350cb8c1ecca1d35033545d8ab7f3fdb516102", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784554462, "uuid": "0333a935-9ac2-42e1-adbc-17221df65653", "comment": "Malware payload (Mirai)", "value": "885722c9c9d52c718242c1db73e17ccc2dc2ea00a514e9a84edcb76510b1c8b54e6bd8ed5a467b35dc46e7c7f4b37457", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784554462, "uuid": "e1db418e-9e2f-4e55-b26a-8d7694013dfa", "value": "T1A8A3AF689E4F6E81C2C2E3BEAD550FA331363DB4C364C2B36A00A6DED999ED5DC51413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784554462, "uuid": "88193da6-db31-447a-b27a-2610b51335e4", "value": "1536:cfyiC9FxmaVOyWaE0HoFeaWl5ba08fkRzTg7hbJr2P2KOC54L6IS9c4JIrJ:cfGzvVBhE0bmQhTehbUP2KhRIvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784554462, "uuid": "17d3a1a3-5445-4a07-9cae-47e5092db273", "value": 99768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784554462, "uuid": "0a0304bb-c8cd-4ca6-8bf5-73bb6d01b13a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784554462, "uuid": "bfbda468-8204-470a-a44a-ddfe0c0aa049", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e68da9-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509385, "uuid": "47b687ff-b8d7-4ea3-9542-2b9b3a600780", "comment": "Malware payload (Mirai)", "value": "088918ee5cbd843420a7bdd497c2d0bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509385, "uuid": "79e2df22-e483-4112-86bf-268f5007ef67", "comment": "Malware payload (Mirai)", "value": "f6b00f2f991671e105a03c5eb80b810e14372dcba7cc33703d428c9a264c3711", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509385, "uuid": "078025cb-39d8-4e6f-b2c4-714636b7fd7b", "comment": "Malware payload (Mirai)", "value": "3af1e5cb893acb461bceba30833535fd1407859f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509385, "uuid": "ad036ece-441c-4c94-9a5a-61c58f959a72", "comment": "Malware payload (Mirai)", "value": "c79183fde1ffbe2838a030f770ac40d3e319a2acdb483197b76ceb638319c11672982510581f8529df66e17f8ec250bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509385, "uuid": "6dee2636-0490-4632-a916-e47fd01e4ca0", "value": "T14813F1730889BEB2C1750C32EC4E15553F27077DD6A2643D3A9C0AADE15224BE97C2CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509385, "uuid": "003281d6-1755-4244-8f44-4cb633239f9f", "value": "768:fiifDEdlpr8S3nuzKg+t4q38MmTDzXmjypcOVR2s0+PC7zM7hs3Uozc:dDQVqzT32+FCsm7CMzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509385, "uuid": "65062d4a-91a4-40e2-87db-6d73064ccdbd", "value": 41636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509385, "uuid": "2257c860-6ebf-4406-b8e1-168051fae90e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509385, "uuid": "a9288804-c6d4-468b-9fe8-85fef516f210", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5d61c8-83d9-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784510416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510416, "uuid": "e0096af2-57a5-4805-ba12-455bea08a301", "comment": "Malware payload (Mirai)", "value": "204e7526670fdf665aef0f259cd3c84e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510416, "uuid": "84088184-0369-48bd-b0d2-b9cd4c008e1b", "comment": "Malware payload (Mirai)", "value": "f77256eb64c144a1f433705087bcefffbf59c79f6953a39d7c0d745ceab31573", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510416, "uuid": "0978f452-3262-431b-88ee-242e94d30a51", "comment": "Malware payload (Mirai)", "value": "333e1b767048383263589c8a7e0ac6dc02e87664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784510416, "uuid": "bb7ff176-b8cf-4203-9078-ecb512a8571e", "comment": "Malware payload (Mirai)", "value": "d66dec8f20caee085d15655967ec619576306efdd931844d50f8a9bb5276559479643c9f3cb5974fbd6b52be26ad4c76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510416, "uuid": "6f1b8b27-3ba2-4f8e-99ce-e544d74c7f77", "value": "T15103E137D1821AD5DFEF957414B1BFC023E10FCC01AEE6AB1192AE02BC5F429525A6DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510416, "uuid": "b2cfcaab-fe26-41d6-ab09-f061e9eebcd4", "value": "768:SGfe47AQMTPqcOQ6utk3eZVw3JOt8QCSeEvH1es6h72lCqFbLkOAv4uVcqgw09c:Sx4Csput0qVwg6Q5eEvVMdKn64u+qgwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784510416, "uuid": "a8e1ee9a-0e80-4334-bb9c-0ea117c7dd23", "value": 40140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784510416, "uuid": "1dda8208-b6f8-4417-9a3e-1afc7e0fb00a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784510416, "uuid": "5dc7d6a6-b8df-4d48-a7fd-e15af8584406", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf1382d-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784574684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574684, "uuid": "8bced826-dfe5-4aed-9310-776410cc462f", "comment": "Malware payload (Mirai)", "value": "07cf9a85a3ab283d66ce82cbcfdecbb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574684, "uuid": "aba80421-e9c7-4b8d-9a0a-7c7949921c05", "comment": "Malware payload (Mirai)", "value": "f78648c17aa133d312e0255869f5b35aae1ca7674349e8a050df2da8c9e25d9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574684, "uuid": "cdcf2e5a-5887-484b-bc24-fb10fb0e02db", "comment": "Malware payload (Mirai)", "value": "95691dedfe8341a3e5f9164b620f384d6cc393f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574684, "uuid": "37fd45ed-4dd2-473c-8433-f5fe579bbf3a", "comment": "Malware payload (Mirai)", "value": "a23e9e6c3d2ad9eab8251d7c12efec0ca4e45b7899d49b2c8258fc993f486509d7f94b52c4a29f8a1053fb5c3d8b9038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574684, "uuid": "a8539aa6-e7e8-484c-b48b-f4e1e4feed1a", "value": "T193C329A9F890DE52C6D526B6FB4E418C33231778C3DE7106CE149E3467FB95A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574684, "uuid": "9fc81c42-4111-40b0-ab77-99c9a0d52e18", "value": "3072:QuIBvPRfsNDUxMa3tIDrcYEEUIAyMW0NwhBigpmqzWNiF+WOur5mf1Dl:QJ5GytercYEEUIAyMWGwiOmqzpJNm95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574684, "uuid": "b14a59bc-bf46-4d22-a6f6-06ac28ae4a2c", "value": 128444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574684, "uuid": "a4c57059-ad04-4c56-8e91-1b8da7bdf8ed", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574684, "uuid": "92e327e6-af4a-443a-b172-92e6048d2743", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce55460-8410-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784534204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534204, "uuid": "999d1a31-dd66-45ee-aa73-bf6cae52c902", "comment": "Malware payload", "value": "bc347e92d56a08d0c3ca922f401c253c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534204, "uuid": "1c115e82-8190-4311-a321-6e510b9996ec", "comment": "Malware payload", "value": "f792112e2bc6159ad293421b49d28431c5c350a5b4b87bff221b719d95b2dfbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534204, "uuid": "2deeb140-a117-4201-b4df-4e1ed4611da0", "comment": "Malware payload", "value": "be5d9226a09c6583aa3fbc6310208358a5314da1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534204, "uuid": "3d932e94-36ee-4ffb-9ebd-382bd1beeb9d", "comment": "Malware payload", "value": "988fd58c24aacfef29d3063c6128d75f499cf80b1b020f99c82e813a029fb1792bd782cb5d621408b837ee75720f349d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534204, "uuid": "2efa371a-19fe-4b75-a21f-39160f0bdfea", "value": "T1D2163364BBE115F8FCBB413C8082D412D6B3B4224764D6EB27DA5A662F237E15C3E781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534204, "uuid": "aa0ddc44-af2e-4b30-a152-28bf02dbffdd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534204, "uuid": "e41de82f-85a4-404c-a253-7db2725e5853", "value": "98304:d1Dl0hsqlhr06Cpo5oKIEUljuvQL6NVitVt4HqQEGDyO:3l0hsqlGN65oKOOkt4nvyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534204, "uuid": "3d033a29-0ddd-422e-86db-1470e3aa6395", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534204, "uuid": "cc31195e-37a7-4cc0-9164-f19147c69083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534204, "uuid": "d01c9270-07ea-49c2-bb23-854baf3de123", "value": "bc347e92d56a08d0c3ca922f401c253c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bede0f1e-846c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784573801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573801, "uuid": "cad1d0b2-5ba7-49cc-b269-b03a7082ba05", "comment": "Malware payload (Mirai)", "value": "82336c361999d7109f0c6a8105af8634", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573801, "uuid": "e03f89c7-68a3-49bb-8b2d-9ff89f877b59", "comment": "Malware payload (Mirai)", "value": "f7e9af811c5c2291f44902afd72561a472670254ac013e9c38624ca52cc8523c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573801, "uuid": "ea4d8fcf-7232-40b1-a503-178064a001c9", "comment": "Malware payload (Mirai)", "value": "e99c70c5b006c62551ad2a44ece43774bda531fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784573801, "uuid": "2b05cb57-05d6-4928-be30-e62596694f03", "comment": "Malware payload (Mirai)", "value": "a7bfd376462557bc992cf979867a7919cf98339c4bfb77832b59d96426f317480739fc4958b56d2edb51d152ae8447c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573801, "uuid": "57d3b82b-d1a6-456f-a67c-c4f1ff2ebba1", "value": "T182147E00FB184913D5831EB45A3F0776E379D98358B9F009190EBB561733EBB9A87B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573801, "uuid": "da238e7f-8fde-4f32-8a73-5ca2e54ceb78", "value": "6144:By83KfLiY028Umk+LZAIJipYQd16zCVje:w3iUFiiHfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784573801, "uuid": "b437ee98-71d7-40fb-ad00-cebd673000a5", "value": 198024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784573801, "uuid": "b2323d02-05b8-493a-b816-a7595a46e0fb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784573801, "uuid": "8bbed1ca-9ad0-40db-8f83-a9d9259f3742", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc49fc4d-83cf-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784506366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506366, "uuid": "201ed44e-323c-4649-ba2b-2b81e4187ffd", "comment": "Malware payload (Mirai)", "value": "bbd42190e42a1f25cce46ebb230cfb0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506366, "uuid": "1f44b64e-e91d-4706-a447-cd3d43d4874e", "comment": "Malware payload (Mirai)", "value": "f9191fbfcd25b4d0274e7831ae190d888c42be4e3794c4bb3dea7517b704fdee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506366, "uuid": "ad7c84a4-11b1-4a54-853c-0bdcbaf6234b", "comment": "Malware payload (Mirai)", "value": "e2bdf1cf47f42ff081a8448a84c5e07cd54f84a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784506366, "uuid": "25bfd0a9-28c4-4040-98fa-96ee10a94426", "comment": "Malware payload (Mirai)", "value": "b363639d9de640f4257aa83bcd29c3b9b37a1c6417d42934867527a677edb0b7fe40cba8c31b8ae1be11ef7b31e7ceb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506366, "uuid": "1fd9f43b-6a8b-4b8d-ab83-8687f385b8ad", "value": "T1E0A3BE62C8742DD4C154C1B9A4A4FFBA6B33E81056836FB3165BC636E087EDCB5863B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506366, "uuid": "cb501d01-dafe-4b35-a0f8-de43773581c6", "value": "1536:uZ/GPxiqRW2HXqobEMP3YLADz0PdKISOtmuoaICc1tWTmNv+Hb:c+ZisHPbEMPIiz0PEIGuoaIR8qNv+Hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784506366, "uuid": "92ea7676-45d9-4fc1-9add-b2203339e791", "value": 99872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784506366, "uuid": "e1f35919-666f-45b7-b23d-d63782f94e80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784506366, "uuid": "b3e916d4-9dc8-4dc6-9576-32b7733ef239", "value": "ohshit.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c241cfda-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509383, "uuid": "70dad8e0-2365-4914-b6e3-15d2ee902b81", "comment": "Malware payload (Mirai)", "value": "0eaf308701b61bafc75cd8e542a21f7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509383, "uuid": "74430fac-8216-4a54-a5b9-7584f6ce4c64", "comment": "Malware payload (Mirai)", "value": "f93fdc21623eddd541ac3b5d92f83b31ea6ea3dd7b0359b09aaa1287ba58579f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509383, "uuid": "4cb45448-f5f9-4a23-9a81-3b7e1a2175f0", "comment": "Malware payload (Mirai)", "value": "fcbbdfe6769c9e3e63db9f8379f9ad8651b48c68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509383, "uuid": "e77a843c-e622-4a00-bf67-4767a3ef6def", "comment": "Malware payload (Mirai)", "value": "4ce42aac2bf4a022c8c7f95b35fc3099f9b35c3f96d8fe2c6ccdee19586f16ef5c8b026d63eeee2ea684a1ce07a0d726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509383, "uuid": "a2f5e892-b61a-4ec3-891f-775741313dea", "value": "T1849329C6B401DC7EF80FDABB4463690EB631E2511A831B26675BFD53AD321E45923F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509383, "uuid": "f54a2e5d-2c00-4527-a3fa-36b0ea6ff9c7", "value": "1536:xsdLEbXJld35KM6hRozWD/TJsP8dFWqvl1Pj8b4b29wv5tLBo0zzHlplo9K+tMUP:xjKvhgWD/T/wqvlNLCetdoqOK+tPKqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509383, "uuid": "0666baca-dc96-44bd-82f6-e02c15d10bb7", "value": 96728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509383, "uuid": "5699d89b-d378-404c-b660-35e551c597c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509383, "uuid": "863c1e38-3da0-428d-9e54-2f5c8b7228f4", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61acb86c-83ee-11f1-be1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784519528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784519528, "uuid": "eab04e88-7037-4886-a208-80d3604d29e8", "comment": "Malware payload (Efimer)", "value": "f35901a1bfb87b6c31f16bed491bc64d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784519528, "uuid": "27163351-5f01-42e1-ba97-e6dc938becec", "comment": "Malware payload (Efimer)", "value": "fa1e42eccf2edbaa7306cd40636bf579a6588e3d0fa61584e1ccb92a00d01ecf", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784519528, "uuid": "3893f100-2568-4161-b8ac-678fc29257de", "comment": "Malware payload (Efimer)", "value": "87a981d160bd9ec14de5fdb46f74f989fbf559b5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784519528, "uuid": "5c376827-91c7-41b6-9c57-fe9b033f214e", "comment": "Malware payload (Efimer)", "value": "e5a68799599642c0f63f210adb4d8f2fdb5aa7f7d517f2f48f7b0576863d850b22994585a489d34470bb91f298a4b2ee", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784519528, "uuid": "032c5546-e80c-40e9-8ea6-055b0d3792d9", "value": "T1BAE6331C56D012FBEEA3843CDDD19195D9AEF46A6B3AC6CF43548321AF570E04D3EA12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784519528, "uuid": "562c0a48-ea4d-4bee-b589-1898d26b9861", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784519528, "uuid": "19cafb3c-a991-4ceb-b712-c9dbb7f32473", "value": "393216:ZLRAo/tmA29LctHwymYXMCHWUjX7cuI3/PGTAI:ZLRAfAcLyHxXMb8X4H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784519528, "uuid": "41c1566e-d602-4175-97b8-666dc03592a6", "value": 14285822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784519528, "uuid": "419b9785-6865-446e-8e47-a661edb4f0d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784519528, "uuid": "e6587860-7a29-448c-b941-d59ee4945071", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb7f0b6-841f-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784540461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540461, "uuid": "fa29e9b9-a2c5-418f-b550-3c6ed18adcd9", "comment": "Malware payload (RemcosRAT)", "value": "492381d07caf7706628905deeb698dc4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540461, "uuid": "244d5cf6-bdc6-45d3-be89-03db5e084609", "comment": "Malware payload (RemcosRAT)", "value": "fa7d1e33f54d3499b18c93e4c0d205db3f334fbd53e60694500494fc826def74", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540461, "uuid": "09856567-0703-4d6f-b424-ff4810bda0b5", "comment": "Malware payload (RemcosRAT)", "value": "e42bcc733e2ad244f8819cc7d2e020f9f75f3d68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784540461, "uuid": "856f1002-75fe-4c6a-94fb-424fd22ed415", "comment": "Malware payload (RemcosRAT)", "value": "1c0cf897729c0907e8052a551ec9a1bf2c4bcfee3fe5e6926c6036e1b7f4a9096d3e3c9b26606a6fe4dd68dd068f26aa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540461, "uuid": "bf903843-fc47-4632-9b7d-f4fcfbe4d5e9", "value": "T174834B60DAA205774F83BB58FCA58660C66DC315853305F0F6DACB0D9009DECE779AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540461, "uuid": "e8aa0135-97de-4f35-b80f-7c00635c19d2", "value": "1536:/tFta1sbUA/zHEgXnpux8rM2HUkzQd2zzZHc6:/nta1sbUyHEgXnpO8rM2H1zQd2vZ86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784540461, "uuid": "eb37d01a-5333-4e0f-be65-44bcf13478bf", "value": 82849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784540461, "uuid": "be3fc2b4-7420-4d7d-9bf1-35ff6b652148", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784540461, "uuid": "444142bb-63f1-4f5e-af8c-00eeca093f63", "value": "SPA of goods (draft) final.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592f755e-843e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784553874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553874, "uuid": "6d61ddaf-da67-420d-a7ab-33a6da9d7ce3", "comment": "Malware payload (Mirai)", "value": "0afc81c944cc2efb8a2606d967999204", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553874, "uuid": "ddca8c8c-1202-466e-9026-2b7428c5886c", "comment": "Malware payload (Mirai)", "value": "fbe6afe9bf94217b4bec7bf9d27bb01f68bdf6d67e5bf5500ff3541db322a2ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553874, "uuid": "6787cb7b-2d19-4c86-aa1e-19939b0512a1", "comment": "Malware payload (Mirai)", "value": "c491139b45e0cb8e55f472f857c9938ae2f4e8bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784553874, "uuid": "12d2a6e2-7e1d-45ef-9567-31d7763cd833", "comment": "Malware payload (Mirai)", "value": "e672c215aab2d20627962230a64c234bde8da55cd89dcb607a477a5b23ce353ac920a1f893382cc5ec5a4ba99cb0fe9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553874, "uuid": "f8d088e3-a63a-40e8-adc2-db6200ee0c9a", "value": "T1EB631A99F9819A22C5C115BFFF0F829D77324398D2EB3307DD296F25368786A0E2B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553874, "uuid": "5f5a52cd-7d22-4f8d-82a3-2fa1657eaece", "value": "1536:ohP9QkqIe8Scg0mvvKpXhKLqs9DnLmO3vQazco6vMn5ZLC1R0:oh9DSc5qKlAWs9juaYwn5I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784553874, "uuid": "f7ae78d3-80a8-4e32-a3ef-326eb2ed20a5", "value": 70784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784553874, "uuid": "f851be05-fd06-4fed-8c53-96d830d495a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784553874, "uuid": "8aa46356-1c4b-4ad1-b1ac-2e5b0ad13aa9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a04f59-8411-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784534588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534588, "uuid": "0db92f77-76ea-4eb0-a400-5024860c84c0", "comment": "Malware payload (Mirai)", "value": "a0cafa1e88df73e4b4fc26ec935ab9d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534588, "uuid": "bd9e0b99-8ba4-425f-aff3-35710415413d", "comment": "Malware payload (Mirai)", "value": "fcd0c4676a7b813715aeafd9f5084c166781ea5bc9f618231285055a189e396b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534588, "uuid": "1301992a-b590-43da-abbc-864ec57c59e9", "comment": "Malware payload (Mirai)", "value": "e1a786e382a889f94ee5fdd559f4d5d348a0d230", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784534588, "uuid": "f717195b-7b0d-4e88-befe-f7ace1605ec0", "comment": "Malware payload (Mirai)", "value": "6bfe43ac315fbc184f9fd48925995ad7692db29d689d812397c84fa825d16d6744a16d707ff01b756e034aefd153de76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534588, "uuid": "49454360-146e-44ac-8987-0a3d221f930a", "value": "T17AC3127279F871AB778712F7783E71CAF8750E38A4C577172504AE8971871AE8FA0442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534588, "uuid": "3dee5114-8079-4a17-8e01-84dac33452b1", "value": "1536:h4sSenRpumIQ9TuoTHKl5daDIm0oJpr/ypSAWWh+WRYV/vtXIM3SF4YFt/tbuoA+:h4sjZDtY5F0SLWWUjrfKFujiaaEEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784534588, "uuid": "4fc580d7-3c4c-445e-8312-cd5728426414", "value": 124896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784534588, "uuid": "a4f05644-34dc-4cab-9e69-d36eb7da3dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784534588, "uuid": "13d71937-328d-48b9-bd5f-ffa09d035194", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afeff247-840c-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784532545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532545, "uuid": "34c95c02-0675-4549-9a57-de56f63d3cf5", "comment": "Malware payload", "value": "b348f7ae41623fed7a3c9f46809ffe4d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532545, "uuid": "fd4ae1e4-b53b-41c0-87a5-be65944dfa8e", "comment": "Malware payload", "value": "fcd959770e20be2a9d6ff33c27678f52e67940ac9f6d24fde9276e13fc8832b8", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532545, "uuid": "fab06ce1-9bd6-42d5-95db-2d3f8d785112", "comment": "Malware payload", "value": "dd03f24715e6961873204c735517724b1578ca17", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532545, "uuid": "78c9a4ef-70a3-4764-b138-fa74891cf41a", "comment": "Malware payload", "value": "99f7b4b3fd3f07265b6de7b117263c5df220ca486f36126dcbabaadcf64c7d8ad9031d62723821efb7ac14708d52bb4f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532545, "uuid": "13345ad1-81cc-421d-b1a9-a0c6cf373384", "value": "T1A9052389F9E1FE1AC133957428C1C2D4D22EEDD1AE49E65F6A22B71D483127CA7C142B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532545, "uuid": "9cf266cf-f45d-4202-b4ad-c5d670ee6fa8", "value": "12288:CxgRAPXRC5Ih55TEY3K+79QG0t0v/5T3N0WDsHTZGjXxwdpjvYdUIM3Hg5Q3IdSR:8gRA/EyXul0dP4HTMj+dpgUIGHg0IKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784532545, "uuid": "4b426df6-dc2f-47f9-84b2-6c948be61fe2", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784532545, "uuid": "e809e61f-6a46-49b3-a9af-ada0927687af", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532545, "uuid": "fb21323d-66e1-4456-83c3-6547481e3fc4", "value": "PO0044829307162026_RFQ_Specifications.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1150719f-83f6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784522830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784522830, "uuid": "d223921c-8005-4640-aec3-c26012824de4", "comment": "Malware payload (Mirai)", "value": "c149e169778ab653d5714d7990266e53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784522830, "uuid": "9715f3d6-a095-4e66-80ae-015e91a84678", "comment": "Malware payload (Mirai)", "value": "fd5a48693a99cbb7c49f5f4245f3090ffeec58ce3f9d9bcf7f6c7eade62769f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784522830, "uuid": "53c6215e-c254-48e5-b030-73bbba67b93a", "comment": "Malware payload (Mirai)", "value": "35fdd1699479424be7ac729abe6ceade022477b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784522830, "uuid": "b79150b2-7263-415b-a8fa-c43e5f3efd99", "comment": "Malware payload (Mirai)", "value": "7b6d2816f81e7160df04c000b663d55ee475ac6630025b8b37842e35269757eebc5d45b9ce409e853626d0bc8e9f20d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784522830, "uuid": "487d6f9b-75cd-47b5-bd59-f06b11488225", "value": "T172C3125830D5B012427BA533F87784D097976EF9E0D96BBDD129B509F8C90F06EEAA03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784522830, "uuid": "07d8ae06-3d49-4923-a702-fe848c83e2d3", "value": "1536:ZEaOpUr/6ueo+XpFqSpyXfg9CoAai5oviNimWLn6ttSsS4bUhk8VhA6WEpCCEv0L:1Ok6Do+X+iyXfg0ba8IaW4w4QfA6O5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784522830, "uuid": "670cc423-2e96-404b-bd1f-d159ab789c12", "value": 119052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784522830, "uuid": "4870dd8a-a72c-4eef-9d0e-fde25d4bfede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784522830, "uuid": "80159864-c197-4eff-a0e8-e246d811b93d", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e594b2b4-840c-11f1-be1e-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1784532635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532635, "uuid": "3370b83c-8b0d-4230-9585-4773d172eb1a", "comment": "Malware payload (GuLoader)", "value": "75ddb885294b71b8890a54761cd14780", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532635, "uuid": "aa80eaa4-2105-4744-bdda-8ad730a54b85", "comment": "Malware payload (GuLoader)", "value": "fe1b0a1cc8090e6394d778530d7536588247e9de6c9996e175ce509847ad0d96", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532635, "uuid": "3e447fe4-19db-4193-b390-386bac66e647", "comment": "Malware payload (GuLoader)", "value": "cc93818e4ee3214afdd212dcee4d5ca98eab484d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784532635, "uuid": "3c3a9f54-ef60-4795-a682-8501a2037abf", "comment": "Malware payload (GuLoader)", "value": "654ce6e239dd20af9f16fe07f3d10fec41ff2533f30f29c4b11caf4a0d2a774c5721dc01974acc8d3ecbd9eac6da463f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532635, "uuid": "7453ff7a-3692-47b7-8365-7b2838f8f746", "value": "T1ACF34A20DAE4077A0E470BADFD952B11C9FD8615462694FCF7ED031E61064ACE3BF6A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532635, "uuid": "211b7ab2-2487-4acd-94f4-0c0397f1af15", "value": "1536:sIHcOFeI8mA0S6ti6HmE7nzGUMz907UWn+dR8wNLi7fXgGdO3+c/hGPfh3sgcrp:GI8mE1ET6UM+UW+1OXHdKf03sHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784532635, "uuid": "f9e192fb-4b63-4643-9ec5-25d475fc5927", "value": 158713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784532635, "uuid": "af12310b-1be4-4f16-a164-bff2ac6342c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784532635, "uuid": "6878739e-2fc4-4c0a-b1e7-5cf0d0492959", "value": "Nonprolificacy.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e130a856-8446-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784557538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557538, "uuid": "3163f54f-7e75-4cf2-9c8d-ee272838d293", "comment": "Malware payload", "value": "d96761d6a211bee452a471ea45ae2a5d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557538, "uuid": "1ad5ff71-7c8a-4525-9dfe-7c507f43ae01", "comment": "Malware payload", "value": "fe64f86257761032a1792e9cd1e24c2ed4fe1f9f48015dc6cd3066d79452963b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557538, "uuid": "4c07fa57-ee67-42ab-b6b8-65a563e80994", "comment": "Malware payload", "value": "2fa0d300ff1310ceaa6dd3922302a3d5767fecdd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784557538, "uuid": "992dd905-0990-46e6-9ae9-01f69044245a", "comment": "Malware payload", "value": "6a788c5ccae65ab7f4190d9e0786951890d7a6ef448a0068587ca09f132847198d8d1857ff4e201e1b520b91acd66cbe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784557538, "uuid": "dcad65a6-4197-4d36-b46d-540d809504a4", "value": "T157016FD54550A900405D8A5E779761A0B450D3CF0B5B4FBCBFDC5E3EFB58904B126FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784557538, "uuid": "81d7901d-fbff-4a82-810a-68943c43e40a", "value": "24:kXCKysE2hi0ziQvZohaajzuE71/g7UEMe7:e9Qp+MsajzuE71o7UEMe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784557538, "uuid": "01e21a32-694e-4a88-bbf6-78bb77236c04", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784557538, "uuid": "6b9ed981-d96a-48f3-a862-1e4d4f8f0d43", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784557538, "uuid": "ce0fc2be-6b89-407e-9b1d-95a13b52f6a9", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3d9b3e-83fb-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784525076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525076, "uuid": "c2bf3966-ceb0-439b-a5a5-a0aca00d9694", "comment": "Malware payload", "value": "ae82430de01466ac15b3d7aaa3683d77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525076, "uuid": "d1c4b01e-3cee-4a64-a53b-eab9132f76e4", "comment": "Malware payload", "value": "fea294471b06a7e6e6225091b438c1a34c5580f7355f7498cac91e40b4751a89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525076, "uuid": "330cecb9-b63a-4653-85a1-ca91e39db853", "comment": "Malware payload", "value": "ca277d9157121092cd8fffbd4c332bad0f01e6b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784525076, "uuid": "eb88dd82-a068-4eb9-87f6-9ab7e67aefec", "comment": "Malware payload", "value": "df8e4b166f83d951f510936eed39c8c49aac91451c87fb38ddb13536aab37e171844bb58a63b87443f17979f6c1fb1c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525076, "uuid": "a9441ed8-6816-426e-aada-85580499cb68", "value": "T175D3F602BB0D4F43E1532DF4277B1BE1839BBD5228E9E280751AFEC993719B16506E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525076, "uuid": "ebabfc2b-627c-46d6-a001-f67e2ee8b50d", "value": "1536:o12gn5APs1JdNPOYoxQPxl3xIh8YeE2bDxMz48arEjErSvAA5vNHq90gG2NBRqbk:a2g5DJdNOdx63+h8dbDC48ar/LAhONAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784525076, "uuid": "372c79f9-3ea7-4359-8d35-4cea692be3d5", "value": 135072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784525076, "uuid": "cacef182-d2fb-4438-a9c8-a43fed534176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784525076, "uuid": "df9c1e87-5739-474a-be1c-425d45edd542", "value": "eclipse.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de821139-846e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784574713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574713, "uuid": "44144491-ae6e-4ae0-a18e-d53dd3f22bbf", "comment": "Malware payload", "value": "e642f72b0d667ca5be1095c67aea927d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574713, "uuid": "9581e15d-dbc8-4262-8c57-4d68e09a3612", "comment": "Malware payload", "value": "ff363cb6f29a269fc7763c2a5ea564b0d45ecf64b422d024bcf0912877ed075f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574713, "uuid": "35b3fd25-8e38-4afe-be60-ab5619c04600", "comment": "Malware payload", "value": "ea4746588c41814b2f4b9b22637397bb7d425b6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784574713, "uuid": "eac13d77-b8d9-45d8-8e87-0a28acbf3c79", "comment": "Malware payload", "value": "eb82ceeaff5402b0ada3ed23089e351baef1841e22b200b602d3148310b8506e09cfdef767a43360118ff7ef1c6cf1d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574713, "uuid": "9aeb4350-2460-462d-82a3-78a8e174bd7f", "value": "T193D3F849BC819B10D9DA35FAFE4F028933575B6CE3FE7202D9205B2127CAA5B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574713, "uuid": "55f30931-9dc5-46c7-8837-439b45761136", "value": "3072:cGLhjcafpLSTtxEvuxgvaLiKLUZyQxh45NRMHp:cYhD+txyu+vaLiKLUZyWqNiHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784574713, "uuid": "73fd6b60-7fb4-4bf3-86f8-e715103b9e78", "value": 130460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784574713, "uuid": "5fa8b918-ff15-49db-8cc7-4c8ee003ae0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784574713, "uuid": "301c4016-e549-4a36-9b91-da032ad9be13", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453e8904-8448-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784558135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558135, "uuid": "bd08d9f6-fb41-4bef-bba8-68983f930dbb", "comment": "Malware payload (Mirai)", "value": "c0a849c5f3526fa019905bc2ad9230c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558135, "uuid": "c171dc5a-5ba8-4ea2-8046-60fc8160e8a1", "comment": "Malware payload (Mirai)", "value": "ff5a682bad6c911fd08c90622b7fa13ab22a608e501eed511a40fe43a9b53a1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558135, "uuid": "53e252f3-0dbf-41fb-af22-ee86969d0860", "comment": "Malware payload (Mirai)", "value": "74f368b8956535cb8af205885b492c014ddc2da2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784558135, "uuid": "89f46f38-fbc8-4539-bac7-5a4a51a78552", "comment": "Malware payload (Mirai)", "value": "58522f84e7cec96b2278aae9c8cae2e5bde7e99d75861ca1fc647969ce7e8a0c541a1a06b9f620237345f78fc37070d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558135, "uuid": "8834edab-a26e-4598-a6e6-c7da888f5d9d", "value": "T118C329A9F890DE52C6D526B6FB4E418C33231778C3DE7106CE149E3467FB95A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558135, "uuid": "13325184-bfbf-405a-8570-bc19a925869f", "value": "3072:QuIBvPRfsNDUxMa3tIDrcYEEUIAyMW0NwhBigpmqzWNiF+WOuS5mf1Dl:Qt5GytercYEEUIAyMWGwiOmqzpJom95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784558135, "uuid": "e71144e7-2e69-49f5-a0ad-9533c9ee9f4a", "value": 128444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784558135, "uuid": "a99f0ab1-fce9-4e28-a395-09a32d6ce0f9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784558135, "uuid": "d540c497-b7e0-4d3c-8a67-66558cadc5d6", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cd591f-840a-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784531434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531434, "uuid": "d6890319-362d-4a52-9cd7-aefd970acd2f", "comment": "Malware payload (RemcosRAT)", "value": "375f38e0dec2bbec13379294cc42f553", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531434, "uuid": "58ca3440-eea1-455c-ad94-b7c0c454fef3", "comment": "Malware payload (RemcosRAT)", "value": "ff756fa0b304c849de65bcad9b2c69b800f3a99e0f7f6f550616be3a9d5f44fe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531434, "uuid": "7ae6e342-6d23-41ad-b358-5472ef1abf44", "comment": "Malware payload (RemcosRAT)", "value": "6257ee2d435283a2ee271433cf88335a99432053", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784531434, "uuid": "136d17a8-c717-484d-8d8b-6958a6d2d97d", "comment": "Malware payload (RemcosRAT)", "value": "a02d51927a392c60d49695e76bcb5c9909fb2467969ca196f205c903cfb1423483bc5c6c16ada489e84460876e27a9b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531434, "uuid": "70d9cba4-ffbd-48ae-ac4e-1db28a26fa4a", "value": "T143834960CA62017B4F83BB98FCA58660C57D8316853305F1F6DAC70D9109DECE779AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531434, "uuid": "74e7bd7e-6a51-4d1f-b589-9b8f5c79e195", "value": "1536:/t7629XA7cWFOASwv/nea8M6HgwFudMbaRHzIXMqc:/V629XAcWoASwv/ea8M6H7FudMWRTIX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784531434, "uuid": "97a5cc01-2b8c-4b19-aa61-6e25d3793f93", "value": 82427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784531434, "uuid": "529899a1-3df6-49b6-abad-50428b252b91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784531434, "uuid": "93c5f750-1059-42bd-8d5c-8802640f71ca", "value": "Spezifikationen fur Materialien und Artikel.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a4e26a-8463-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784569947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784569947, "uuid": "c7e62a38-f295-46c4-9723-4415b407e7d8", "comment": "Malware payload", "value": "ba67288a05cab908dcebe00878bf9024", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784569947, "uuid": "8fd39eba-2463-48f0-a30d-375b4df6d982", "comment": "Malware payload", "value": "ff88381a9962ec47e8c9ebf7624ad2cb5c10ec95ff6eacf235a6e0968a890f2a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784569947, "uuid": "41c67d3a-40ea-4408-b82e-ae1021236c0c", "comment": "Malware payload", "value": "55c7111e401ba12047133ae8ab5ca236006412a0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784569947, "uuid": "af15863d-051e-484e-afd8-af53ae64a32a", "comment": "Malware payload", "value": "9e91071e314434e2210eec992d45069e7ea3862475939a40708d774c3692b7b081543477cdfff4cf6f96c3c18cd527c1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784569947, "uuid": "f1ff517c-b89c-4a01-8f5d-0cfda2e6d36d", "value": "T15CE6332865E052BDD277003CEEF22182D66674AB0736C5DF1BB88BF52E172E0493D75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784569947, "uuid": "1bf49754-ec41-46fe-bfb7-1952e7050b9e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784569947, "uuid": "821eeba3-6f59-46bd-b3a4-0ff5ca4a8138", "value": "393216:1EtXgmcd80i4HLQ0xtlMXMCHWUjXicuI3/PGTAI:1Ch2LpRMXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784569947, "uuid": "bafa90dc-6147-4ef7-a224-3bfa18c6ab91", "value": 14281422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784569947, "uuid": "7b8ec70e-0c93-4ba3-bc35-75fc1139efd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784569947, "uuid": "08f2d358-f06a-44d5-821d-c11a3345f488", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80ba467-83d6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784509392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509392, "uuid": "6ce62b07-6367-4ca9-93a1-e6371e22a9e5", "comment": "Malware payload (Mirai)", "value": "0e603fdc076b57686e2f760a404b8b59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509392, "uuid": "08610663-56b8-4e85-9750-ba3914c5086d", "comment": "Malware payload (Mirai)", "value": "ffd0d42db56574e5cdcf9c1c898cd900ed7b71bf799f8212a6a08c235ac76d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509392, "uuid": "13d3b8de-6bc0-4e38-a427-db4bf9efcb97", "comment": "Malware payload (Mirai)", "value": "71b4f8e0ae93382733d003663eb2c9b15f0febad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784509392, "uuid": "4ff7a6fb-07f3-459f-84c5-b065c63a7cb1", "comment": "Malware payload (Mirai)", "value": "6404b46233b5f61425580c9d58919c7d2a840ffe4fbe7e271f6eed7dd8570da48dce02ff8e72d20e0bafad3d9fa08cd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509392, "uuid": "58e480a8-165d-41b5-8cfc-4d7edc192f19", "value": "T1D713E18DE1D4A95BCD6D6CB7C49E07703DDE818323CB1ADA6349CC98AE35A4B35910F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509392, "uuid": "d0226f59-5e60-4385-8cb8-ec37a1a31202", "value": "768:tx4mYFaluq7c2hrjYJO5AhCA7ks2Q4kUx8vdgBxTgO5qJ5a4RvSxmtyCm0aJ0WHP:txhYYuqYZJOFE20d+xTfzSSxVCmlpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784509392, "uuid": "6381483e-f704-4346-b5d2-3316abb45b70", "value": 44524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784509392, "uuid": "291cad87-1318-4343-9bda-cb713317c66b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784509392, "uuid": "63a4276e-a7c2-44c4-ac6d-f0a19dd0eab3", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }