{ "Event": { "published": true, "date": "2026-01-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-08", "timestamp": 1767916982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "bbdb8d77-6990-40eb-96c0-98dc7ae616e1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c447bf-ecc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767901208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901208, "uuid": "3ce19d01-0205-4636-b357-f7a1d58e7d56", "comment": "Malware payload", "value": "8b6807b6a7479a2e770eb11a14de8e2e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901208, "uuid": "08df5a67-306a-46e0-a9bb-24fffece05f0", "comment": "Malware payload", "value": "01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901208, "uuid": "49619cc8-3edd-4424-98dc-b2409c156a42", "comment": "Malware payload", "value": "872a4a2ca24f5bf73b67e86243609ca93f90eb95", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901208, "uuid": "bf9c9548-ba32-4694-9dab-c9a78ab400d2", "comment": "Malware payload", "value": "e6466acd8a18978b204068e11b2162cf2d1ffe773b27669b919493e3d45eaef68ee3726069ce93a964dc9fbf8e985609", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767901208, "uuid": "d6861022-a6f7-4af0-8253-22442f964c4d", "value": "T1B60102212C004D385572C1F598E7E53CFF52305701048C05BA9C62A36F717C7C9D36E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767901208, "uuid": "28adcc01-4d37-44c3-9681-51a9c8d78ce7", "value": "12:tqgkG6QclfhfuDiOF0XDfczMJCWbcTn12luMCg+zdMCVDwI8/KPiGWgGf:syspGWlzKMFE2luMCggTVW/Yen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767901208, "uuid": "2cee7e94-d06d-465b-91f2-a64514266c0a", "value": 663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767901208, "uuid": "1adbf52b-3018-4834-8895-de7b7499a974", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767901208, "uuid": "46b4c945-2a20-4974-8ec5-5d17fa01a961", "value": "Trump's Former Russia Adviser Claims Moscow Offered US Free Rein in Venezuela in Exchange for Ukraine.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd1572a-eca3-11f0-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1767884902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884902, "uuid": "747e3bf1-e6eb-46f3-a514-e1e5124350f8", "comment": "Malware payload (PureCrypter)", "value": "d32175880985f3095418f2f5db2eaab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884902, "uuid": "2724bcca-b03f-4dd0-ae5f-8c56fe2e41c2", "comment": "Malware payload (PureCrypter)", "value": "039d9ea659f231a826c3340efd5f5894517f174d31b4ad7805c631d2b101dac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884902, "uuid": "756ec9d2-b9c4-4b72-b6f2-b4417b38321c", "comment": "Malware payload (PureCrypter)", "value": "bf634605a1d106d8f84688d84f833efcd59e8992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884902, "uuid": "cf5fa000-44a8-4a44-8bde-74b32799737d", "comment": "Malware payload (PureCrypter)", "value": "f386d235f72deaa773188177beb5518b7c909370839e7d03b84494b68c5b214497208f7de7e6dd18cee75f9555a88630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884902, "uuid": "498d4351-620c-4660-93da-bf57039cdbf6", "value": "T186C63314622044EDFCE3D13BA59150E2B7F2B5255B31CADB0BA852993F67BF25D3CA08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884902, "uuid": "bcae255f-9a33-431d-a38f-a5a9c957fac1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884902, "uuid": "cfb27a4c-4ead-470d-9f37-f80dbab0c9ee", "value": "196608:hFUhyslgTSJIeRo+jFgaIAjNyMzEltbW897GGr1LDsBTG9WdvWQ4a/R6f:hOysfuSfdjcMo1N3sB15WQzAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767884902, "uuid": "3bd5c3e5-eab6-4719-bc04-ad802a6ef61f", "value": 12608504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767884902, "uuid": "e6d5be1b-c6fa-459b-b8a8-c3f9ce63c3cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884902, "uuid": "42f224a6-157f-4528-913b-e39a4da01f06", "value": "x039d9ea659f231a826c3340efd5f5894517f174d31b4ad7805c631d2b101dac2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfa8c50-ec74-11f0-a129-42010a9c0007", "comment": "Malware payload (DeerStealer)", "timestamp": 1767864765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767864765, "uuid": "67af2034-03f5-4d5c-a6ba-0d9287f268a1", "comment": "Malware payload (DeerStealer)", "value": "0e06addb6c3991067f6a19cd71ecaf85", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767864765, "uuid": "1670ec50-c2f1-4dab-9ce2-4c1e2c894573", "comment": "Malware payload (DeerStealer)", "value": "03d82d139e426e0681491151774ecb233deadc70851328a3ce623dcf8988baa8", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767864765, "uuid": "5d1ba9ce-a75c-4bf4-b7d7-44734fbd0bec", "comment": "Malware payload (DeerStealer)", "value": "16f99c369dc1c65e5cb8fa2e6a2731f4f180bc09", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767864765, "uuid": "a619db8d-1cc2-495d-b6c3-9288c80ef85c", "comment": "Malware payload (DeerStealer)", "value": "be3228260d94c8ffb78eb16eb82a4b811d35e61001229c580b7c053c317bf975dbd006d449842bc7d18fdba0907a2378", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767864765, "uuid": "df3ede71-7715-4d89-932a-9d2218108003", "value": "T14847CF92B6838172D8D282B99A1F673F817AB956871182C3D39C7F4999703E11F3B707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767864765, "uuid": "17996e17-4bb7-459a-8ebb-602f21456300", "value": "393216:kb5ffm/KInNb7iPdJsv6tWKFdu9CNxryw2oxuCp8NDUFsLQsK:kBfmFnN0pywJxJiNDKsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767864765, "uuid": "03ed7442-87ca-463c-b90e-209963ce40eb", "value": 26424821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767864765, "uuid": "1fad42e5-09d7-4f61-b98a-db016a74cf22", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767864765, "uuid": "5b3e4399-1c0c-481c-9af7-e7c85eb90ef1", "value": "a.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42d2a43-ec5f-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767855623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855623, "uuid": "bacdcc9a-50f0-4916-8de1-c1deda5c90de", "comment": "Malware payload (Formbook)", "value": "3784005422d903fb93584e310eeefbde", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855623, "uuid": "71e76dba-68bd-4a1b-b711-547034f42d8c", "comment": "Malware payload (Formbook)", "value": "042567731948c9a3c463b959334ab3462d92c56c7e0086d897e7fbfb2aecc83e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855623, "uuid": "d3497f0a-e9f6-4a0d-95a3-7a2a02b9323f", "comment": "Malware payload (Formbook)", "value": "a470527fac22c3db634f1623edd1b723d9d06c04", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855623, "uuid": "5a23ef90-4f8c-40d4-97e1-fa4f43c681f2", "comment": "Malware payload (Formbook)", "value": "76d2b72ca2482b77f46fcedf618572921fa71de1b7e383e7c4c6ea20dc621b3caaf31fdfe2c6a7e966f9d0c9e9713d62", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855623, "uuid": "a33ccb16-ca2c-487b-9446-885539b4fc24", "value": "T1C926D3F6A34D8008454D1334DF2556E4EA21088EDC678EBE3C61DADE4BB51724B3A7BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855623, "uuid": "adee227c-e657-42b2-aa0a-a5a0824c7bec", "value": "384:JITlPxTYzwXO5aHlh6JvIF1MVkwwyVNDGp/Ka3hyf3333333333333333333333c:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767855623, "uuid": "df52beaf-e8f8-4c80-b88b-05a7110e69e6", "value": 4462642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767855623, "uuid": "3841a1f4-7a6c-4f7e-aac2-6255059f1133", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855623, "uuid": "85ff0202-438c-4692-8482-2e10f794c87c", "value": "ROQ_61216ZI270.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb12d625-ec58-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767852628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767852628, "uuid": "a54109a1-b72b-4c7f-bcf0-48e69d82dc31", "comment": "Malware payload (LummaStealer)", "value": "2dead59422250009e89e5df5d8ee4b4a", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767852628, "uuid": "32ee83df-d89e-4d6c-a954-bf4ed77e2220", "comment": "Malware payload (LummaStealer)", "value": "082cefa4daf662f5e1358779c49347c997938675ba134b939a81a9557ce0b38d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767852628, "uuid": "8440c196-3485-430d-9ee9-843d7ebf8c42", "comment": "Malware payload (LummaStealer)", "value": "174e8f4d2bebf0a11eb8db5db91e16dac5cc86dc", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767852628, "uuid": "64147874-a9eb-4876-bf0e-5a885de39854", "comment": "Malware payload (LummaStealer)", "value": "bd2a763d4ff933578f3fe70b1b14a7105187bb8567e82807e8d66754f9edb264c01b0b0b6c7126285fad55741df30fb3", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767852628, "uuid": "2cd48969-5a1e-44ed-b863-cee766965023", "value": "T1DCB6012538349167E007DCB18810B29197B07F67C7600CB6A0FFA59AA66DD3D2CAF797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767852628, "uuid": "a568330e-e159-44c4-a562-5e97c4bbabae", "value": "196608:wEXdu6cQFjUoIzZtLRzPJHY5L4ge3eIWewAnHMvKZs6J5/dNi4vn:wEXdu6QzZRRzh45sr5w7vEnr/dNi4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767852628, "uuid": "71d3bdde-3b0f-489a-a0bb-268efeb721d1", "value": 11237376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767852628, "uuid": "0f9afb89-8edc-4897-b34a-993ecae5eef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767852628, "uuid": "b7f954bd-f498-47d9-8d1c-e07b9ff84e36", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6b5c46-ecd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906423, "uuid": "72ea7804-2da8-449a-9e41-7ec8185282d7", "comment": "Malware payload (Mirai)", "value": "eba2c213c3ae9c05335ba176a04aa6fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906423, "uuid": "170c680a-25e3-4cfb-9554-1c976c9802b7", "comment": "Malware payload (Mirai)", "value": "08ac2bfeed1e019c96c644912edaedec526f5d3fc808f914ca18ebc661978f93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906423, "uuid": "8837975f-2b73-46eb-a6ed-90ac596bca5e", "comment": "Malware payload (Mirai)", "value": "6f1b890db4501951e1fa74ee8bdd52da92fca653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906423, "uuid": "6521cd8d-556f-4b30-866d-08b7051e52e3", "comment": "Malware payload (Mirai)", "value": "3a4534c0ee7a0bce6ed1d76493c4708072181af4c1653a17a95ec53791aea7cdc589201206e621d582a4304b7c7a0081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906423, "uuid": "825a767e-e451-43cd-86f2-f53b72ad929b", "value": "T1819302A0E8229562D9508936E9F0C24234DB9E7DBA7AD833375D2D34DF703CA4CE51D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906423, "uuid": "6d7df197-53e8-4176-ba38-1a6ff65c3171", "value": "1536:4sMZDC/1NT7aStIeSeGKjPqTPdOuJLeqB9z7V6d6EuASL4bEbZdobppqchoL175:4juTT+xeSdYPCdFRP3EdVrSL4bEbZduE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906423, "uuid": "8c9d9094-d9d6-44a2-96c8-85365d10c328", "value": 90204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906423, "uuid": "6bbc6293-12bf-4c03-9eca-4cf3fe0330b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906423, "uuid": "b021ce8d-72fc-4982-8156-956720e9f2be", "value": "ub8ehJSePAfc9FYqZIT6.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e94aab3-eca7-11f0-a129-42010a9c0007", "comment": "Malware payload (BRAT)", "timestamp": 1767886457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886457, "uuid": "4ad50f98-3ac8-429b-b373-6265dcecf40f", "comment": "Malware payload (BRAT)", "value": "9edcd207c071410e8361f1bddd250bc4", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886457, "uuid": "5c0a10c8-4409-4501-bca6-7fe03568cb57", "comment": "Malware payload (BRAT)", "value": "099b1152bea45c82b9bbd555854d3e3ef83cfd60849f3a7adb664228986f4e45", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886457, "uuid": "d1da8164-ec3f-4698-ae6f-3a4de219c11f", "comment": "Malware payload (BRAT)", "value": "521cd3cf06acaed9d433da2e37e08069aab1c336", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886457, "uuid": "2a978077-a918-47bf-9f4d-f5fe3f348415", "comment": "Malware payload (BRAT)", "value": "d3465562cb771978df6c5924dba0ce7a29291ce872b2554c5e4c954bbabffc519e24051e94de961b72a2919f93b32341", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886457, "uuid": "ed73c349-a74a-488b-83bb-0aed1b31f967", "value": "T19E377CC393406AE5E574B429077DEB26FCFFE54853BD5817B8AA13102B9E27B6346083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886457, "uuid": "fa52c084-a256-40b5-80e2-0a048047d956", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886457, "uuid": "17606397-0cf5-484b-a0d3-ac8c074f420a", "value": "98304:MhBNSF8q7U4F0GggaG1HCoQtGgrp3ir37rM7P9tW+byMYx14qYmxxEPCQ:eNSKqAZ1aio0U4DDbYb3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767886457, "uuid": "c6b077fa-6682-4e81-9e48-c95ee354219d", "value": 23525376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767886457, "uuid": "8da15387-7c70-4e96-a851-b617eba7f308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886457, "uuid": "c8f8a113-29c2-4ffc-a500-9845c86a896a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13de77a4-ecdc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767909041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767909041, "uuid": "d066eeb3-4319-44a8-aaa5-991c8dab8cfe", "comment": "Malware payload", "value": "306eec73497b1b6a682efa176122e868", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767909041, "uuid": "9c1d073a-5acc-4adf-88f8-3d9758bd86d4", "comment": "Malware payload", "value": "0b976889e3f947b139103d3c29cccaa5849a97415e72c6b1a54e793d6561b0a8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767909041, "uuid": "e6d04a74-cc5d-4a3c-ac34-672a6aaaf4d5", "comment": "Malware payload", "value": "6822582e2ba84aeff3ce3389ddcf3c61b439b1af", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767909041, "uuid": "870cbb76-fa12-4618-b09d-67b728ebcc60", "comment": "Malware payload", "value": "c9a80fc381575a39df8f316b3c7515e5fadef715971e73674d79799f480a775508c6ef46daecc762425894a57d452eab", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767909041, "uuid": "339aeaa7-3359-44d2-ac0b-2c634fbbf831", "value": "T11F7422FBE7FB4EACD066D1FF8566E0543468F5DA9B2906F77E610839084069233A4E4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767909041, "uuid": "c6da7fd8-1b62-414e-8304-a6ea48811bf0", "value": "b6c0704c2eed1ccfc74d0399a110c80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767909041, "uuid": "1f6be1eb-011f-4c93-9c60-3c88aed6b5c5", "value": "6144:M4XdyHx6ee1v6IxUykj7nlSOZ/u9okZsDWCPYl8kapn:M4tyHm1vnxUNj7lhA32DWCw7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767909041, "uuid": "0b8eeb3f-4d5d-45a6-806f-5ff10820daf1", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767909041, "uuid": "f56d97f3-5a8a-42df-9977-0cd30d85c5b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767909041, "uuid": "69c283b5-9e2e-4126-bfd2-e18ca400f448", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc1cbbd-eca0-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767883285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883285, "uuid": "439ace94-6013-4de0-8945-3609600f3f08", "comment": "Malware payload (AsyncRAT)", "value": "4069d21bfd62950a43ec54cd74893761", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883285, "uuid": "d75ecf4f-9659-4db8-bc50-725b4d19a274", "comment": "Malware payload (AsyncRAT)", "value": "0f523040c10857d5e03c5f0f88eefee85518ee22505f3a1f5850dcb12a70c94f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883285, "uuid": "b71da8c3-bf4f-4d23-916a-0254ec44618a", "comment": "Malware payload (AsyncRAT)", "value": "a0bec3c91c450d05d48030e44e806b36968e136e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883285, "uuid": "5b04fa0c-bf65-442d-86a7-fce9e29c5c71", "comment": "Malware payload (AsyncRAT)", "value": "10c50b3453e0765dae28e14ed0b0bf53acc5ac62dfb8f3988d47633f1fd2ad3543f160a7f7d5c87c08249181f8d0c944", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883285, "uuid": "914132a4-8449-49ae-992d-c0b178d36eb5", "value": "T1F4536A003798C966E2AD4AB8BDF2550106B5D5772102CB5E7CC414DBAB9EFCA4A133EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883285, "uuid": "422bb9d6-a140-4d80-b1e0-b18c21f66ec9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883285, "uuid": "aa0a2d7b-9651-41fb-9802-bcf9ce7a301a", "value": "1536:4qW011W1OsVtM9YHyeLGbbnwVqkGbGaJVclN:4qW0e1OItJyoGbbnM81jY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767883285, "uuid": "9d01c1c6-39ed-4af5-b48d-07553ebf4810", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767883285, "uuid": "a1020e89-5bde-48f4-b4ab-0c7d1e9f56d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883285, "uuid": "676bf521-65d4-4384-b7bc-d1843c685f49", "value": "IronStake Pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b47787-ec87-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1767872759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872759, "uuid": "9364eb11-8b88-4b3c-bcd6-d6032b1618e1", "comment": "Malware payload (GenesisStealer)", "value": "14941737243269b0a32d5f4d040722aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872759, "uuid": "b8422f47-0405-4c08-ac74-5a12b0ccbd4e", "comment": "Malware payload (GenesisStealer)", "value": "11de285d451f5f2f24fb449364ee836ea599fb0ed7863643aef43ccf888ecc26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872759, "uuid": "76af4cf6-1489-407c-9341-2ab6feeb200d", "comment": "Malware payload (GenesisStealer)", "value": "7bb9c2c259f488dc4f6cba4cd7868c8af41f942e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872759, "uuid": "42e530e3-cbdd-407f-9838-3cafac3c1546", "comment": "Malware payload (GenesisStealer)", "value": "6b12e40a1ce6d43599c125c2b4d76608b664ba0a30b18e3df294ad31905bf95b7f3ad8f2d9971f37de0b9d3cc0105f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872759, "uuid": "7242f59b-485a-4277-b151-37869c0d667a", "value": "T14618337E2FD6994EC00634BB8FE536B104D795532D22F02E626B81B9B8F8E3295741C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872759, "uuid": "1449d1e2-bc21-4338-a20d-38df95574724", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872759, "uuid": "09aa4712-03fb-4c53-9d94-fd19da83d634", "value": "1572864:tx+BWMFDe45kAUbJB6hDR6GyD1KWHsPKhwC8coHhdXmaXALwpD/n7iO2e:t4BFle45thDRuBKQ5wvS4pN2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767872759, "uuid": "c889d305-b53d-43dc-a2fd-a12bc626571a", "value": 87929539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767872759, "uuid": "9cc17f60-b41d-4b22-883b-0338a768375a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872759, "uuid": "017ec3b9-bce7-4824-88a2-db97b6cef04a", "value": "advanturelife.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6942e0ae-ec8a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767873966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873966, "uuid": "9583a036-68eb-4d79-bdd3-115e82c07dd4", "comment": "Malware payload", "value": "f663d4f703a5eca09baa4b33a0edebec", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873966, "uuid": "292d6244-0f1f-4ddc-93c4-6778f1dff58a", "comment": "Malware payload", "value": "139ce7362cae1aa48cfe4577027035706bde2e0f4e4c0d461c8ac1b1f459e33c", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873966, "uuid": "a5fdbef5-3ca6-4341-b74a-d1d5d4efb08b", "comment": "Malware payload", "value": "db107c0f1c7e55bd69d6fa1c87b435a77e0ecd8c", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873966, "uuid": "82e6e5dc-73e5-44ab-b813-3bd53bab0a77", "comment": "Malware payload", "value": "6e274ed356b1795796931a2c8faf2c1602a7192d1c0fa4049c8b3268a5b1168cad3db9c43f338db3f28f3ea6411a6fdd", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873966, "uuid": "0dba94c2-2a59-4a8c-becb-d3d799f8f3e9", "value": "T18AC7AD1663E111AAD577D138C6AB6203EB72B4072330DBDF329C43A52F63AE45D7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873966, "uuid": "c373a703-dd31-4395-994c-533695c744d7", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873966, "uuid": "d015e2b1-669b-4ec7-b78a-98881d44896f", "value": "393216:jI3gBe8bpHCebvYygICa5pbkIM4Lfc5uKEkhxQjWdHkK+UUVXpyNeG8MF8KN/67S:jdBeI7LfOCDsno80dguj3/oyngPV1Ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767873966, "uuid": "18422b7e-aa18-42f7-8a5e-40cd4400af00", "value": 57404416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767873966, "uuid": "656dd3e8-fbfe-48cd-8cc6-3e596d25aced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873966, "uuid": "0acee076-4c40-4dfa-92f2-fd848596ffa8", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5353648c-ec64-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767857608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857608, "uuid": "ac08f8ec-3744-4f65-87f9-a57fec9dddde", "comment": "Malware payload", "value": "a7e1ec3d31528dfade60490b5eed9d56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857608, "uuid": "a08d4c77-0e5c-46f1-be6b-2f160f61ecec", "comment": "Malware payload", "value": "139fc8c1f52e459b288c683e04275033704f2ec886ebef30ffe2818d7e82726b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857608, "uuid": "3126cf85-d1c9-4e19-bd38-e855bb569024", "comment": "Malware payload", "value": "5dc791c17caa34f2869ba93177ee85e738e8886a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857608, "uuid": "fb21b1b5-d653-4545-a9be-2838c3d68480", "comment": "Malware payload", "value": "39ad3958b26988373ae3a2891788d4d2909a78323c0aaab2127f41bc64d389a526a3ef4ea496b80dd8d8ec6ea43dce8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857608, "uuid": "1c3e1c1f-444f-420a-9472-9e2642194e9c", "value": "T1A1631B32BE764D2BC4C4A47661F34735F2F6878624AC891E7EA10E8CAF6465032477F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857608, "uuid": "a39a12b0-1b4d-42d4-aba2-23fb94234a0b", "value": "1536:Mzvs98NOUTWYhGhKn0z0v3rz8l3OkptR+YW55ptWX:sjIUT+c0ko/+YwWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767857608, "uuid": "ea811332-4f9f-4453-8543-80e3e9a08d29", "value": 67792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767857608, "uuid": "b6733cf7-04f6-4947-9667-f6febe1875cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857608, "uuid": "4a252fa4-473e-4648-9f49-0ed483e8043f", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06621946-ecca-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1767901288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901288, "uuid": "838551ad-9837-470a-a6bc-12f2b2d9eaf5", "comment": "Malware payload (N-able)", "value": "30dfcb40d2229ad84a767ee4f7c3b004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901288, "uuid": "368aeba2-3830-4b18-a939-2fd2ebb999b0", "comment": "Malware payload (N-able)", "value": "13b593448ccc629b176dedaaa0eca6c027ec7f7b095697d6c9d4bc5b3b8547f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901288, "uuid": "6c9702b9-e66e-4552-aec2-6a0bd08f7ac4", "comment": "Malware payload (N-able)", "value": "be8d9d7bbf64a87048ca9f004039e2c09ad2608c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901288, "uuid": "c21dfd09-2265-4e21-8b3f-50cd6e2578e4", "comment": "Malware payload (N-able)", "value": "0e6d6e5692112469e0ce17d06ec5f70a76df88fa89ed6162ae4f6170e296b9e22e7515518a35371bb70478250ba2ef81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767901288, "uuid": "81fb6685-f19d-4034-8e23-d0bc7bfa6382", "value": "T124E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767901288, "uuid": "dafedd95-8a50-4623-b516-f3289647c0be", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767901288, "uuid": "7bc742d8-e7be-4dfd-98b2-f49f54a010e8", "value": "393216:eKF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD12:HrRxvoC/7a0jUxX7h12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767901288, "uuid": "08633a2c-3cc9-4914-9b94-11297c57a140", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767901288, "uuid": "71983d43-a6b0-4415-a6b8-bdc26890695a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767901288, "uuid": "bae8873d-f9c2-4996-a6e3-3e0b075327b1", "value": "FILE0838737838838373838938736363836638736388636833839393783863JICEMANGOAGENT_470655_V10_14_4_RW.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339f796a-ecd4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767905659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905659, "uuid": "23c16c44-0d6f-4d91-a354-f31fbe72cd88", "comment": "Malware payload", "value": "16d15f54546b14f5ab97041feb891ea0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905659, "uuid": "f2478a8b-b1f1-482b-b186-cde9595c4f8b", "comment": "Malware payload", "value": "180a8a2111802322eb88389492cc7fb62411a6a4a70610993584683b93ce0000", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905659, "uuid": "ab6a1d32-0b18-4bba-86bf-65a065700f0e", "comment": "Malware payload", "value": "046eb7fda0c1e7522475d5d18ed06a4ac770ef6a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905659, "uuid": "9f993019-3ac7-49fa-8ac2-807913307eb0", "comment": "Malware payload", "value": "a5c2026a1816e9c2d1cd7e723f2a39ab3654924ce163749abcbb9fe8466c4b1e3916a0719e6a18d6e19943cc895de70c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905659, "uuid": "43fdcbfb-4635-47ec-8199-b558ff53b456", "value": "T137B5773D5C20ED29CC7E01CEB89918F8FCED5BE162B8AA27B4B75366C168BD4B40C545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905659, "uuid": "89df169c-a512-4f53-9d7f-992b8c37c498", "value": "49152:iw5OZ/rcHTnFvB0xwJOLBllooONa43xwce01oN50QkFjwaAsYNlvkXswYCFHtWTa:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767905659, "uuid": "198a5523-ba18-42ce-8d4e-1efa7e2f1353", "value": 2270678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767905659, "uuid": "4b350836-2522-41d9-bf2b-264c1dcbec6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905659, "uuid": "f130ab04-179e-4cc8-9083-e0fb68712c38", "value": "injection.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab06f9e2-ecdb-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767908865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767908865, "uuid": "ea286665-e1ff-4d72-a6b2-879810a38ebc", "comment": "Malware payload (AsyncRAT)", "value": "b637c7d8cbf206746cc89d9c4ac13a42", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767908865, "uuid": "7180f302-88d9-4c6a-bd60-ffd2751a45f9", "comment": "Malware payload (AsyncRAT)", "value": "1819dd98ca99ff72ca4d734b189cd513c78ccb83b60acf0bd92c53143513d49d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767908865, "uuid": "bc63fc87-abce-41ef-8394-a0a2c85fffa6", "comment": "Malware payload (AsyncRAT)", "value": "8d5f6d51372be2cdbf36b5ebc1be0e85a4266dcf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767908865, "uuid": "96c599f7-1aec-400d-93e8-b688a5878666", "comment": "Malware payload (AsyncRAT)", "value": "9fadd9f641d44c802c47f1c0b3c46853891f21ae3dc7f5ec48545e3597944273be4302406e9bae6a3e1ecab0d28eebc2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767908865, "uuid": "526ffb67-6d0f-4b41-9c4a-97dbf165fb11", "value": "T197737E283BE64515E4FFAF7018F23122D779F9236903EA5F289901871B23AC9CD516F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767908865, "uuid": "05079e30-22a7-4aed-baa1-48db6dbd8a27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767908865, "uuid": "4314cc7c-37b5-46c6-ab53-2739b746ffa7", "value": "1536:M+z8oKZOlTPcb76D0C0kV2q9btBVpuLJy7OcZ+d8DQ1:M7ElLM2IC0kV2q9bHViJy7OK+cQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767908865, "uuid": "0531b0eb-2d64-4536-8fc3-63dbb43b6cae", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767908865, "uuid": "3280fdb9-63b7-46d9-b261-fc9e6d343f51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767908865, "uuid": "dd53edd2-8ff0-4715-b3ed-9b202f4f2602", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db272fa-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906481, "uuid": "c7b7b30e-ebb8-421c-96ba-a1fe970b2bbc", "comment": "Malware payload (Mirai)", "value": "e3fb44b8682a60a9979acb472e087014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906481, "uuid": "496ed575-9778-482c-99b4-e63f73e92af3", "comment": "Malware payload (Mirai)", "value": "185746d95466813044d8970eaa8d48f4e8e67b59754615237f7080226db4c750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906481, "uuid": "6c7de185-65a8-44ac-b082-77540933caba", "comment": "Malware payload (Mirai)", "value": "c1bbe70fb3e8416795e0ac2538a64b4bb3940f52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906481, "uuid": "75b8547a-a4d9-4a1a-b34d-65b433edf5ef", "comment": "Malware payload (Mirai)", "value": "82a40435c74199c0e6798421947a18c275379874628220aba37349f9b40db87c6c37cbb0748b0b77edf92d281e4b3200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906481, "uuid": "7e78571c-132d-4c2b-bc70-c01c00c9e696", "value": "T10A04F747F8818B11D5C212BAFE5D128E37131BB8E3DA72129E146F2177CB96B0E3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906481, "uuid": "344c08b7-bbea-4c60-bf54-f8c7e435e38d", "value": "3072:MRbYbSZshn+NUstxHCcXe+B3iQaOka0GC9Lac0Po/tNXSc7A:MREbSGhn+N3HicXRB3naWvQac0mNXSc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906481, "uuid": "6a9a7b78-3d77-4c7c-9714-c601c00ea345", "value": 188444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906481, "uuid": "f60e7867-10ff-49a4-96e6-6302b2a1e5e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906481, "uuid": "03bd1374-9452-4f22-a053-17c35c8c2907", "value": "ub8ehJSePAfc9FYqZIT6.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a4cee3-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1767856409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856409, "uuid": "90030e2f-9536-4918-812c-21f691a7ade9", "comment": "Malware payload (PureLogsStealer)", "value": "1b279d0a71b9f7c2ed1a8d3e68b278e5", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856409, "uuid": "efc2f38a-9d28-4381-a4f4-7030382010a9", "comment": "Malware payload (PureLogsStealer)", "value": "1a1c6f1831a47e8c6d4aaf0934252100f4dffdfaf7fa7f30e0bcdedb17b149c5", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856409, "uuid": "5818de38-3e49-4a14-9a0a-7b642d4481d3", "comment": "Malware payload (PureLogsStealer)", "value": "c232430955db35f5cb98a1e30851a6b1a3c89e06", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856409, "uuid": "ab5ea03c-b18a-497e-a1bc-b430bdb93ae8", "comment": "Malware payload (PureLogsStealer)", "value": "f98ab05e2be85813e4ae1f3116c09cbaea1b05e02d349c4cd0c3f047ab5e5f33980c14a6d2e0ea7abafe75b1c573ef5e", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856409, "uuid": "bf0d1c19-b4c7-4c1a-88dd-92be6a9489c8", "value": "T12F95021589C82FB4CFAC591850FE161E53F04A8E546A798AFB33BD47EFFB944420B189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856409, "uuid": "d485180b-5e8c-422b-bc26-685ab751e680", "value": "24576:SLBoJADyigeghjBVZSd2T5yOb8PBQVEfArfdT9gEiORH1jXthq:5C0u7QH0ORo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856409, "uuid": "aa4a6b63-718a-49ed-b481-51f18273927e", "value": 1886133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856409, "uuid": "919c60e5-51d9-4f87-93b4-c2e8076cb56f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856409, "uuid": "a544a597-095d-4c76-9d7a-4390fe0857d2", "value": "RFQ 583012.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37d2655-ec85-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767871997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767871997, "uuid": "6a7bd9ea-a405-443d-9e7b-a6f5fe7f90b0", "comment": "Malware payload (SalatStealer)", "value": "cb8272847b94bf2fb6bffa78b8c74316", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767871997, "uuid": "526081f6-e98d-41c3-b8ff-9e37ab7dcd7c", "comment": "Malware payload (SalatStealer)", "value": "1b2af9e5b82f7eeb0e76783e5395bbadea48cc9df041b5a0cf873973584f778a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767871997, "uuid": "98b4b06b-e9fb-4b51-af11-f13247b3c64a", "comment": "Malware payload (SalatStealer)", "value": "512a8440c46d1cbd08d93aff433a8972f8a8abfb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767871997, "uuid": "b985c00b-94f5-48fc-80f5-a54e221e5fa2", "comment": "Malware payload (SalatStealer)", "value": "6fb5544e59857131056f23197018ccdfc53797c8ed124abae9d0f31190be6e970bc121aca383de9f4fb3aba1b57bc8a3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767871997, "uuid": "45db8226-918f-4fd4-9ca6-1b355c5692c9", "value": "T11CE533DC13D41A09C1BAAB39F8541205588C3B728E57329DFC9A152700BFB716B77AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767871997, "uuid": "d553e4c1-9c42-4487-b183-1f6e72c4879b", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767871997, "uuid": "fa079464-5964-4d4d-a24b-887679a3cc29", "value": "49152:/AXwKdVFL9d0gOVVn8SATxBpBpAIcsdqmj5SnkTbiY6WhZ/X3rYCZJIj03v:/AX/bFL9+gcW/TbpBSIdqmVTRhlrZI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767871997, "uuid": "ada56c8d-58cf-4eb5-8d82-c64e68a486aa", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767871997, "uuid": "d6bf7bc1-2c06-4ee6-82e6-d46a0e18d197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767871997, "uuid": "5d2a35c5-64c0-4dea-b45c-1dd372050012", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fdd03d-ec8c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767874710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874710, "uuid": "5457d17d-fe12-4e78-b965-1450ed88b6ce", "comment": "Malware payload", "value": "8278051f2b9dff368c6b48ebe37ff36c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874710, "uuid": "56ded796-cb2d-4fa4-bbcf-bd61611894fa", "comment": "Malware payload", "value": "21338a7e573c8fbb2a8dd334c8d94d6d3532cf168bed93064eb00f26ddff176d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874710, "uuid": "44ad2f68-faa8-452c-a901-4a42b1f48e13", "comment": "Malware payload", "value": "5319205a1bfce8dfd51c33a2692f2aed9ed6d676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874710, "uuid": "bc54375b-79fb-4cfd-b2b2-70e4ee492ca3", "comment": "Malware payload", "value": "a21b3766b4bbf6a0b00d20032d5749fc9b0a6e7d8f88ae43cc09d207b69513385e8e196b4dfd12971c32c35ad2d5287e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874710, "uuid": "8bbccee1-cf73-4d9e-94f0-b268b2adbeea", "value": "T1C9187C5263FA09D6E9FB9A3489E65213D633BC062F3086DF324C176A1F736E04976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874710, "uuid": "88ad6682-3756-4d05-b435-d0b0340206b4", "value": "764090509664248d5254caeebe1e7af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874710, "uuid": "dc89a246-0af9-47ce-842d-e996aa431c8e", "value": "786432:4lI33vITTYy/5AYtzT/9tf6QvpgPVlcm2wK:H33QTTYA6V0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767874710, "uuid": "ffa2d49a-5f50-4b2c-aec4-c2bf1dc6772c", "value": 86140410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767874710, "uuid": "182343fa-7dc8-43b4-b736-b54311bb4f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874710, "uuid": "ad9b65b8-9a97-44dc-87d7-d1c9d89291aa", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed78b14-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767856339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856339, "uuid": "61125d52-f66e-4496-8340-38019921d328", "comment": "Malware payload", "value": "59792ac342266af95efb43bafed0c5cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856339, "uuid": "ddde886a-7575-4766-b48c-277b7fab7d8f", "comment": "Malware payload", "value": "220e61256c029d2916f4a789055c8c7c1ebd90dbcf8d461a26eb3559a8e649fe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856339, "uuid": "e6c34da2-0dbc-42ba-8eba-aa4e3bc53c71", "comment": "Malware payload", "value": "a1d24aba17f2c5104504e670233c3bfd0e82b14b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856339, "uuid": "8df72fe1-e168-4f23-8bce-59b07750485a", "comment": "Malware payload", "value": "a6971661b1fcc4ff4095b8e5de977bbac63af2d9dd94f628c9bde484428ab9c76851327faad7e5b6f429cd03d4610df1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856339, "uuid": "0541dffa-3511-45ed-a006-62372f3e0f47", "value": "T1F11693639A2802B5C1F5CC038A3DFC7ED65AAC8F0A72C56D71C486DF5B62094562CBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856339, "uuid": "9c70c15d-d243-446b-935a-38a637cd266b", "value": "192:09wavpnJdM0qNE+9MzBnd9GpkKPmPnzB9wzPy59drCTdY5zmVcTXEpQ3jcq3JWK8:0ZzhIoipDBOhEX91xdAHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856339, "uuid": "b077c34c-3926-4dd2-a6c0-5c50d304f563", "value": 4035733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856339, "uuid": "b826b26f-309a-441b-bb67-18b65bc0a38a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856339, "uuid": "c75c25ed-7be2-4363-bfff-f775476b81a7", "value": "Order_0394.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7849355-ec97-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1767879708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879708, "uuid": "3ee6b6b3-8f8d-4265-96b2-eca599d512fc", "comment": "Malware payload (MassLogger)", "value": "4c512a7cdba038bdd857358e699b49e4", "object_relation": "md5", "Tag": [ { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879708, "uuid": "30a72438-478e-4aec-843b-9eacf25df230", "comment": "Malware payload (MassLogger)", "value": "241776fc69196b89dd17f06ccba50bd0d00dd1422c4ffbd1230eb828b021853b", "object_relation": "sha256", "Tag": [ { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879708, "uuid": "fb0a24bc-65b6-434d-af4d-863444fc7820", "comment": "Malware payload (MassLogger)", "value": "7f9fabe67ce215b637b4f5d188b726cfeed02c2d", "object_relation": "sha1", "Tag": [ { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879708, "uuid": "fc27bae8-3089-4fc3-aab4-bbc969bd472f", "comment": "Malware payload (MassLogger)", "value": "20ec4d2ef8dcba6db50939b2a61b1d869f9a6b835c9805a5005de649e5a6d5dc41b68382a3d6702554b6f1775f86218e", "object_relation": "sha3-384", "Tag": [ { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767879708, "uuid": "06ee818a-bba9-4e87-a6c7-9573fc591e2c", "value": "T1FFA423F90E49C69838565F6756FD0CD9E30B8E0B221C4AA0F5C563DB4C88A6F5DBE701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767879708, "uuid": "599bc8ae-6159-4f0b-b27d-10f0bde66d8c", "value": "12288:EhT2WLGidCDu4r5gmGg0FCoPJ5VSsUezgEPPJM:EhT5dwu4W3FCsJnfUezdHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767879708, "uuid": "b85e9eb8-6087-4bef-ba23-08f777aee42e", "value": 491962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767879708, "uuid": "d6b976eb-363c-4d39-aeb0-19ae0f01d97d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767879708, "uuid": "fb2693f2-47eb-4c4d-aae5-94ea751fa750", "value": "Request for Quotation - 171595.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b6dabf-ec79-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767866712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866712, "uuid": "91707837-778e-40bc-a158-2f4d90d77999", "comment": "Malware payload", "value": "177fb4d897d8f56e3376e8f9cc7d4754", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866712, "uuid": "7e4aaea3-52d3-4137-a310-38af7a72a4c2", "comment": "Malware payload", "value": "24623ef6a9a942f3fdb278de3886461840aeb341c833cc65d8dd98cc0223f71a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866712, "uuid": "a2f8bd66-6f94-42b5-a270-2ca600883bd7", "comment": "Malware payload", "value": "6f162f575c846a2f8f9b7f433a66d10464ef5f93", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866712, "uuid": "86a97d2a-a6e5-4fa2-96c5-d0ffcd4aba79", "comment": "Malware payload", "value": "83d13c35339a28b8c95d298cbee3bf9048601651dce7a72c5d68aefb03c46f0e10df21db4c6529a440a4e22cdd7601c6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866712, "uuid": "364c6b9b-c1eb-4dd5-8d79-4087a5983ca6", "value": "T11F863383658FD352C0A658F505312B7B4ECDF178AB2A0D4DF3A61EEB98CB487D1AC950", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866712, "uuid": "50d80bde-8222-4dd2-9612-201680df4db1", "value": "325a66953f99d5c330ad41872dda2f13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866712, "uuid": "9331e595-a8af-4a24-90b0-317857e23530", "value": "196608:kxrF7b4rrmWwgDUv9M+/muIHfe+ahinNwrxyh5b06kXTi59Pn:kNRc3D9DUviM9IHfUhiE05v5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767866712, "uuid": "32317926-c296-4c3e-9ccd-a862ddaa40d6", "value": 8109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767866712, "uuid": "763e0b9f-8e57-4f81-a551-8f588718e355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866712, "uuid": "fa4b4007-e70d-44a5-81a1-b7096370bae1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10216143-ec6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767860502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860502, "uuid": "1a7854fb-c50a-4ef2-a955-9964a35c8c29", "comment": "Malware payload", "value": "c895b8b7b06490ad6befc6b19f92fcab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860502, "uuid": "fadb2310-5033-444d-a896-653dcf9f52b7", "comment": "Malware payload", "value": "2665fa72f040f6b027b2d5a6bcf3bf748428d5e28b9f257e7eb7bb64769b4a30", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860502, "uuid": "647194e4-37c9-4f3f-815b-5702ebd442fd", "comment": "Malware payload", "value": "6be8215fa498c9b0da6e37b8da5d505e6bbf4a46", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860502, "uuid": "441032c9-c945-4760-968f-016a2e6c3238", "comment": "Malware payload", "value": "4b0558b6b3b3498a8df6c9d97251beeabb62b06f2b937bfaa95f214f7924b804af35e929c0407515a6521e4b80f588cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767860502, "uuid": "778a96b6-77f1-45cc-931b-f24cd131a987", "value": "T134E2F922FDA5903602678199F7BBA709F331504BCA04CA10F6FC866A6FD9E42CC579DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767860502, "uuid": "5265ca7f-e706-49d6-8206-1362652a4de5", "value": "768:M5RHm8ia7zHqrqsCVonKOBbK6KftIVUfDx/Y:M5RHm8imH1VoPbjctIKx/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767860502, "uuid": "a7d8ff4e-99d9-4958-97e8-129523a8853d", "value": 33896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767860502, "uuid": "6cfbc720-5591-4313-aa98-f023a4f2494c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767860502, "uuid": "08a4426f-f4e6-40a2-a0ea-b6c24c90001e", "value": "PO_N0_JKPO25040107.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ffd1d4-ec45-11f0-a129-42010a9c0007", "comment": "Malware payload (MimiKatz)", "timestamp": 1767844320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767844320, "uuid": "bc4b54d4-f338-4819-96a5-ef7e0ab6b792", "comment": "Malware payload (MimiKatz)", "value": "e333839e75109d276c9d9319d7c812be", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767844320, "uuid": "e4a507f2-8685-49f4-b43a-5ea5ea2f04de", "comment": "Malware payload (MimiKatz)", "value": "27147eb56a4cda7125349c3e2973185ed389b28548a8dc5dde404bb84adebd68", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767844320, "uuid": "2a13b702-131e-4381-b745-cbb505b2dfaa", "comment": "Malware payload (MimiKatz)", "value": "ccae8271f93bb73783295b82ffc5e12a8a91f90e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767844320, "uuid": "fb7062e3-1393-4d31-a14f-05833eafeaa4", "comment": "Malware payload (MimiKatz)", "value": "81ae1c5cdc9135088e45bbc964832c0f108f870a88b617593c7de07c9e3e4d1453f72be9e992a0d064336d0aa68a0c34", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767844320, "uuid": "713f3549-4a78-4f07-8ba7-754f173ee310", "value": "T170D5018033FC0548F2BF5B70A9B655504A77B9A7AD31D74E0A8920DD0B72B85EE61F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767844320, "uuid": "b632ea78-d69f-4d99-96a0-e783533a2c0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767844320, "uuid": "2b42961c-c39c-4b97-bbe0-6235d16ff41d", "value": "49152:l/SL+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcmcH:FSL+2upjBVGVl/lQrCSZ4183Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767844320, "uuid": "20896a8f-6e4d-4f52-8056-3525785cc2f5", "value": 2867200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767844320, "uuid": "d9687a3d-48f8-42dd-a2dc-db804257f93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767844320, "uuid": "8a7f0a4a-99ef-4266-9130-b2081e6163ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb82dfe-ecd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906426, "uuid": "fe22f88c-c167-4c6e-9c96-a69711848d7a", "comment": "Malware payload (Mirai)", "value": "c4c9f00c1cd6785832bd9435f66db5ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906426, "uuid": "19bb1db0-4bd4-4e8c-80b7-367df56ebea7", "comment": "Malware payload (Mirai)", "value": "273f3ab1bf0d83314b44731226447df1f641a233a967114a9bc6b30ae04a86b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906426, "uuid": "6a6fe337-0e68-4176-bead-bc9d3635a112", "comment": "Malware payload (Mirai)", "value": "3f2774a24f1679fe11a7593a6d341b2419f1ab36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906426, "uuid": "5c236d32-d727-4b2f-b177-83cd02182ea0", "comment": "Malware payload (Mirai)", "value": "d1ff1a468b6655db5716db21c2ac073ea1aab2c218050ead61f7c1c91ae3339b2d41c99b9db0c9664daffabe7549a370", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906426, "uuid": "5801c0ea-0078-4945-856a-55217853b0fb", "value": "T1F16302B3BE89AC33D4B15937585998DD2A294BB9E12F7C4400C94A7DE4D344B83EAD0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906426, "uuid": "6fe4dd14-aa5f-44e8-8588-7eb4085b7c89", "value": "1536:lEQmtfSDo4ROas49fUFI6mZiOw3D8FRv40eHs0OLp:otq848aP9T6mgzaRv40+9OLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906426, "uuid": "2cc2ed50-5ced-4f58-8dac-90b42b862342", "value": 69592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906426, "uuid": "92d3a9fa-afa7-4193-866b-e31f5655db8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906426, "uuid": "0c4d1d4c-8a61-461a-b257-4eb39f17357d", "value": "ub8ehJSePAfc9FYqZIT6.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2844e065-ecd4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767905640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905640, "uuid": "d24887e2-b12c-4202-87f0-733eab90d2b8", "comment": "Malware payload", "value": "27bb18462723379b4416ced8d7de3320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905640, "uuid": "ba4d0dac-dc25-4179-ab57-924482964a1c", "comment": "Malware payload", "value": "276313de9f5299c7c65faf2d6343e902b3561ba24eb0de749af9148304b22878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905640, "uuid": "c31c717d-5a5f-41e4-a8ed-cc4568be1892", "comment": "Malware payload", "value": "ff993d758b094e25e413c200a28e4cedebcc13b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905640, "uuid": "eced15aa-7cd4-415b-89b8-f0ec34c342b4", "comment": "Malware payload", "value": "fa7a93458d21a2e33e75f6ff1a78f74080dc44fb92ed5371fafbd4faf2de58faccc20c0796d7c2572e4d9b99fe5e84be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905640, "uuid": "b778090f-78e2-472a-b549-b894f3f0a3d9", "value": "T138F733399148200EDC74E6FA62BE6F1EB9DBFECB076D36417A570935329D724242DA30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905640, "uuid": "c4e88e36-82fb-4f3c-8622-eb2e0b17c94f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905640, "uuid": "992714dc-a169-4639-9f66-e5c1828ed2af", "value": "1572864:p4gRAGwuH+EjSgCWvFdmsz8PTyw3HJxIMHsur39WWljXOFx17:p483wu1jSCvGPTyobFHxMWpXOFf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767905640, "uuid": "e77c0d8d-0f62-4228-9b45-7b44246a9257", "value": 72028665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767905640, "uuid": "1a6dea98-e36f-4e1d-a232-961e080408b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905640, "uuid": "02d81bc3-246b-44b0-b84d-b9d3ccf7648f", "value": "Mantanos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e35c08-ecd2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767904795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904795, "uuid": "a0b3cee9-989a-4b77-ba1e-df898dc5fe7c", "comment": "Malware payload", "value": "913ebef78b388dcf56ca2ad620231a70", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904795, "uuid": "9a8e3f67-2cfd-41fc-8f86-45d4bf956d5d", "comment": "Malware payload", "value": "284387720bd2c67619657ee68c2f5b9aba2f64cda5da335eaf8503d3c4abcbb8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904795, "uuid": "dbdd47ad-74be-4d49-9247-0999c74e6e15", "comment": "Malware payload", "value": "187be653d91b0f4b271f834ee9cc9f998a415c6e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904795, "uuid": "7b77dc9b-4b0b-450f-a68a-ccc3089149e4", "comment": "Malware payload", "value": "80ce8ba8251f9699ea0399acd0a6a4807f0405a49ff8e4d058f402e24a675fbe7915db3b0304512a5f8400635323be90", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904795, "uuid": "957b2219-097e-4e03-a147-b6cee69e6d5e", "value": "T16F1125D6D1B107F41DBAA923B0BAF5C4B69040CB59F27D30E08CB4D15E4CC18B1D4762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904795, "uuid": "949ae11f-99ec-47db-aed0-d42be87cc247", "value": "12:v0FZd6Td7WErm0G0FZET/HMErm0G0FZliTUErm0J:U3G7VmQOzmQ7Qmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767904795, "uuid": "c6eed5d5-4427-48c3-b891-4303fd715e8b", "value": 865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767904795, "uuid": "f04e298e-72ea-41ab-9e19-56b611458952", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904795, "uuid": "2bf97782-5745-4569-8b99-4bc7dd96abd2", "value": "x.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b95b8d-ec6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767861047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861047, "uuid": "f423da64-1321-49b0-aba1-14f5bb664e2b", "comment": "Malware payload (Formbook)", "value": "2c09eb962e08237efdb07ed10536ed6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861047, "uuid": "b28a982e-dfdf-4bec-92b0-98a03c52311e", "comment": "Malware payload (Formbook)", "value": "28f959fc9483c245c25c6beedc3f449913aeeef3810e43bfb251bc7cb3a998f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861047, "uuid": "76ba46be-f6fc-4fb3-b577-4e782167e491", "comment": "Malware payload (Formbook)", "value": "e6a6c3c6cae05c8a7eafa623f88e481931b1f926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861047, "uuid": "d61fbb32-8c39-4700-8045-eef4320f1f97", "comment": "Malware payload (Formbook)", "value": "37cbd0389d037ce40593412d4a8cd0a1794260c7b0f180168d144dd9f1ff05d34636d3c1d079df64bfff4a245e365a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861047, "uuid": "ffde9f50-6640-4b48-8825-b7b37f1e32d2", "value": "T111F4F114235ACD07C0E24BB67871E3B47B296EDFA892E2969FC93FEFB0356410955342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861047, "uuid": "c6b7e208-494e-4397-885c-775300525bce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861047, "uuid": "5749b103-0256-4889-b1fa-96c05aad9791", "value": "12288:SKE44ctN7IBWXWWA5lDsjsx/Lcs0FYj5DfQHESq/vz9CgoF44gVeAqT3iHBrUv1g:lTrIN5lsjI0oDfaivBCgGmeAq+HBi1Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767861047, "uuid": "180ee24b-1b69-48bd-b9f1-1638bad1d383", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767861047, "uuid": "5aaef9dd-5ba9-4b0c-8ba2-d9531bf0857b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861047, "uuid": "40ec58e7-0d8e-4c79-98f5-7ba1b7d91c64", "value": "PURCHASE ORDER.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdb1d06-ec3c-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767840525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840525, "uuid": "0b078457-dd28-418f-b256-ac6be4ff2715", "comment": "Malware payload (LummaStealer)", "value": "50f7c88f51c9ad96a4c92c374d81454d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840525, "uuid": "c1a2d157-310c-4aca-b328-f82c17f69eea", "comment": "Malware payload (LummaStealer)", "value": "29ad51c0b28e248d5b4252e8b0ed08c57def0de8f5502344be9600767190f412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840525, "uuid": "b35fc09e-cfba-4388-854b-facebd919b3c", "comment": "Malware payload (LummaStealer)", "value": "6faec40aaae450c9edd2b1610d9824d6ec0e3978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840525, "uuid": "967c06ca-0f8f-433d-82cc-2e86f7d6ddb4", "comment": "Malware payload (LummaStealer)", "value": "8d2ac377c4bdee56feace8c8493326d7acf2fed9a4c07d106eea9ad6edfa4773aacccd89b54652d501ef473c7c9ed01e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840525, "uuid": "5ef75578-10d4-4724-afe0-9143475c348c", "value": "T1DEE49E22F99311FDF4B31034989DF33ADB3A3A158E159F8BD7C09B74E9702416A2661B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840525, "uuid": "8a5be96e-b58b-49cf-9061-8a862b79618a", "value": "1cb7010fa29c1205e95faaaf21e5a21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840525, "uuid": "8d6d8c1a-74d0-4667-b7fa-7f1f86ef0c79", "value": "12288:YWCXhe4mhLKlRUQGJNTXar3lSn65/QLtk:YW2mhOoQUTXars65/QR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767840525, "uuid": "5057f09d-dc69-41b9-b140-b56f3474eb81", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767840525, "uuid": "bbdda852-dc68-4a0d-bafe-764d7a4defa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840525, "uuid": "b3503d01-09be-4e69-9ddb-dfc7506d80bb", "value": "7ricubnk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8efd2d6-eca7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767886662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886662, "uuid": "d110254f-dcf0-46d7-892a-553ba88e44b2", "comment": "Malware payload", "value": "b5ccd9fb24020e8efe399476627e3172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886662, "uuid": "5e5f27f2-e94f-4fe3-aa3b-5f0f545644b9", "comment": "Malware payload", "value": "2a2d1fcf994988a3230f2a15ceb2b81354ec2f75c03b051dc8e5fc953ae6ece0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886662, "uuid": "27373367-0206-41d3-9d5c-b001f13e8067", "comment": "Malware payload", "value": "464d5d42222a5c4f94a075c8370137fa5c14c60d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886662, "uuid": "7d6cfa1c-5c4c-4601-9c3e-2db5078476ef", "comment": "Malware payload", "value": "fb7b4888b477410fa3ef179733b30904522215df7b16409a117fd83885865cc497b62e79c58c04425ac56753a8dcb359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886662, "uuid": "f93cc675-9bcf-4a47-a31a-d7a6a5bc6cd2", "value": "T1F00723C37AEAE29CC0870B343AC653C921D4728D84FF4A5E39CF5C076591E1A89DD5BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886662, "uuid": "f8adb47c-d9fd-4a4e-bde7-1d9a1e44f13d", "value": "687080897b5f9d8eacdb5b351bf1908d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886662, "uuid": "9945f340-072b-471c-a024-868ecdcd4271", "value": "393216:NmNZJo+c5tXvLJh7GHBuzVa4w3ReJofmEqMXNi3Dm9t+Z0xf:qZrc3vLJhaHBuzUT3cofmjCY8sZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767886662, "uuid": "6d68967e-61f2-45fe-af3e-d47b0fcf8aa9", "value": 17386496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767886662, "uuid": "915aa2bf-ad16-4203-b737-93ad997bf284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886662, "uuid": "aa03eef4-d98f-4ff3-8dd5-73f0c7679f8c", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177f3afe-ec35-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1767837322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837322, "uuid": "89a996c6-d780-4297-8c6d-3e4289227ec5", "comment": "Malware payload (Gh0stRAT)", "value": "b7dfdd6befc62f6c56eebe3d84d57e07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837322, "uuid": "bf84efe9-5aae-4841-90dd-0fb5b3a48a28", "comment": "Malware payload (Gh0stRAT)", "value": "2b71f6d1eceed86198744b55ee685efb9088a26b7b48be758c175fc7ca670b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837322, "uuid": "ef9ec3d0-387d-4c8d-b79e-8c5d9277cec1", "comment": "Malware payload (Gh0stRAT)", "value": "3569959322adebe67804d746e69c0eabdff60d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837322, "uuid": "fcef37c8-6042-40f5-a787-644623ccbeb2", "comment": "Malware payload (Gh0stRAT)", "value": "e3c75c21b170657b6e4b2395d1068d7a0c0253eb0df55555353f5188ec718f2db84de8e22cba9d8506173145d2340ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837322, "uuid": "6e24a142-e551-48d0-9c2b-72de61bed549", "value": "T1CFF74B96BB43DD93F54692759C5B87907372F8F40EA08303329C672C6FAE3489DE25A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837322, "uuid": "f8ddd593-2631-4ddc-a217-9fe97aabcb68", "value": "c1388db37310975dc1b57400c24d2627", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837322, "uuid": "59bad714-1348-42ff-a157-47be51b7ca37", "value": "196608:evDqbMx1LDCXFIqfoeO0so/h7c2Q+JBYaQi7ZkfvVsKj2wlmDJiAucxDwGjXT7Ha:9wsXhLQE7Qi7JDDJkcxnjXXxzAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767837322, "uuid": "ca28cf47-30ca-4ba7-902a-f39508aafb32", "value": 72464480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767837322, "uuid": "a6544743-01c8-44bb-8d72-2853e2dbfe4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837322, "uuid": "a9fa8e45-7931-4b72-bc13-c34049f82181", "value": "asn.866321005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16b31a5-ec60-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767856129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856129, "uuid": "6707d6c4-ce72-4b43-8ba9-15192044c697", "comment": "Malware payload (Formbook)", "value": "7fcd49b3cef838cc7c392b254c3fafb8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856129, "uuid": "006fd7c1-bceb-41a6-8ce8-f27dcb6f8028", "comment": "Malware payload (Formbook)", "value": "2c28019dd1b9b7e8f6590e957510da44f079e74a1883d8fcdea38f8263c708b7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856129, "uuid": "dc387f64-4364-4b74-a599-645913727cd3", "comment": "Malware payload (Formbook)", "value": "d2ae9cef12b168f512b925041df7a6e58c4f22fc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856129, "uuid": "29790870-5956-4e89-b12a-7697a0a0df7e", "comment": "Malware payload (Formbook)", "value": "6b28745e38346b7483bd71c5457dd99b62c220d14c68fff9539a0cde91a591d1c06f8f02997c3f2351a535dac4ba2d6c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856129, "uuid": "27ee4269-91d7-45e5-9865-21c860b08b4b", "value": "T1A216E50FA14D29A8F634A2C15D0EE45AF43E49D55A6BB27E3EC4FCD46FE10F05278A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856129, "uuid": "deb43c4f-4446-4a4f-b88b-59f7ca5c33e8", "value": "384:ceqHp51UVG3NLJZDKH74DL0BXfLyoapF101s0uINn/y1E1APP9O1G1d1ebJZ1v1g:Pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856129, "uuid": "b2be3f4e-cdf2-4d50-9bff-87c18c682b1e", "value": 4201691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856129, "uuid": "1f5d50fc-066c-44cb-a66e-3a45c6161c4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856129, "uuid": "b2c94f6d-6bcd-4897-99f4-088529dbb7f2", "value": "\u03a0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1_676.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7f3e62-eccc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767902157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767902157, "uuid": "fda88d9c-d953-4ac3-a19c-33e158dae57f", "comment": "Malware payload", "value": "f27918bb04406914614ef5665493bbfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767902157, "uuid": "c194b9c6-a4c2-4e6a-b903-76f6bbca2bfc", "comment": "Malware payload", "value": "2e17c6be77af380ef919edd9c666cc3bd39d876092a2601f9ee21b3782ad354a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767902157, "uuid": "8d298f1f-f0ac-4bd9-a793-1039acc658e3", "comment": "Malware payload", "value": "9df8ac7695f16763891a90a2945b1c4224ea58bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767902157, "uuid": "a126410d-cbda-4021-acfe-68950a0958d9", "comment": "Malware payload", "value": "48642f8b3b112cc9c9fcc42ed1c3ac4be45aa3e74e506b74f72df6e992e18038e65e673ba8a2758799cc98d1808055d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767902157, "uuid": "e20e115f-e3a5-4ac5-8e3c-d36cd74724dd", "value": "T17AF623C27AD9D2ACC4A74A346A86074571F1B28DD4FB4A1F37CF1D0376A0E578A4A4B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767902157, "uuid": "9786cb3c-d0f3-41a0-902a-fb8ca6f0c052", "value": "687080897b5f9d8eacdb5b351bf1908d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767902157, "uuid": "791a2ceb-96b2-4f27-ae32-dc0896e56070", "value": "393216:H1qvLncBzSJUz3AQa2aAXReJofm9+265jVafmGy4Qb9K:H1PBzSJUJaTAXcofm9GjV4mRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767902157, "uuid": "657f4f80-c398-443a-8ca9-caf8075c701c", "value": 15907840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767902157, "uuid": "0acac05f-d64a-43e8-ba1b-68123ef730fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767902157, "uuid": "1a92da92-a203-4678-9961-6a5c7e71b18b", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf1abfa-eca1-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1767883960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883960, "uuid": "448f8c3c-854e-476e-9cc5-d73aa913f2ba", "comment": "Malware payload (MaskGramStealer)", "value": "449391a04e9f7aee985783decaafdc15", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883960, "uuid": "9ef358b3-a7a1-4619-87a7-3f6480a908b7", "comment": "Malware payload (MaskGramStealer)", "value": "30a28900f6d7c6cd2882ad80a548368e8131bf2042fcfe25ea2ff2e016de5098", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883960, "uuid": "31d60bea-5d9f-4960-a15b-c954e69d2a94", "comment": "Malware payload (MaskGramStealer)", "value": "0b75b81bf7498bb54fca61a6385be82adf3ace36", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883960, "uuid": "d48377bd-ac26-487c-bebd-1fda2beeb39e", "comment": "Malware payload (MaskGramStealer)", "value": "bda62addb70696fbdb8bafbd4ce268f93976393dbaafa4b55717582ab635a06b7fb2f3aab7ee22446cdc78bee66797fb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883960, "uuid": "ba33a127-80c3-45d3-a72a-7e4c460c5198", "value": "T1B3C32BA3D99180F8D42AC17889DBE33E69B3B4811679754E5DE0AF021EB2770F319F49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883960, "uuid": "dde2dae7-1906-40d1-bc87-c602c1223d0b", "value": "b48b4dde0f2f8c05521ed25ad452dd8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883960, "uuid": "0d711944-7914-4f4f-8b54-0eb7d1fbeed6", "value": "3072:aoXmXKkkNHfnuI2s+1YnwjZw++LIHI3q5H73zdIu:aoXmXK3xV2s+1GwjZ/33H73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767883960, "uuid": "8e3b3941-ac1b-4a6b-9609-080bd8389585", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767883960, "uuid": "c1338a07-0a47-476f-9242-9ca7b8f547af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883960, "uuid": "cb50e2ab-0c57-4399-98b6-8b03f862961b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e00698-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1767856195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856195, "uuid": "58168735-3884-45ed-ba62-c27aee29deac", "comment": "Malware payload (RemcosRAT)", "value": "b32637253b278987417e08bb50c28564", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856195, "uuid": "81a27f11-4059-4ac1-ba08-005db2f1961a", "comment": "Malware payload (RemcosRAT)", "value": "315ef8a7c6950f41ad85ac91b89a9526312184bd127118466ad4300f883a000d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856195, "uuid": "cf71cbe8-fada-4e57-9f40-86bf2dbc86c0", "comment": "Malware payload (RemcosRAT)", "value": "4f36b45977c9734e89f21b196e309cd2b53b9891", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856195, "uuid": "690e68c4-fb5e-4f82-928e-dff5d7232c50", "comment": "Malware payload (RemcosRAT)", "value": "b13cafe4b179cf22097f116195f8810287240753dd625bf80b786cc49a157374ea2cc181c0a37cd2de406a008bcbc7a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856195, "uuid": "012e8da7-d829-4182-b174-2189237007df", "value": "T12346721D74E20143E8167AFE4E3DA6E44C0E7E176AD21C8B3129B65B707DC99E620E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856195, "uuid": "f291ae7b-188b-4584-aeaf-3ade0ed64b45", "value": "49152:11kRAA7lnb832R1dWj/tlRjq/zB6fZ739RNAucf/jOPIUusIKwHnqhrnkZ8cA:110AAJnbiq1dc/p0zWIUeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856195, "uuid": "b5c5d9f7-7de3-46cc-be12-30b6a8cc2fae", "value": 5828814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856195, "uuid": "1dd7b372-e3a5-4bda-85e8-de0a3db5b1ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856195, "uuid": "8c2873d1-00a3-4308-89fb-15c0c54b02b8", "value": "POPRINT_AT___2663_1_06_01_2026_5_56_36_PM_PDF(~544 KB).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f4c14d-ec36-11f0-a129-42010a9c0007", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1767837963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837963, "uuid": "c63cf7cb-6933-4d3e-be23-4ad68eb08ac1", "comment": "Malware payload (Cobalt Strike)", "value": "06267383790ba82f36a5da8614296f8e", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837963, "uuid": "dfce304e-aed7-459b-a4db-dea45609def0", "comment": "Malware payload (Cobalt Strike)", "value": "316b0ed598d0587a567220ea8dac7988e905884bbe5d8e927e1d03b0d4acd6a4", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837963, "uuid": "3321701d-54a2-4086-9403-e5442219d842", "comment": "Malware payload (Cobalt Strike)", "value": "0793abb9e6c80fb8b8e830ab68b62e2189f49fba", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837963, "uuid": "4c73f76b-05a5-4ac4-a843-e64d49d97180", "comment": "Malware payload (Cobalt Strike)", "value": "bd5c3ee25e98d10c1b93777d2f604bdb833f83030ea4f851c81f3dc0057ea3af5dc90f7c829c65e02f13ad9d40c7c91f", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837963, "uuid": "8badb44e-41ee-4067-9c91-1af3e879bc62", "value": "T1F5533FD53AD95CC6EF00627D51EA9336263CFAD0CA835B1B663076321E12FD13ED621A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837963, "uuid": "6b116765-a2b3-4f38-8f4f-fa9fcbea42f2", "value": "da36125deb24d606380bce8191d29e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837963, "uuid": "5995f3cd-4506-4b0b-b1c8-70fb77516406", "value": "768:HQmE7O7UotFrxjmaWtItE+im6gvqWddoCWmQuD+rPdlxPoqQd+7tLVT:wBzofFjmKim6+qWddo5lHJoqQd+7fT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767837963, "uuid": "a8867994-d354-41d9-8b65-1dbe18915ed3", "value": 65543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767837963, "uuid": "59fb8e3b-fa2b-481e-96d2-b8877da5f865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837963, "uuid": "3d2adcd5-55f5-4999-84de-509bf753694f", "value": "\u5173\u4e8e\u6625\u8282\u5047\u65e5\u8c03\u4f11\u901a\u77e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8141e85-eca3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767884916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884916, "uuid": "2bcedf6e-3bfb-4065-b2a5-d84aeeda56db", "comment": "Malware payload", "value": "b7f94cfbe7014702a4695dd69a71115b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884916, "uuid": "fcd0ba7f-156c-42d6-be12-2cd76bb26e9d", "comment": "Malware payload", "value": "3219302d6aa4e99e96d2031e4f851dea1ff1be8e88312806931ca5dfdf703270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884916, "uuid": "a4088c94-6b8d-4c4f-96e0-6a8e55a5d106", "comment": "Malware payload", "value": "59164e86c7bf34ce1f074cce3107dd72364d6221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884916, "uuid": "6172501b-326a-4347-8e8d-1b91b81436a2", "comment": "Malware payload", "value": "aafdf43c23da3a42b3d20b93fb5a3531e987aa5f904034ffe97859de7fd0966541934f3d2e7d9cde43cbaa3e31ca0b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884916, "uuid": "84e03865-dd01-4f3d-a66c-09be260b8a44", "value": "T1E394ADCC755072DFC85BD4B2DAA85C64AB9078B7930F9203E41316ADAA0D99BCF590F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884916, "uuid": "79db778b-e416-4ec7-a784-cad397cfd9c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884916, "uuid": "94ad7cb9-ce08-4011-be6d-dac971b7ccef", "value": "12288:CR1MoNOKDDvWd+Pmoc/6ACI/GtTPJTRlCtBnzob1hIIy5pUB:CUo4SCUmmTIs5eX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767884916, "uuid": "5bf6c869-aa7d-490b-84df-1531d21f0dd8", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767884916, "uuid": "d648f56c-afef-4c96-a223-e203cd8c4368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884916, "uuid": "a2d7f39d-912a-4284-bb12-a7388347fc1b", "value": "b7f94cfbe7014702a4695dd69a71115b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9755ef-ec60-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767855983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855983, "uuid": "410605e4-a6d0-42c1-a255-3635b69fb7d1", "comment": "Malware payload (Formbook)", "value": "30f0868c6bdfa90870b4480c972b04f8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855983, "uuid": "6b5f6282-0c42-4ef2-b456-8347955c46bf", "comment": "Malware payload (Formbook)", "value": "32ed5cbf8154b60628ec938a2b225031bf690a06aabad873cf0cd8896b0768ab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855983, "uuid": "d069eea2-6257-4d41-98b5-846c0b8f26fc", "comment": "Malware payload (Formbook)", "value": "14953b061a176606ca03d941b53b600e4aa80a15", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855983, "uuid": "2279fc36-5455-4048-a473-fe52b412271a", "comment": "Malware payload (Formbook)", "value": "4392a9b9a0c06c80040b892b8fc65d8406f1710c19171c19368bb39b9704f4b03d384463187b27d95ed0c55e68186745", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855983, "uuid": "2f759344-1045-45c3-b1ed-01568394e223", "value": "T12916C22C22558FE99C9247D88F5273D0D76D041F664F8CBB30306DE8A66076F17BAEA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855983, "uuid": "cd7feeb1-3457-49d7-aa81-3e74b97eee83", "value": "768:DAK7KDuBIde0mNYmrU0PE3jDhEcqJIpbNeQ1AYYYYYYYYYYYYYYYYYYYYYYYYYYH:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767855983, "uuid": "c056ad47-898f-4ad3-a0cc-4dd3c0ef76dc", "value": 4341410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767855983, "uuid": "ea9a4362-1674-43db-9138-137cd340ff6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855983, "uuid": "8d52e7d7-ddd3-4a4c-a91b-7dd95d2f86fc", "value": "Orden_2563.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10b9b28-ec5d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767854759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767854759, "uuid": "e593065f-1c76-4e8e-b4c0-67b5b791e46a", "comment": "Malware payload", "value": "bbb93c7556982e996cdba425562fb3b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767854759, "uuid": "272fd0fe-6a47-4b93-8b70-9a55303d610e", "comment": "Malware payload", "value": "3645af92b5b14a234ebcfc75787f828506624bb59ea09acbbe9e4675552b3788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767854759, "uuid": "bd49391d-5b44-482f-9c40-d6d99855b7ac", "comment": "Malware payload", "value": "a0a89ddd05525e6fd4e98ede2e0eef2728b51548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767854759, "uuid": "26553deb-d387-4559-acea-447d4a19a7fe", "comment": "Malware payload", "value": "851b8b29f837877250ad1adc822354f1a085c205d4becad5b091cb6adbb736d95e0f1721923e50064b69cb1535d6e473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767854759, "uuid": "feb38096-f7f6-4b1f-945b-56005ceaa4d3", "value": "T11ED46D26A79405FCE077C179CE964962F772780A03B19AEF07D049A25F671E09F3EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767854759, "uuid": "be125fb2-9208-4d4a-9d11-22bc6ddb0a45", "value": "8e89b6d46a1b7ccb7939a25a95322203", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767854759, "uuid": "766f9e19-f1a7-4214-91a0-c6af391470b7", "value": "6144:R2AKm/0tzrKRZCqDKKU9PyweKTjpC07y+djrlZj08SEfJKfkFdmnRR64BsUf2ph:gAKmcKKqDK9JLXpC0mOjdfJkzRI4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767854759, "uuid": "9022b368-9715-4b6a-8755-1e8b8ff6afc7", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767854759, "uuid": "8e3aaddd-5538-47bb-88dc-9b9d7994fd3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767854759, "uuid": "6ce9f1df-8959-4aef-8dd3-e81b035e9d79", "value": "3645af92b5b14a234ebcfc75787f828506624bb59ea09acbbe9e4675552b3788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651d2d4d-ec78-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767866228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866228, "uuid": "4d4bcbbb-c31c-4a67-9ea1-392e69244c69", "comment": "Malware payload", "value": "3f7ff61fd5728808124b69858ebe6f5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866228, "uuid": "cd799b46-abf4-4daf-a9db-7113e6165e38", "comment": "Malware payload", "value": "38711e926a9100f632301a395baae58197d48f87b93b10d85666407c8bf4d0db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866228, "uuid": "63124d49-647c-40ab-9ab9-a0a2e877de3c", "comment": "Malware payload", "value": "1b7673759f6f1fdb7f179bee3cd4da1f891ab918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866228, "uuid": "602565f7-6af3-436f-9460-aa7f5ff5f8d1", "comment": "Malware payload", "value": "04342f24befec22c3a4ac71c16a7c99bc798451a178fbb8f1d9b79d41169f0fcb65d9a12f7968f75977677e34598ea95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866228, "uuid": "667d9c28-dda0-48a7-8947-3c16ab62c870", "value": "T14C187D13B3A705D5E8F7DA3096E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866228, "uuid": "3ac1452b-3120-4988-a7bf-6bd7c8482b3c", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866228, "uuid": "5f6967f6-c972-4263-9ac1-5a4751aec55c", "value": "786432:/AZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:/AZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767866228, "uuid": "9a28e528-6851-4176-92ab-4b26c6f97b70", "value": 90356736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767866228, "uuid": "12cd8ee0-a266-4861-9ac0-4c3bad631688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866228, "uuid": "9a269456-f6d9-43c0-8400-ba208e2e145c", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7873404a-ece7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767913935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767913935, "uuid": "8976590e-3b9f-491f-8312-caefd2c7a4e5", "comment": "Malware payload", "value": "51b4f3876b51263318d415f46250b921", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767913935, "uuid": "7ce7124e-6b89-4ada-a975-974dc0c8046f", "comment": "Malware payload", "value": "3884cecc5a9ecc34298686109f9cd474e2dd93c2a3b634399ffc166f76b43301", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767913935, "uuid": "47879ee4-e596-4f80-bf45-9a91328ecffe", "comment": "Malware payload", "value": "3a58245bdf058159d22342aa0184a80bc667ca8e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767913935, "uuid": "2638bb7c-df25-437c-8259-b9c47b64c136", "comment": "Malware payload", "value": "0320634ffbf961ec54e5da635d0b9c42c69c9c434d65971e12b841f2dc2ad03cf30c0422cc52207738ee15ed850d4032", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767913935, "uuid": "122ddfbd-0a74-479d-9256-41523933d14f", "value": "T11D863399D3E40DEAD863A83F69756062D3A1F42247A0C4DF1BE4832A2F572FA3C35751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767913935, "uuid": "db5f0c19-1848-48d2-b30f-867d7ae701ca", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767913935, "uuid": "7ac70a93-bfcf-40cd-b7ca-8f2e5da8eb92", "value": "196608:so5algtbW897GLPHMe81SF2RPUewytKZ21HsMRqxbRgFZDU:sEh16PsZg2Ke3K41HsMRqxbYZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767913935, "uuid": "5ed783b4-e92e-4754-92ec-4de4f8892ad8", "value": 8385445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767913935, "uuid": "73afae04-942f-479f-a31c-26df2d19c1ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767913935, "uuid": "3643ff15-5f82-429b-b1e6-61d9ed4c164c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab39a53-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1767856439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856439, "uuid": "5e4dd7aa-9591-431c-a3fa-c545b98452dd", "comment": "Malware payload (AgentTesla)", "value": "435f64de1106b8b47c3fc8cecf4b96e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856439, "uuid": "d93f3eed-3c06-419e-b89e-a44cfd4a01b1", "comment": "Malware payload (AgentTesla)", "value": "38d7a93db30a6d59ca0be89e28b58714e5ee741265e123dc86a80f5e10277bee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856439, "uuid": "b6ccd437-b446-41c9-97ee-4dc9c25b83c0", "comment": "Malware payload (AgentTesla)", "value": "b7854a601dc4a29c7ce2eb56f6f055c3381ead36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856439, "uuid": "a146307b-dadf-4c46-8d77-c0e776cdbd64", "comment": "Malware payload (AgentTesla)", "value": "044e7e2ffb4f0d726ff68174e48847f7cc395a4076560a209ec197248609097eccba22d02ac9661be4fd129e05ae3f10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856439, "uuid": "62c3b43c-b0eb-4e09-b23e-9ccddba55e3d", "value": "T1C472F33B965CDFF00B2E21F051CB7D0530A5D326A936896D98D6C099BF26B114FA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856439, "uuid": "554b1fc5-6f1b-480a-9abf-ce83b959e3d3", "value": "384:YpzVqhJqxbliU989ic+hlTgAMmbJ7Ciao8Y:YpzVAsVM8LbJ7hay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856439, "uuid": "e963b37c-4867-4619-ba37-51b4a391ded4", "value": 16130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856439, "uuid": "f87d899c-ea88-4b21-ad8c-62ee4f8a09c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856439, "uuid": "92a69d7d-0d20-49f1-b319-23933422db50", "value": "Bookings_0664.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00058fed-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906431, "uuid": "c03fac87-9fa4-456e-91a5-7ccbe1e0dde1", "comment": "Malware payload (Mirai)", "value": "678877465419315688d905b34b5b6d4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906431, "uuid": "822b90a2-cd8f-4545-ac0b-49ab0bff415c", "comment": "Malware payload (Mirai)", "value": "3952e932a1f97b2d7260d3c69da485c132e4f7cc2c0c9a5db48d3bc6a9575923", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906431, "uuid": "ae63579b-8baa-455b-bf6d-0ad7f954b2a1", "comment": "Malware payload (Mirai)", "value": "2909e38b960bb3add411b889bc88fd335b0ea871", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906431, "uuid": "c39e5684-533a-4e1c-9bc8-a9541a0d7fd3", "comment": "Malware payload (Mirai)", "value": "4412abfe088a9e7daade482dae714c884e48ea9ccdf978c19e79f561d57c582b8131efe218a47848090a95fca49882c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906431, "uuid": "a5d66c14-1a81-49d5-994d-c4bf0f16f263", "value": "T1FDD2D0315662DD62C3B01C3BF998C147275F4D3CF1E251281EA942A9BAE350BD9B2F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906431, "uuid": "297fb2ff-8203-4336-82a6-e2fafea5f8df", "value": "768:ABVqdq1jjfSFOuBn5UueR6QKlOiUScs3Uozz:Gqdq1vYvn5beMQniUqzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906431, "uuid": "759bf0dc-307d-425f-b8b2-f7dc7816b832", "value": 28916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906431, "uuid": "e29874b7-0294-4d8d-b92c-efd13f66d910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906431, "uuid": "2cad4f8e-be60-4f18-ad50-92f8cb4a29e4", "value": "ub8ehJSePAfc9FYqZIT6.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6effb389-ecc0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767897168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897168, "uuid": "f630ef92-e701-465c-b779-e4c28443aeaf", "comment": "Malware payload", "value": "83cf85f0e3adc9b3be9a6f09fbaa9c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897168, "uuid": "73dc2ef1-b480-48fe-a394-16d5d063ba51", "comment": "Malware payload", "value": "39fd304d614d437ef081ee14dce36c5f67f1d96dd77a8aecd95353dd8694eebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897168, "uuid": "8fe543b1-eae4-4fdb-bd2b-b284d04c756b", "comment": "Malware payload", "value": "4a9e877971bcd6b0b777075635869bbe3c6b8559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897168, "uuid": "1b98f321-9d62-4104-9f47-5fb36ffbe068", "comment": "Malware payload", "value": "1e1d2a29740badff65cde2a0608d4b563ef90bb9425df30c89ad0b46cff22092b3da72974fe9c9f409af029b9797cf3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897168, "uuid": "6692ea81-9ac9-4e9f-a47a-ddf62d03cd50", "value": "T1A6962993EE504229C59BE239ED7562457230B084533113D77FA70BA58DCBBC49B3BB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897168, "uuid": "d502ecf5-2dc7-4a6f-8bfd-03371df1ac17", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897168, "uuid": "1168dcd9-71cd-44d3-af71-fa5c3f091103", "value": "49152:hggy7rb/TevO90dL3BmAFd4A64nsfJ92hsb5RBAYQ6Odg7MVWOkqMmD5eaG4+EE0:hg/VeF587j/y7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767897168, "uuid": "427881a2-22dc-4b94-a1c4-dc2c68c191a9", "value": 9235584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767897168, "uuid": "01958ba5-2c06-4e24-b0fb-052baaa0ff25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897168, "uuid": "1586bbb6-2750-40f7-aada-bde98d663f22", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53cd3db6-ec6c-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1767861045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861045, "uuid": "3e6a303a-9c96-4e18-be05-0c5955103442", "comment": "Malware payload (a310Logger)", "value": "0b299f77f7565481f9a6f72d300aa32a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861045, "uuid": "4d8b6c40-0dc0-4a7d-a3f8-0bc803c3c390", "comment": "Malware payload (a310Logger)", "value": "3ad521009837517bdafbba310233d18c12e00f7d94e2b01f4533f44a299243e4", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861045, "uuid": "5024e386-2b38-4e6a-9221-c44d27734e54", "comment": "Malware payload (a310Logger)", "value": "2e70f58cb2a675bbcf66f1e1114510981154a18f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861045, "uuid": "ef9e825c-90b1-48fd-9329-f8996a907d01", "comment": "Malware payload (a310Logger)", "value": "3384ddc10c030ea3b55ce40639199de2502dc2b9a48f616c9f948cc234a2a43dac9acb272bbec19ce435df54896f6966", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861045, "uuid": "b262f44b-39c0-4164-a017-e69d10ab73a9", "value": "T175845B13EA50A11EF1A3C9F1A9B4925668693D351AE8ECABB7415F5834301E3ECF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861045, "uuid": "0e2f1ab1-919d-479b-b310-a5a844e0f960", "value": "4e88637d5094cca5de1556f3666ec73c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861045, "uuid": "13cea039-4087-45dc-b100-0bb744e44174", "value": "6144:28d1/w5KA81IJ8GpF6nuTmOOUWTxjGD5W7mISVADsBE30hyfXuHqD4XthdN7Fh9G:ljYKkJj6GmZUW1jGRIo5hyGHQiJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767861045, "uuid": "12ca9726-c64c-45c5-bdb5-4d700237387a", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767861045, "uuid": "e9cd27a1-182f-45ce-a738-ea1d9013de87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861045, "uuid": "833f69f5-cf8f-47d7-b96d-74b3ab8734c1", "value": "JCtrans Global Sea Freight 2026 Circular.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d87af40-ec68-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1767859290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767859290, "uuid": "1db55528-2de6-458b-829a-3b78e03b9527", "comment": "Malware payload (njrat)", "value": "96e528d6444dac0d8a40a8ce2f1c81ec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767859290, "uuid": "abcf9c54-0cf1-4084-ae84-92af90f90ed0", "comment": "Malware payload (njrat)", "value": "3c122a88359e5c0f3dd2a6e41d6472f54d1620a5c5364da994e6ca8c0fa9432b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767859290, "uuid": "c6ed0958-7e58-4eca-b40d-cb647006fe73", "comment": "Malware payload (njrat)", "value": "7fc77b2f1b27b12939e9c125c19d0021769f86fc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767859290, "uuid": "c7bda112-0876-4a32-b0b3-343eaab6e77c", "comment": "Malware payload (njrat)", "value": "b922357a7467610de402b89fa13e2a4893d2adec74af4602e36d544687c0a904e67a447a5bf2ca291d0bc7f199311f6e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767859290, "uuid": "43beedc2-3ed7-4d8b-a55c-8426b9313004", "value": "T17C25C09177F4861EE1FF1F75E47249094BB7B812AA36DB4F0994A0AD1EB37408E103A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767859290, "uuid": "dd7af894-b145-49ec-87dc-6bb4748d6fc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767859290, "uuid": "4d1157f7-68dc-4234-abfd-2b05721a5fcb", "value": "24576:cF/phxJzck+uGW/yFoBkkAQFUg2Y/qyYYY:cF/phTYjqqanTHlqyYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767859290, "uuid": "5d2b680d-d908-4d95-b091-d6c3f3136c5d", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767859290, "uuid": "c93b9d80-32d4-42ff-9621-1b1067a4c413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767859290, "uuid": "9972f346-9be3-4d7a-a9d7-cdcd62cbb1e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f0bfbd-ec5c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767854338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767854338, "uuid": "daf19d1e-1136-4acd-93b5-61a57e9ff9af", "comment": "Malware payload", "value": "5be9f1946d3cfe939794e6622486dc27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767854338, "uuid": "a3cdf1bb-87df-4b63-84ca-241525495b93", "comment": "Malware payload", "value": "3d1b894802aa5a47230a6750af1276fe20f921970801eb7564ebc01829cc5ea6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767854338, "uuid": "999d8362-04fc-462d-a5be-505df3e50e20", "comment": "Malware payload", "value": "db26fd1a2aef6ab8fea88056f7390491461ffd4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767854338, "uuid": "1ad303a3-e943-4108-9f06-47257722b2a9", "comment": "Malware payload", "value": "211e87563c13f8c0357311a5a5dbcf1fa4a2b4f5645dc821d5e9103e0255524fa5fc5dcd0f1a083be5208d70ca65fa31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767854338, "uuid": "a2365bd2-df8b-4ee1-81cf-605f7530f452", "value": "T1A1C53304955CBCD82BB3E05054541546356FA62A3CEF3EF060AD8E6F6981E03EEA7DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767854338, "uuid": "f6ef614b-ebce-474b-bce6-5ce11b6bc668", "value": "49152:CeYLwBBIaFzS1lJydoUi8mmOf8cLqDamlNi+iCeokgxzUCSlunTbX2:CeYmBiSoUi8mzkcLeDe+iCogqVs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767854338, "uuid": "802cafbd-cac9-41aa-a997-5bca9fd3d636", "value": 2615088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767854338, "uuid": "044f61fa-1cfa-496d-bd4b-2d57f24e589a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767854338, "uuid": "a0487fbf-767b-4805-9f07-7b668122922e", "value": "app2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e3fc0f-ecc0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767897229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897229, "uuid": "67fd8c34-742f-4ae7-a324-ed4b1b713199", "comment": "Malware payload", "value": "728757a42eb98a64128dc7e59439a742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897229, "uuid": "eb48129f-9727-4878-bc6b-13c1bf2b333b", "comment": "Malware payload", "value": "3d2fe9c8a19b49107591d98ef849ca7c7c79df2d2eb420ec31f228a5cfe5a026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897229, "uuid": "2ed6d65d-9622-4783-bec9-d0b213a7cc8b", "comment": "Malware payload", "value": "0d4b0d31effb26110b5b1e601c6831083dc5b44a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897229, "uuid": "09e52c61-2757-47a2-9b29-6db26c13671a", "comment": "Malware payload", "value": "831a37562849929af689f2b040c9aea1afa949b3bfb030fba6c13aa70a6443f0f889a51e94e8fd37c147f36b488da291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897229, "uuid": "6d0ea6d4-3fa2-4875-b55b-a73a33276b91", "value": "T10106BFB876047DD6667F577BDA96ACDC13B626238ACBA8CD8064B7C30563375FE02804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897229, "uuid": "7ec7bbbb-abf8-4a86-ad96-024205572189", "value": "b0054bd918e7b591ccdca9561e30028b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897229, "uuid": "1f63a1ba-3b4f-4e86-85aa-5394e88d1ad6", "value": "24576:yUjVz9yqdUcIvAwqytQURWWEtZIft7kbuinHyjFGxq07eORvOo0j7VB+NFJY9FRD:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767897229, "uuid": "05300197-7301-4987-be97-5f40eb037d18", "value": 3920896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767897229, "uuid": "0fd13ef4-a6f4-4b50-97a4-8cab431fdd21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897229, "uuid": "c4f14600-922a-465c-ad42-8272044dd2be", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d91faa-ec35-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767837351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837351, "uuid": "48a32e61-fa8d-4820-a739-0ae8f2cb64b7", "comment": "Malware payload", "value": "dd4f55729cde2f25378d9426e61e10d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837351, "uuid": "a70e16fc-c96a-4751-bd7c-97ac8e0160e0", "comment": "Malware payload", "value": "3d3618c20dc216b608202e1224e9bc3ece4ae5a47d8d853ed15e9aa6c5a502b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837351, "uuid": "484e08a5-a058-402f-9f1f-f3b586b18eb5", "comment": "Malware payload", "value": "80be50347a9bd73bb9b52538a037351a47308013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837351, "uuid": "2057f2b8-6f57-4045-9660-4dc3542ca586", "comment": "Malware payload", "value": "2163b075a77f4981a8d9d98eab7016f9a334e6d7655ca9499ffc2f93d5ab446c25f044665ce73840e5f22642201b74a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837351, "uuid": "69e2d26d-3ba3-4c8e-b502-8f4ee9a3f9d5", "value": "T11FD63333A141545EE21582FEA81C52AA4BBEDFE7E23F5D031612111EC7CE6313E1A2B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837351, "uuid": "bf9e3e41-b4eb-4574-991e-63dcc1e33235", "value": "5e48fbae3520a62c95e412b293e1759c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837351, "uuid": "e0c691c6-0b9c-42b5-b49a-baa9675bd3ee", "value": "393216:eeBnBtFBtNFXqF3zNsRzohWgMhR5u7Uo8ufB:/BtrtNBqnvhAhLo98up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767837351, "uuid": "8a79bd2e-73e4-4558-aa8e-367ddec71f85", "value": 12635129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767837351, "uuid": "6c273084-b364-406c-b7bf-732194b46a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837351, "uuid": "ed9168ff-f38b-4b0a-907a-c3b5241561d3", "value": "Chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77692527-ec8e-11f0-a129-42010a9c0007", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1767875708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767875708, "uuid": "a591b9e3-daee-48d3-9d47-41a16d311489", "comment": "Malware payload (AveMariaRAT)", "value": "839fa9038938d09b32fe75e26803c53d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767875708, "uuid": "8b585a3e-70bd-412b-b276-7bccee88cd19", "comment": "Malware payload (AveMariaRAT)", "value": "3dcea9230c2846ace39008f70c062faa0688dba97e28b6bc2a77b4858a753f10", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767875708, "uuid": "568e5329-77de-41d0-bc82-efe344a5d8f3", "comment": "Malware payload (AveMariaRAT)", "value": "90a42ba4a31db88c75f4d9f69e258b2e54b78656", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767875708, "uuid": "61f8995b-9789-4161-ae35-7b84374772ff", "comment": "Malware payload (AveMariaRAT)", "value": "50b19b79d4a9442e9ac4aa87f6ff384763a9f51cd8e6ebabdc2309cd8cc6cfe420b993cee9bcf4f00ff6daf3fc3bdaea", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767875708, "uuid": "f5f10464-74f6-4033-9aaa-61fe1ea7971e", "value": "T13DA4BE55DA82CD62DD582B75C57288741173BC6826F3F75BACCA78B627F33E1001A88B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767875708, "uuid": "a77c70ef-b701-420e-b6ee-3040541f0143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767875708, "uuid": "0642ad42-b246-492b-a6c7-fe6bdf835872", "value": "12288:8BsaG8d0K73zzgRrEwHEBVzgA5vWw6kkTMP6iFKg:gsPKbzzgRNknzgA5J6k+yyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767875708, "uuid": "964b58f2-ace5-4e07-85a6-4c545cd9633d", "value": 464384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767875708, "uuid": "1408a967-938a-458a-96ad-269e5f9ee98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767875708, "uuid": "8305baa3-6af5-4f62-96fc-bc46555638b3", "value": "BelgeBilgileri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e89ecd-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1767856400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856400, "uuid": "c2fcb126-3660-48a9-9dee-36e0ff872434", "comment": "Malware payload (AgentTesla)", "value": "d1778f03925cff4e833c7ea433a4ff2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856400, "uuid": "c637dc99-308d-4364-b7ef-5d139c9fd287", "comment": "Malware payload (AgentTesla)", "value": "3dcf242c7be7242aee8ded8fa386364b4a4c97a27e7f635f8a3580b9c722ae3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856400, "uuid": "2d2186d3-edf4-4348-a360-32a5a244b34f", "comment": "Malware payload (AgentTesla)", "value": "56bfb45814af3b91702bc67cb3acb1471c6c38b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856400, "uuid": "548b789a-f8bf-404b-87ff-ce53306cedf8", "comment": "Malware payload (AgentTesla)", "value": "32c711feec8f8bdb03de84be436c261b5582c7ef01487b3cfc9d4f12fff000ad672075a82a3becfceb7285a9c29a7729", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856400, "uuid": "9fa154aa-4468-4422-b540-7a67ac92571a", "value": "T1CA45021199882FB5CFAC0A1C80FE161E63E0568F541A798AFF337D4BAFE7544121B1DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856400, "uuid": "27bdd83d-67c2-4f74-9158-e88cdde0e6af", "value": "24576:HA4aQ4hItgCu+n17RNdttNSai6md3Zg1ZeZX:HAkttw7n2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856400, "uuid": "0328c5c1-8b8d-420e-8da9-c8e4e9fe5a73", "value": 1242125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856400, "uuid": "a10579c6-52f0-4bd6-89f1-9019db076873", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856400, "uuid": "3acca7e0-3043-4ef2-a206-323a4fcbc1bf", "value": "PT001.08.01.2026.LSPV.PDF.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cd870c-ec70-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767862731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767862731, "uuid": "4298fe6d-d631-43b2-aea3-365bba1d7fbe", "comment": "Malware payload (ConnectWise)", "value": "92d606c247f974c5419ed9ac461618a8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767862731, "uuid": "91408063-d606-4632-818e-94e1208cf2b6", "comment": "Malware payload (ConnectWise)", "value": "3f2de9f29834ca7fb64dc53ac7415e9903b1cfb23e52b1b0a28dc08798c2f790", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767862731, "uuid": "0ff5910a-a7bc-4168-a4a8-9d7ed7eb66b2", "comment": "Malware payload (ConnectWise)", "value": "9df02a107eb5b05420d29100409833243746e3d1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767862731, "uuid": "7378b54f-d539-4ae5-b0ff-1c5b69c7e90d", "comment": "Malware payload (ConnectWise)", "value": "2bacea1c3901cf20ef4b2c9cc5b4e74768ce72daa5fbf3b941d1b2a6bcc12e4fb055cda62a1239cf000a0395256e9233", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767862731, "uuid": "7b3a839e-534b-47ff-9777-c44629118dd4", "value": "T178648CF2960200F0DC255E3142712DB796AF5EBCEDCAB24B9AA438A6DD378C1453F15B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767862731, "uuid": "094ad2cf-0203-4f23-87ee-cd8b088fa5ba", "value": "f4d1e4cd7416ef83f79f7c6a038875b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767862731, "uuid": "39e7ae23-dce5-4783-9156-653bdb278af0", "value": "6144:jJ7B8JB00cyP8PxOv2ZgZhZyZZZZZZZZZ0bzNZlZDZdZe0Ut62gDlIYCAX:JBw002ZgZhZyZZZZZZZZZ0bzNZlZDZd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767862731, "uuid": "a96a235e-bd2e-4c71-819f-9a4aeb70149f", "value": 330400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767862731, "uuid": "4b70f295-6376-4df2-ad9c-1ccc9c10413d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767862731, "uuid": "1285b9b0-a4f8-4b1f-b3b9-8f94139da24f", "value": "MSTeamsInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07027d25-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767856192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856192, "uuid": "d6666faa-e30d-46fe-9d3e-4423fc601527", "comment": "Malware payload (Formbook)", "value": "0b9982d92b1cf803f9d39d29635c30ed", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856192, "uuid": "5be94f53-41d4-4bb0-8c9a-9ffc9a5fcd59", "comment": "Malware payload (Formbook)", "value": "3f3a323fd46bf9d3ec3c7cf112cd758be1b92e950799d8955f16a33d9709013f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856192, "uuid": "878ec7db-f82d-47d2-bc4b-64e83df7db2e", "comment": "Malware payload (Formbook)", "value": "a9fb019f3000ab5842e0563b24608ba742ba68f5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856192, "uuid": "1aacce36-3f9e-48f5-a04c-2a8a2e4b3a73", "comment": "Malware payload (Formbook)", "value": "d34d5592b3104884da9f3233e8d2e4e99bd408531c5ebdc865548e125e6377b626c9dc7853854f8a8c6846a752540c93", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856192, "uuid": "ea239b63-021d-4ad6-acc9-2ea8f0876325", "value": "T125B375883FCAB461935525237D2B60AEF23E4C48B14C44A2D2A76ED5FB6C314E77B52C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856192, "uuid": "ed12de92-8f3b-4c2a-a654-8daef249a898", "value": "1536:LOWuvNp8orfu8Yczel6Qx1Cp/wFLSGWLosEnxY+ruJRtE2LbPvTIdHyH:LO7r8o7zwW/wFuGfsEni+ruGwmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856192, "uuid": "782524bf-0c39-4fb8-b77a-e2317244daf9", "value": 113902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856192, "uuid": "5d3f2198-b835-4446-afef-4840ce31bc01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856192, "uuid": "b6c6fad1-901f-4cf6-bfd6-cfbc03f7bc93", "value": "RFQ Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55393607-ec31-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767835707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767835707, "uuid": "081f9766-d939-4248-a6ab-b87d1c7a6e8b", "comment": "Malware payload (Mirai)", "value": "6124a3ae6e48cdbbf9ac102a0b211f49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767835707, "uuid": "055c5b98-5e46-4dac-9f30-7530b4f1ae82", "comment": "Malware payload (Mirai)", "value": "3f665877a6ec089bd55abf8d5c47764ee7db93a75f08a246b7faa0e6b6e77204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767835707, "uuid": "3c1ef540-3336-440c-b3ef-fe3b13a8363f", "comment": "Malware payload (Mirai)", "value": "a822b48be89f10e0f45f22c7205225a30a28566a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767835707, "uuid": "52137b5f-9b36-4cd8-9e0a-f862705cc1d2", "comment": "Malware payload (Mirai)", "value": "e084f2bd16603a79961b6de0cb4e2cf784160ea23a28d68f3be089b6f07aeb4f78ba4e3d1655dbfea592264d9257e93a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767835707, "uuid": "a344c9a9-5b9e-429e-8a00-4408c36d2ab3", "value": "T116C44A55F8809F62CAC52975F79D829C33174B79C3EB720699144B383BDB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767835707, "uuid": "caaf18fc-4b0b-44f1-9cf7-053cf900bf11", "value": "12288:skDxKYoJ3gjS0XsRnW4HTQVCD2He+agpZ6mi0/N5:BVigihT3D/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767835707, "uuid": "69bc4708-bd4f-4553-a1e5-a097427884b0", "value": 566448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767835707, "uuid": "0bdd1f7e-43b0-44e9-8303-f80abf8b5de2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767835707, "uuid": "b4e3e19a-af57-4763-bd9f-89023c629ebd", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f77e2cf-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1767856447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856447, "uuid": "ea9635f9-fb1c-407b-adf5-b4c935c18bf6", "comment": "Malware payload (PureLogsStealer)", "value": "c858c0e247a103e3f45ec989eb0284dd", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856447, "uuid": "aae3a212-81d6-4b98-8682-ccc4467b27db", "comment": "Malware payload (PureLogsStealer)", "value": "3fc6c27eafe612449b7168316418620eb8cdf7f8206648dbf60bfeaae86921c1", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856447, "uuid": "2ec38f13-682d-4b65-b4c3-88368d2cc7c5", "comment": "Malware payload (PureLogsStealer)", "value": "30f12616785380c2b89c3126fe2a6f194b4f4c92", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856447, "uuid": "844626f5-e52b-4601-9d99-a2e1dae624b7", "comment": "Malware payload (PureLogsStealer)", "value": "68d5c7e3b2215402771985dcd529151b9f252ccd6fb295f5fd8e5248061acd0f9e08b7c9e50354b5951bc3f1ca13eef5", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856447, "uuid": "05d5dc57-e2a5-4989-b9b2-4e038b9eeb42", "value": "T18D95022489C86FB9DFEC5A1C80FE161E53E05A8E51267989EB33BD47AFF7404420B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856447, "uuid": "1fc3b16c-f4a2-42e7-aacb-feec6f01c82d", "value": "24576:s4tesbty75VQ7U/3H33vdk5lb7KwBkdEwLL8TG11col/MVUKGDJ:spYydquaPTBkBj1coAO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856447, "uuid": "d976cbe0-9b93-43ef-a0dc-b8c2ccbe10e9", "value": 1885981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856447, "uuid": "a628b534-3a39-4165-aa51-7304ae7107f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856447, "uuid": "bd0906fc-03c6-4b9b-ae6e-a0155f0199e1", "value": "PO 26-0115005.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02f04d6-ec89-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1767873655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873655, "uuid": "9b4cd392-1fd7-4e7b-89d0-d4eb91aca6ff", "comment": "Malware payload (a310Logger)", "value": "655f3c3350d774d79bf5715bdb97e0f9", "object_relation": "md5", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873655, "uuid": "19292483-ed62-481a-8983-2e3fe66fc8ce", "comment": "Malware payload (a310Logger)", "value": "416e0a8dcc571341da149109a17826c645f55ac3fd1eb2eab31098abb83af172", "object_relation": "sha256", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873655, "uuid": "b0d364bb-0475-4a31-a357-c32744bb5857", "comment": "Malware payload (a310Logger)", "value": "54d1d4ed03e976aaedb3ca797fba6e929c7ad7d6", "object_relation": "sha1", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873655, "uuid": "001eec3d-8619-4842-b7df-e686ffac1bcf", "comment": "Malware payload (a310Logger)", "value": "7ddc64885adebd04902204d525e55ae1acf61a4ea17d6b840c6d73239fb33484c1c0102ed74d031f8f3326610845f56f", "object_relation": "sha3-384", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873655, "uuid": "7dfc060a-1667-4299-a319-b7e1e04cf821", "value": "T1C6545C0127ED4659F2FF5BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873655, "uuid": "63c412b8-4b7d-4770-b902-81eb8fbaf30f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873655, "uuid": "5d147238-5d15-4d86-b284-7f460fbfe1ea", "value": "6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUK:Hh6OTyejyThvFhIpQrAHYR/H7UK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767873655, "uuid": "19330fe2-1a0e-4e7d-be0c-c295d4afe92f", "value": 303619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767873655, "uuid": "fb661ed5-81ea-4bef-a12b-44a8781ee5ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873655, "uuid": "6de696f3-3e0c-4295-96dd-7262a76cdfc9", "value": "start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5639c212-ec6c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1767861049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861049, "uuid": "a8193e90-87c4-46fa-ac2d-fda31c8852a8", "comment": "Malware payload (RemcosRAT)", "value": "f8af6b615e6f64f32fe8d7ae2268dc03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861049, "uuid": "3d684e75-ba43-4191-bbf1-91b246fd0425", "comment": "Malware payload (RemcosRAT)", "value": "44a84a42cbc6a6d1d875077e6455842c699c43b3f66aaa6595d04e639bdf68de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861049, "uuid": "cd5e43b6-4fc2-4601-9120-54c416166748", "comment": "Malware payload (RemcosRAT)", "value": "caecfc5e3a77bbd2c423a4b806b27b2b745e25ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861049, "uuid": "18982b1b-860a-4e4d-a86b-c8b800c58a5e", "comment": "Malware payload (RemcosRAT)", "value": "ac46f4ffe39b584022dfd0542b1115fd98e14b26f3621be08f54a1d3d0b5447253c714fb60f776f2eae2a61402643794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861049, "uuid": "72635014-876f-4644-8312-4b401fd77fa3", "value": "T1FFE42334B6909B47E7F2513244A3513FCE31BD2722E5638AAB103FBD7C7A541C52AA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861049, "uuid": "89c02aad-b44a-407e-9c76-b978f778174d", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861049, "uuid": "0e00beea-6c80-4196-88be-9ed132bb4bcf", "value": "12288:VfLs5BP2PRf7Wpmqo49/QhgIp3+jb9dCvzEhGyhmsk5RrlsNW4TUi758tD29J82J:VfLs5ERjkVoZp3Yb9gfyPY9Ah7g29JBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767861049, "uuid": "c7374d06-2e9b-4c38-ab8a-7d590d44c8b6", "value": 722032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767861049, "uuid": "0fdf372d-016d-4520-a872-b22df1448db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861049, "uuid": "fdce0dd4-6be5-4e97-9d9b-086c511dab99", "value": "SHIPPING DOC ORDER # BL85728690192-ETA 02.2.2026-VIETNAM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fe7fc2-ecac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767888694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888694, "uuid": "5ea749f7-3da8-4911-abb3-b6641fc41b14", "comment": "Malware payload", "value": "68c5a367426fa7f11490cc13c5dc2429", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888694, "uuid": "4e98c8c0-6068-4d83-8d8a-e92260d8957e", "comment": "Malware payload", "value": "45f02e95f9ab8e4ad4d473e92edbad1961056cedd2cc763549e44a20d88a6cd2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888694, "uuid": "4ff5f955-b07f-4a1d-92cf-9e92a9c32ad5", "comment": "Malware payload", "value": "ee430fb374b7cf306da4a78cbbc9c12bd92ab461", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888694, "uuid": "b91b4873-5e79-4d01-a821-34e6c8c3de6a", "comment": "Malware payload", "value": "1333bd8c4019372153f2e6a1747c20dfac1a6c427118b30a1b665ab37bd432a5c114a6eb87535f8f7c7de7c3147e4cb9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888694, "uuid": "44dbed97-910b-4639-8b2d-35f800f246e1", "value": "T19EF27A11729F861871A253C956AF07B40B6F76DF1E7E8189008CEA8A9FE3811CC577B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888694, "uuid": "b036317c-294c-401d-beaa-d55326e825eb", "value": "768:pR+Zp+elVIWEEEEEEEEEEEEEEEEEV03f7EdnPwrghVWs:G93YdWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767888694, "uuid": "7a9211ce-4bd6-4a6b-a173-57440ba5b965", "value": 36818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767888694, "uuid": "7b7bd1e2-bbaf-4cd2-ab69-86de8e9fbaca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888694, "uuid": "89feb289-0c0f-429d-9bf9-e9f7e104f24b", "value": "Cheat Gaming.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01701e7-ec3b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767840235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840235, "uuid": "4b504274-4fdf-4e66-9cb9-3ad78d4194f8", "comment": "Malware payload", "value": "43365f902bee460c7217a41c94a072e2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840235, "uuid": "823a7c07-68a7-4612-b507-a774f2a9c859", "comment": "Malware payload", "value": "467fefca95ce2d6b4d1545398069556c4e28bcd65f8dd19484b51d9ec9253f23", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840235, "uuid": "d7907a42-4d47-455f-aabf-7aeeebcdb39a", "comment": "Malware payload", "value": "5e552811f9ef1782629cffaf85afca19c504cdd2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840235, "uuid": "63afdb85-885b-4ddf-a805-908b5dd813d0", "comment": "Malware payload", "value": "97ba8e375ff8cf43aeec663ae2d42dac0b793b3de41bcef86cae6e3f20a25c2ebc7eb09fafa53f2d44b3f51fa4d697f6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840235, "uuid": "559c9f67-d174-41d0-8f30-29548805a127", "value": "T14B23F7B7F2805CCCD61661B7640BDBD02059AD136A36CF2AB4A9BA270DF12418D76F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840235, "uuid": "74dbddc8-d95e-4a19-8f05-95ad90fa33f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840235, "uuid": "77c4165d-732f-459c-9f92-55f005bd2084", "value": "768:80b7ACe+SR7l9e0tNenFv+cRR2l//G+iyY+d1oOWIkEvgNCVj5i3Tq:80bcCDSR7DRtNenFv+cRR2l//3O2PINI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767840235, "uuid": "6c9348bd-d736-4d0a-be77-162d1faa9134", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767840235, "uuid": "a64fe573-d900-40e9-9c75-03627fda71ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840235, "uuid": "2d14ccbf-06ac-4f90-ac08-7d70ed86f56d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dec92e0-ecd4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767905649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905649, "uuid": "a29a4fc5-2c28-4b63-915c-87e55e87156e", "comment": "Malware payload", "value": "8a4fa59f5cf7fed8b8b26792a30beba1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905649, "uuid": "d6cba779-b073-4618-98e0-771631cc9d66", "comment": "Malware payload", "value": "4691e7a07b6962f43bf79031673b6e9bb5497615bc9c1e6fc875a470c13b3c32", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905649, "uuid": "8b2d5d1c-bb19-4377-b6f0-7f4f9a95a00d", "comment": "Malware payload", "value": "c1b87f4b1e5d6df3b479f8b0c61b2b1cc4106b3b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905649, "uuid": "827a7576-455e-4a1f-9f9c-6533093e4429", "comment": "Malware payload", "value": "6901760db8b5256457351321d49cb9c2f7eb1418f0f5157e862c48a1402b8fea48c994f0f3ec4526d11a9cc2941ae24f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905649, "uuid": "ad62e4c4-dceb-4220-a28e-6a935e774ec9", "value": "T1FD85563D5C20ED29CC7E41CEB89908F8FCAD5BE262B8A927F4B75366C1687E4B50C544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905649, "uuid": "3bf698eb-fd5a-4172-bb06-6b78d81c56df", "value": "49152:NOP1Czq741KfJsFDtAHyzIhIyZRTLI2VesHRpb2flg3pyavNAihDA9dPPN4hyE39:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767905649, "uuid": "089e62e4-8631-4e33-b34e-80896f326ed0", "value": 1773522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767905649, "uuid": "0a3a8742-33cc-47a6-8e6b-d0353d104365", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905649, "uuid": "9cd49118-7151-4b43-8faf-36b2ce5acf11", "value": "index.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab094f0-ecc6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767899953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899953, "uuid": "fa801ced-6255-40a1-b795-14af8087f2f5", "comment": "Malware payload (Mirai)", "value": "2cc71f937d323f449cf8b6b30e97f1ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899953, "uuid": "cb0ead81-285b-4faa-95f9-65d07440c29d", "comment": "Malware payload (Mirai)", "value": "48077a36ff22189d2df5506b5b0a5dd82c2c199d7abc0192d1d6eb1d4a84264f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899953, "uuid": "d06efb8c-d0e5-45cd-b502-0d58bf5066fe", "comment": "Malware payload (Mirai)", "value": "082d0765226466b199b0bdb3038fec4aeb86c201", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899953, "uuid": "049bd29e-3989-429b-86ff-568ed4da2ede", "comment": "Malware payload (Mirai)", "value": "028b475aa542d666f9abf72b1b7d85f5c79ec2793b340a42871803acc09e1e5c3f757c14c18d0a1cfac02816b53aa44b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899953, "uuid": "f2c35274-663e-4da9-aef6-524ba6dc4523", "value": "T1F143021EEFD8E10DFCDF303D08E7F75A2400D3AEA45149DAB5A8D00A95536AE05627BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899953, "uuid": "72fe5fce-2256-4101-9d7f-131344a0009e", "value": "1536:uzYxz5QhOsX4jjsA++JjFmjMA8fhunouy8GyA:rmOsCN+IFmAAoutU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767899953, "uuid": "188d28cb-99ea-499b-9f73-c876729b93ff", "value": 56264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767899953, "uuid": "89d05a1c-eb34-4445-921a-a3bc1fa1d8c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899953, "uuid": "9f7061e4-ecde-49f2-8e9d-348a1e9e6d4a", "value": "ub8ehJSePAfc9FYqZIT6.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b86524-ecab-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1767887969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767887969, "uuid": "ea68bd44-a9c8-4cc3-b6e5-dedc951af960", "comment": "Malware payload (Sliver)", "value": "8ecd0b38be7ad74b2075a1739bc41796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767887969, "uuid": "54ac16d1-5018-4b37-b8c0-07e7df8a2150", "comment": "Malware payload (Sliver)", "value": "48e9e4a2fe3621b55d48fcc4909e8a4c0d7866c9a96f9bf236079eafb9ce2254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767887969, "uuid": "a8e63389-7cf7-4c68-b9c3-0b07d684a846", "comment": "Malware payload (Sliver)", "value": "62fd9f25f356bacb6307e0b61ad6bff11bf22b85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767887969, "uuid": "1563c6e7-59da-483e-aabd-5abf337770ca", "comment": "Malware payload (Sliver)", "value": "28ddd4ab26fbcc81e369f6cb264f3bc4d92759fc15aa8f30f4c67963a2b5dc145ece73592533ceb16a15f509a86d6f8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767887969, "uuid": "28f1c256-2878-4cd1-ae40-8a98983925ec", "value": "T149F61B03F8D61095C4F9D1B489658262BA71785C0B7933DB2BA1F7B42B32BF04E7A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767887969, "uuid": "33fc5912-099d-4330-b5cb-fdef9b3573f4", "value": "196608:CeJI4OI0MM3B/Mrd5GHdnp1LMJCk+0E2q:iTIb+p/30E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767887969, "uuid": "90c4080c-3370-469b-b349-6b1f72e8111e", "value": 15724544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767887969, "uuid": "e75eaffe-c2e2-46b4-a2cd-55eb4bed8206", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767887969, "uuid": "cd68c89c-c249-4117-b75b-9ce9f5eb8156", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a2ae93-ec85-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767872020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872020, "uuid": "2ca57e06-20bb-4d9a-8e02-10a9f3f78040", "comment": "Malware payload (SalatStealer)", "value": "86534b278539ec76c46a9b6bb472b698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872020, "uuid": "139116d1-2ed9-4aca-a88e-cb85f1d0d236", "comment": "Malware payload (SalatStealer)", "value": "4a5597997248146636fa55423941d2a15029b7c953e46b4c716759332587d72d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872020, "uuid": "82470ead-71ac-4b77-9acd-6d17b7b3e40c", "comment": "Malware payload (SalatStealer)", "value": "c43932123430d7985c2d8cd83c66f45edd43bc58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872020, "uuid": "abfb0bd3-57d4-4908-8bc0-edadc2764487", "comment": "Malware payload (SalatStealer)", "value": "77e4105f10d6627a1c9253f4942dade1dfb59c2a10e69736e5dbe9a0a7c38867cb2d55b7fb939289ad200acfd29d0376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872020, "uuid": "21906b79-e487-4491-acd9-857b44c7ca0d", "value": "T1D8C66B11FA8B54F5E9031835809BB23F67315E048B28DBDBFB543B6AFC776921927209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872020, "uuid": "ec7a8483-d14a-4534-80b8-5f7f4c0d4069", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872020, "uuid": "543a7988-c0e6-495c-befd-34254e6b2f1b", "value": "49152:dPV5vpc5Eb4GslouBdb3Mk0PwQoDpK4vv1CaP4yQVSNiBVPQIhg4E9lgszE+0ifR:RXvpuEwoOY/CmM9vfZN7JU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767872020, "uuid": "b73b0ea2-3056-44d4-ba0c-3fc99cd338a9", "value": 11657728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767872020, "uuid": "1591c628-eb40-4d6a-a908-c98d6c1aa883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872020, "uuid": "51f1fc57-7c2c-4856-80df-7bd34381b342", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f4e01a-eca2-11f0-a129-42010a9c0007", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1767884260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884260, "uuid": "138f5183-d9a2-42cb-9e12-f4d6b1c23798", "comment": "Malware payload (AveMariaRAT)", "value": "6a5d28c91f74c12cd7e166802cf6339f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884260, "uuid": "a28eac5c-42a4-4e97-b58b-3f9a2f4ddf94", "comment": "Malware payload (AveMariaRAT)", "value": "4cd8d12c6fa3ef9b37f7fc8b1806060da01d3879f65c637318e12d07fd7a3e26", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884260, "uuid": "600c4dde-30fe-477e-83d2-e316b4e57f11", "comment": "Malware payload (AveMariaRAT)", "value": "4d518b8689f8c45ff334d5d7092b7fe5499adec0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884260, "uuid": "203abb87-5a2f-4d3c-ae49-c61ac2884b17", "comment": "Malware payload (AveMariaRAT)", "value": "5f45730e2696094567ea30665118a4f9c14004f86e1ae469a974bb6a01dfab2927015f0b4fae8754abd8bbfca8bc20e1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884260, "uuid": "6249a912-171b-4bdf-8f02-7cca27b0352e", "value": "T19BA4BD85E9D2CD51DD692FB5C232C87401B3BD2815F2E74BE8CA79B627F33E1141A84A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884260, "uuid": "402351b1-b13c-4822-a4e8-60c4be79086a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884260, "uuid": "9cd63d74-f752-4570-adfb-739633ac0bfa", "value": "12288:b2emAK6tCMQLFvDZj7Pg2VOekhBlRuVF5L:iemAKmQRvtgaOFtRuVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767884260, "uuid": "1201ad9a-274c-469c-9ed4-9e4efd5027f1", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767884260, "uuid": "e885d3b4-091a-4729-a141-4c3b3b72c3b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884260, "uuid": "f7f7d3e6-5575-47e1-a0af-60540efe0deb", "value": "Belge_Bilgileri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f916069-ec6f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767862353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767862353, "uuid": "c8a9f4c0-4f50-4fd5-9575-64a401529997", "comment": "Malware payload", "value": "5cae9142eb1a2a4451f8355a2891c0eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767862353, "uuid": "56fdb27f-f49b-4ff1-ad5e-477f68e667fd", "comment": "Malware payload", "value": "4e0eb28a1b69c2a4a9edabeb223d9886b1749d742b6c1f5a5beafbc40f761fa0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767862353, "uuid": "862c9907-ca20-4903-9044-3457cea2d1cb", "comment": "Malware payload", "value": "3b21ebd71607656a5f8c4d8796ed955bb9a492d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767862353, "uuid": "3b2a8ed9-a142-4b5e-b227-98e41781d001", "comment": "Malware payload", "value": "a2a839859b356e3498a8f3d1ea5fe47c47810820b79aaee7ca6baa228b7e4ab716748f438dccafc26564460e1f57582c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767862353, "uuid": "6fc21046-abb0-4a71-91f8-b13b412c0e45", "value": "T1E4B733068F6F9E2F8ABC215C24BF0F4E26E48E544105B9E767E67CDB9A4FF11204616C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767862353, "uuid": "7ca774db-251a-4426-bcb0-3ebb0950c85e", "value": "49152:aF+1Z8nS6+ScO88pUQGNL70GNecQYVMIVoQ2UDPOT83SAdQ9t7HBFUQbneE1o+Jf:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767862353, "uuid": "e018ab99-8e84-41bc-9ea7-437e2566bc65", "value": 52431384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767862353, "uuid": "f593139f-3408-4a93-8457-6c1def0a06f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767862353, "uuid": "30103261-1d78-4562-8ebc-84e7c14bc689", "value": "Order Item 004.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1f32f1-ec78-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767866132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866132, "uuid": "8ed96755-6905-45e1-bdb0-b9ec44da05ed", "comment": "Malware payload", "value": "a7056a17f5070e062412e8953c2cafcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866132, "uuid": "807842b5-160c-4fa9-9658-639a8dd57992", "comment": "Malware payload", "value": "4e8a1c7702e1a9b888499a2632f18cad60b6003f9b63d8d46b7bdf1ac9f8a4ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866132, "uuid": "7797302a-16d7-4e25-b741-82e7cf4c3293", "comment": "Malware payload", "value": "2811403cc1e56f4cc3abd6b9e864424b56efc3a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767866132, "uuid": "d26aaaec-b655-4c5d-bbc2-525d8040dcb3", "comment": "Malware payload", "value": "786a8bb4ad6d4a89fdfff35ed49a25e4591ebb7e769dec1cf20567efbe6b986c683bcf5c7e10409c68bfa709c1f93b42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866132, "uuid": "45789b8f-dbea-485d-8364-88fa9701d51c", "value": "T1B5187D13B3A705D5E8F7DA3096E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866132, "uuid": "c108802f-e606-40f5-a9cc-74fdfba0b158", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866132, "uuid": "c19584c7-c7c7-403a-9f1b-2b4232903494", "value": "786432:gAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:gAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767866132, "uuid": "42b787f6-81e3-44b1-9622-4ba1eaaae518", "value": 90215424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767866132, "uuid": "87bdf033-2dd0-480b-a909-1e583a72d38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767866132, "uuid": "af4b3de0-dd77-4b9f-bd80-0538385478e3", "value": "DEMO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e57131-ecd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906126, "uuid": "95758527-4625-4bd9-9a55-49df109e0f11", "comment": "Malware payload (Mirai)", "value": "4817724ec483ce351a805eeb524cb59a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906126, "uuid": "8ec39f9b-2099-4779-ad5a-3b6674c674eb", "comment": "Malware payload (Mirai)", "value": "4eceb7d8fc88aa779713713458fd1d126cbccd57c44560704b1b539d706ad1e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906126, "uuid": "f9ac7aba-eb57-4d48-bcb2-5cc1286c5a1b", "comment": "Malware payload (Mirai)", "value": "6e2dd31a6cf4261a76a726e09f1d9e9defc93a3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906126, "uuid": "b6eb1818-3f28-44fd-9461-1cca6e979e16", "comment": "Malware payload (Mirai)", "value": "8d5ee7de6d57a948e04179fa816adc1ed67dc788991b89c32fd81643d17e88d7e891ce832db883300447d502a3be5b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906126, "uuid": "b4df13ac-65a9-481a-8f7a-272d7a5e5d33", "value": "T1FF134C32C938A61BC5D0F37606A74372E0EB2F841140674F7E264D9FEE69340263A7D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906126, "uuid": "b9d23635-15a5-4745-8537-e680d285e74b", "value": "768:2uN1zM8OQFHWP7f7Qlo+JW70//fU1TmQeiulY+EuXVWeOXKOukqmRt7guM81:Vqaa7jMx/8PeiulY+DsTlukqmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906126, "uuid": "753723ac-7031-4b7f-a982-0b5ed667efd5", "value": 44920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906126, "uuid": "7cb9534a-9c42-4bd7-9188-19267ba00aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906126, "uuid": "bb43f5a7-260e-4082-9591-9b604782c067", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0bb115-ecd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906428, "uuid": "601153c8-8d85-4da8-ac28-05519a78428c", "comment": "Malware payload (Mirai)", "value": "cca8817bcbf00c39cb2a3aadb86ed607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906428, "uuid": "1352d20c-e957-4518-a0cd-aa0923db3b6e", "comment": "Malware payload (Mirai)", "value": "4f31626f426071756547bc10abd56011d23908e0b6b703030571c2707c937022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906428, "uuid": "f2f79c1e-150e-4370-98b0-b95c4db776e8", "comment": "Malware payload (Mirai)", "value": "7a6e1c8d13436be6d33771c4f31cc5e300f641b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906428, "uuid": "70bfdc64-047b-478c-ab31-5ff45816d874", "comment": "Malware payload (Mirai)", "value": "96c4555579f5bc267432013909c6b000af100138b90be57a5a6d6b8dfcf12a35e29c22fda1ce5eca82e47f13a51b6c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906428, "uuid": "71231990-7dad-4c88-b8ac-0024fed320e1", "value": "T1BC731903E97D251AD0D0933E0DEA575A70D72E885254A36FBD260E4B7EA7A810F17BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906428, "uuid": "f4f9e6fa-460f-48e6-a2be-a6c6ae765857", "value": "1536:sOJsuQI70PDFafaxtg2AwWFzM8rn0kHWU:sO8KqUGrWFDn0HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906428, "uuid": "14bb0780-b856-42f2-94b5-7259ee6283e1", "value": 75952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906428, "uuid": "23c8f8bc-07c9-415f-bab3-02336a396e49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906428, "uuid": "25b926bc-ae6c-44b2-8727-0ef04174f45c", "value": "ub8ehJSePAfc9FYqZIT6.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5dc79b-ecd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906430, "uuid": "103a970a-6a47-43fe-8329-56c130f2e93f", "comment": "Malware payload (Mirai)", "value": "352d6631629f59723716935747d59d79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906430, "uuid": "eabc3363-25a9-4fc1-9d4c-a3a739fdb8d1", "comment": "Malware payload (Mirai)", "value": "4fb1f80bdc942a362d0ff9413316ab4fa6035d8e76683e293941d141b908bb09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906430, "uuid": "5b0c4601-9ef4-4db3-8442-fb4d70e5a5a9", "comment": "Malware payload (Mirai)", "value": "e326f912d7abccd6d073bfc1e5ef16f3128096c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906430, "uuid": "8d5e0860-eeeb-48d8-853c-a135b8634bab", "comment": "Malware payload (Mirai)", "value": "4f9908bbf934e012629cb2a8e6405cbffe54b64d63e2ff24c9ec5b1bcd624028c7ebe8b324ce62285795191804c23d02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906430, "uuid": "56c54841-6297-4cf7-94da-ec21345b38d7", "value": "T1DAF37C63CC295F59C154D2B8B8A8CF7C2B43994041873FBA5567C2B6908BDCEF60A7B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906430, "uuid": "d5014179-6ddc-4072-b0d4-60963fd6698a", "value": "3072:KCNQJRHZQGIcNgabjnj6bUOt8CJnW9a2Bclg:hm55KabjneUSW95clg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906430, "uuid": "78ade18c-b115-4b4a-a911-0c2a44391651", "value": 158336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906430, "uuid": "9a0091f2-7c57-45e1-9b88-0ef3a0fc7cfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906430, "uuid": "7bf33b87-c409-44e5-b7ea-4f031369ed77", "value": "ub8ehJSePAfc9FYqZIT6.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e238ec-ecb7-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1767893361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893361, "uuid": "99a76456-90a8-4ccc-9776-ca6bb18efc9a", "comment": "Malware payload (njrat)", "value": "058ec267329c393d00a4b70ccae0944d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "searchsystemupdate-com", "colour": "#485EFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893361, "uuid": "e6774e0a-608b-49ab-a214-f2ccaa7553f4", "comment": "Malware payload (njrat)", "value": "514cea85d6782866eba2018927582f7bfe280a3c6c3bf36b4350b8626e93c1f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "searchsystemupdate-com", "colour": "#485EFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893361, "uuid": "a60f5fe5-0aee-4e08-8db6-1160a361d19e", "comment": "Malware payload (njrat)", "value": "4c7c72265e4860272c98ac0f005cd0f0fc9892ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "searchsystemupdate-com", "colour": "#485EFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893361, "uuid": "9ac3ff9d-33e1-420a-809b-00e6e8c2537a", "comment": "Malware payload (njrat)", "value": "6a36e068b579d0bda9af37de8c60d68f32c95bb2f3ead883cb50e04da0db825e688874fe6b1e03bd51c0f5af49dbb136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "searchsystemupdate-com", "colour": "#485EFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893361, "uuid": "1461bd6c-7967-4577-8d57-8458a2f36b4d", "value": "T1DE54D882EF49148BDC399F32D171E2580B7BE9D1B8DADF6920AD3D397C989409807778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893361, "uuid": "199268a2-cf9d-4e94-bda8-3253e7c01118", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893361, "uuid": "702a03ad-dcb2-4966-a436-ee6829bc847e", "value": "6144:BhkbqNCsEbfiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWVm0jVLVVOVVUVZA:/NCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767893361, "uuid": "c16dd19f-a460-488c-9c5c-aebd5c7a1640", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767893361, "uuid": "bf335d52-66fb-4f3a-b60b-3772104a49ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893361, "uuid": "c19441b1-02f6-4249-a00f-96de1ae54bd5", "value": "514cea85d6782866eba2018927582f7bfe280a3c6c3bf36b4350b8626e93c1f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb50842-ec6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767861278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861278, "uuid": "120d86da-c79b-4c57-9e02-c975af6b0d31", "comment": "Malware payload (Mirai)", "value": "464be9009e572ec4c2089e04adc4e7c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861278, "uuid": "cb6083dc-cb9d-4833-a0fe-a9629ad5cd1b", "comment": "Malware payload (Mirai)", "value": "52319c56605e1f12526fa13556a9ae6fd900ffa18de7234b7c649eee0258a07d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861278, "uuid": "b2961a72-8451-49b4-ad30-328204aa671c", "comment": "Malware payload (Mirai)", "value": "ca15e799b2efee9c04045170f4bd0b389a960379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861278, "uuid": "b640d56d-6af4-4dd2-abcd-4f60c0bdef02", "comment": "Malware payload (Mirai)", "value": "5c3af0f96a251244ed477a8351765cd937ff31534432a8fef25655305466bfc1fca6dbb7414a7344be0ea8d6798cdbd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861278, "uuid": "450fd05a-3d70-4001-9b32-75502358dfc7", "value": "T142F46DC6EAD7D0F1E46700F0115FEBEB4A34A2364013DAF7E98019627871BA15B5B36E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861278, "uuid": "d75c2306-f5b0-4688-b3f5-6b1fcb255217", "value": "12288:lVstjGhleh3z/dGZcD6Y2k5td+Eo/qR26ZA6yX92HSWPyMDlI:lVsGhlehDQZaQk5GxSR26ZQ8HhlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767861278, "uuid": "6c198d7b-d675-4d9d-8f48-907e38ea2d9a", "value": 727398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767861278, "uuid": "723db9bf-0f2b-4e42-974d-f581595d9b92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861278, "uuid": "6ab88155-8acb-46ba-bfa3-4bd2510fb337", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b77556b-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767856307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856307, "uuid": "d082fecf-35e2-45e0-b1c3-ffc1532710ee", "comment": "Malware payload (Formbook)", "value": "f6c0a00d5ceb313939b8413b518466bb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856307, "uuid": "7a100a42-064c-40a2-9994-55d66ef348a9", "comment": "Malware payload (Formbook)", "value": "533da1872324407ac2f8ccee9315fd3848b9407fdb921236f9a350e0294795e7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856307, "uuid": "22b59973-4c7c-4671-86a8-da67f1104581", "comment": "Malware payload (Formbook)", "value": "78cd82085d1c6f15b2aa5d2dd54b63d2ebe69965", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856307, "uuid": "656b44e3-3ba3-4d53-a880-8bd462819268", "comment": "Malware payload (Formbook)", "value": "f0902065a6ee2ffda05e366c16463c2d0bfa2761d823ef2519c45176343c1444e55bdf9d44fa30cece4d68a1390ceaec", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856307, "uuid": "9246d0c8-710b-4363-88a3-a485cda132bc", "value": "T11C16E471B24A4385E836033A3FE9DE37EE6503536909EDA4B2B51FE5073503391BB6A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856307, "uuid": "140ae9a0-9b57-4b6b-b040-2f9b51851a12", "value": "768:1UktaeSxCCLARdK3En24KYUCB5rAKj4MLD8u9SdQe5Dqs:1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856307, "uuid": "29c0c904-c71f-48f3-9877-a86028a776cf", "value": 4272387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856307, "uuid": "f78ffdf5-a040-466f-9faf-3247fc19f6b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856307, "uuid": "377c2f9e-5481-4e39-9b5f-027f250560d5", "value": "\u03a0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1_643883.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658b1a7f-ecc5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767899300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899300, "uuid": "5702f5af-7449-4be4-b327-1bcb8087e7d7", "comment": "Malware payload", "value": "8a5b5a7a29accf48efda264d9b9c1fb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899300, "uuid": "6c900fae-e012-495b-97b7-8ef3e8d44c32", "comment": "Malware payload", "value": "53e7b5419dd8edadced6baf1bbe72316b49eb48b11c1af1d70888fc63ff1d270", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899300, "uuid": "616ca34d-db57-4a2b-bd77-64bc83d35b5d", "comment": "Malware payload", "value": "85dbea1285b6c1e433fc5e9fee86e1af9736b4f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899300, "uuid": "9f06eb9e-ebf8-462e-9194-77b3cf3ae93d", "comment": "Malware payload", "value": "21b315193f0908d49cd45cf1720e5361c5da6e37441caf2fbc8cbf02b874d2b08a12161f42626c50bfcf73fc16f2391b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899300, "uuid": "9b4262a7-a94d-4080-8007-ae3502d5293d", "value": "T12643641E6D228FADF7A886304BB78E31965933EA37D0C649E25CD9002F7434D645FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899300, "uuid": "38e49471-2888-4f2d-b75e-9583ee11a2d5", "value": "768:n/M8888888888hUDjndgsQ9k/8/Ms3alWWg6CW98+nu9AJIJXKBD7c1SRtSj:nVDj+XyE/M/lL9xuZWDo1SR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767899300, "uuid": "670eb630-85b8-4695-9126-7876a0a7703b", "value": 56208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767899300, "uuid": "bb8b91b9-57e2-41a1-8c09-1c0b36ccefef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899300, "uuid": "3e569246-2438-44f3-bb7a-c290f5415524", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe7359d-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767856502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856502, "uuid": "39a4f043-1fe0-4d85-9b2b-46892d488a3d", "comment": "Malware payload (LummaStealer)", "value": "876ab7df5a06948e6d87879e46614254", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Defense Evasion", "colour": "#5352A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856502, "uuid": "bc9bd372-bad1-4d57-a7f5-5e57c9d8080a", "comment": "Malware payload (LummaStealer)", "value": "5490dc64bd49f7e57bea3f5f5b885bd439558921f2d7fed8a08768845d12fbbe", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Defense Evasion", "colour": "#5352A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856502, "uuid": "eeeac36d-a367-4277-b74f-6a5abc07e59a", "comment": "Malware payload (LummaStealer)", "value": "cf62ddac9123f80e369e5fcb4d8b90dd19855d61", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Defense Evasion", "colour": "#5352A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856502, "uuid": "300ec87e-d313-4790-928a-06a0ecfcebb0", "comment": "Malware payload (LummaStealer)", "value": "91847f1632dd3dc68223b72806a5cd92469afc886bad698da95b218c93c71dc8de0266d5b76ee516f662ee6e348ace6a", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Defense Evasion", "colour": "#5352A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856502, "uuid": "0f518c89-17f8-40c6-960f-dba10d0ea65c", "value": "T1A9D5CF962467AB7BE0D310F18463827149E42DA74EE04C5F607AF16E523583E79EF32E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856502, "uuid": "99af93f9-ff73-4287-9463-1b4d07b04c4e", "value": "49152:Xv8FRj/nUjHcrNtCdiCNT7D+J1wmJyPHJv2EzxUOOAGZAmksFYnnl:XQRQ8rNKiCdcatXzxnJGZAm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856502, "uuid": "f7c5022e-cff0-454d-ae0c-48a92a3c58f0", "value": 2832912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856502, "uuid": "c84f8ba5-3572-46b4-a2b7-5c283af663de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856502, "uuid": "2f407629-aaba-4764-bf55-5f160e75e09c", "value": "bleweed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd624edf-ecd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906427, "uuid": "6883523a-f534-4910-b79c-d0a8977b0d67", "comment": "Malware payload (Mirai)", "value": "24114aa688e951a4abe886bbd92915d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906427, "uuid": "1a7af5fc-39b0-4247-ad36-192070f171ce", "comment": "Malware payload (Mirai)", "value": "559f28d46c86389def9a0fce04524b14cf51498fda7381f3e4e7544ed88f926b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906427, "uuid": "127cabf5-fcba-4039-b590-6f5f34a6fd90", "comment": "Malware payload (Mirai)", "value": "08b592d7fce2d3d4a8fd20d324f8fdb0345f1639", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906427, "uuid": "86cd1060-89a7-4ad4-9bd2-2c27abf86ef0", "comment": "Malware payload (Mirai)", "value": "af391fce7bc60af5bda2be5084d297387f4d3dce0f79195c644be50aea2253913130b6fc02be03fbe2bb4477f5540712", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906427, "uuid": "9375e9b3-4c67-4335-9fc3-c225fd7a5b5a", "value": "T18163F13C635507A2EA9240F91B792F815C495F87B5C39E8F7750EF6F8842B243491BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906427, "uuid": "0f7c121c-3ff5-478a-9e7e-fd1aeb949b98", "value": "1536:tEARJb4k17ojL5VSLF//o3Qo7OaXUKno4CiNaDTVJuM:KARfq+p//IVLk9nVQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906427, "uuid": "d2c9debc-ca96-4c21-9efc-78db3026b753", "value": 69012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906427, "uuid": "7f0e2eb3-9db9-494a-8b35-784d3c6a6dd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906427, "uuid": "fc337275-30b3-4203-8f86-541c0e6c96f0", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3089859f-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906512, "uuid": "91b8692e-7aeb-4026-bbf2-d10edfc5e00b", "comment": "Malware payload (Mirai)", "value": "4a199856902d792b48f3d9c18ba8208c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906512, "uuid": "cb6d4941-1000-4791-803d-199ddec0c436", "comment": "Malware payload (Mirai)", "value": "58897171dc5b993e6e8918d64fd7483de5c29648c27e7466b51bfaa7af09970f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906512, "uuid": "f87afbd0-3746-4330-aa0b-dae32c766493", "comment": "Malware payload (Mirai)", "value": "adc2c50abe34cd1737c76288ef696c6758e2f1a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906512, "uuid": "f70c2939-f0c5-4480-b6ac-4c1042e26682", "comment": "Malware payload (Mirai)", "value": "94586504061b80a0e705fc1756382624051d2e7159746db21f5b9337d867b8fd60405eb82fa0781e1c17b91e165880c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906512, "uuid": "34b1962e-02af-4a11-a705-9b9f9cafe951", "value": "T14AE36C82F947C5F2D847093060AAB73FAB31ACA54036E769DF844F36CA779029717798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906512, "uuid": "ab3314df-526f-4ba6-af47-53ed4bdb582d", "value": "1536:bBsTD/yqWegKz+GSX7KKCS2BcoSAKKWWi3dw/NxTHHTcDf0Rt1aYp:bBsTDT3hz+GE6FB2bp361xTS0Jnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906512, "uuid": "82c0c8bd-b4fa-42c4-a8a5-f3eec3fbfcdf", "value": 146692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906512, "uuid": "fbf32eba-d798-4b5f-9213-05d346e3db11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906512, "uuid": "9a601c7f-c824-4637-a4cd-1aebdac9c860", "value": "ub8ehJSePAfc9FYqZIT6.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5112b1f-ecb8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767893850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893850, "uuid": "397085c0-e860-4828-9d7d-fa015c4c682e", "comment": "Malware payload", "value": "5151c12a118f66f3e1055f423e6b0cb4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893850, "uuid": "9d41e2fc-8a6c-477c-bad1-fd5a8b71f1d9", "comment": "Malware payload", "value": "58c2aa234a49cc07b0f6c9d9175a456fb12fb16f704dce7620b24cab19bf3c5e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893850, "uuid": "ef3f6bb9-70da-4f73-b18a-a2b6a15c07ec", "comment": "Malware payload", "value": "47dfa5d1ae30e6d8975271b6cfd067e46ebcfc3e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893850, "uuid": "4ac99b81-d0c4-4f1e-adfd-d8bd8240b5bd", "comment": "Malware payload", "value": "71d84625c8c499a00ff618937a34247426ebde127aeda5f656254ae42712020e1f8ca94df2c8ae38e09604afa76db43c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893850, "uuid": "ee9a92a3-b092-432f-8609-3f4388f71e13", "value": "T13B5533D7813C28C49F3E0A5767BF851C62188DFC204308B76B5A4AA7663F39F876495B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893850, "uuid": "cc8b8397-67b9-451b-b2b2-8e0a06fa1cef", "value": "24576:FoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRIX0nv9AbdC:FoZ9bq+MmMEL+hcjXHC/wnwdZKbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767893850, "uuid": "7ad70e7b-1fc8-4c3a-8eb2-611854261485", "value": 1386685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767893850, "uuid": "7afcb8f8-7444-4083-a600-58e677d0fc92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893850, "uuid": "b3e0b4c5-18a4-4573-807b-bb60c09e792e", "value": "DX.DisplayInfo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d80a040-ecd1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767904467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904467, "uuid": "2dee8c9c-c243-46dc-98ae-b3f52230c824", "comment": "Malware payload", "value": "aa17ece2443ed014ea50139ce09ec500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904467, "uuid": "6db79e50-1988-4542-9a59-52e8fee57f98", "comment": "Malware payload", "value": "59dbc225207fb303c9eccc7b962c82ae212f5d302703d3154178b8afceeccd3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904467, "uuid": "d47d43d6-f9a1-4d24-a26b-28aa8a5b6a0e", "comment": "Malware payload", "value": "f3c70c8032af59a4477e826c92da38e6bf974ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904467, "uuid": "a1a8800b-aa8c-4c20-bcd2-bf63c5ff54de", "comment": "Malware payload", "value": "dd8fc1cbe08a0b3a4706317957c58bb04e5cdfcbe4392fe1a299c547abbcddc37630f9aba78a47dd28635107c9397dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904467, "uuid": "9ee92f34-7be7-495b-a39f-865527a34aa1", "value": "T180750D03F63AFCAAF96D3CF1D888DE902C1F3C5A4A8779613972FA5ED5331916600256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904467, "uuid": "84dbfbc7-c4db-4a58-bebf-cc29493227e6", "value": "cbcc3e0661fdf067103373849217fd73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904467, "uuid": "67b2b3be-c8e2-4dfc-bd11-5cfd94625ef9", "value": "6144:gkL/A968meGyDW1T3yDW1TjkAzkAZqrEdrEAZUCwFjNN5Y9PRwmcpAbCN4:gkL/A9k6kfNPqrEdrEURwmcpsm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767904467, "uuid": "606fbb60-c61d-4784-973d-2410a99de6fe", "value": 1555696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767904467, "uuid": "a187d8b3-5761-4c80-9c34-8576509ca79d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904467, "uuid": "700dd623-3a55-438b-9fdf-e52734abf69a", "value": "GOOGLE ADS PLAYBOOK.SCR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d18561-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767856302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856302, "uuid": "e93a7813-007d-461a-a8df-ea09ed7a8002", "comment": "Malware payload (Formbook)", "value": "37665ab3bf28d2a885ade51df753220a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856302, "uuid": "e86d3296-d76f-45ac-af48-859f601a8c5d", "comment": "Malware payload (Formbook)", "value": "5c14e62176fe6f93827864b3359fc15f2f36a5d88cbab42799a9494f38137139", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856302, "uuid": "863c3366-efc0-4c88-9100-f925a958b171", "comment": "Malware payload (Formbook)", "value": "ab2ce51a9be1bf53cd8014f7ff8ff6fad2fcc762", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856302, "uuid": "48a270fc-edad-479f-85a1-f27aab8caab5", "comment": "Malware payload (Formbook)", "value": "16cfe2435dd0371f357cdd8f71c21085ef6ec80593faa8308941684790f8950322042a52992af151690ac66b96700650", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856302, "uuid": "1e233521-52a5-4529-ad70-ed72f5d4f4cd", "value": "T19E1606B01A9B4702F130EB525F846989D4FBB2DF0E0A893EB641B1C9FF150D57AE4D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856302, "uuid": "d03ca149-f333-4caa-96be-6100f3ef0165", "value": "3072:Va8jAvopWFUOmhmAf66DaXrbHSKsNabB54+xsMMMMMMMMMMMMMMMMMMMMMMMMMMb:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856302, "uuid": "d0d2b5e3-36d7-4092-8cfe-14a0d5000848", "value": 4155214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856302, "uuid": "35bd0b4b-05d9-4d29-8d44-cba2e9eb004d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856302, "uuid": "e84c823c-3720-4893-8c71-d8d6703e31d3", "value": "narud\u017eba56.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfe9acd-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906505, "uuid": "7e1255b9-8b59-44d6-b965-e06bdfbc13dd", "comment": "Malware payload (Mirai)", "value": "de0e8c8600688a6347e1938c65dbb394", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906505, "uuid": "d5407de6-0e14-4d10-8036-b0914067ca60", "comment": "Malware payload (Mirai)", "value": "5c44fbf00bfee7ca53ed98a0e9c1f1171ef839b63d127cba6d2157c5cebf6645", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906505, "uuid": "c754da8f-15d6-4bd1-b476-eff2cb5f7353", "comment": "Malware payload (Mirai)", "value": "f4abe1f57235f257bedb150b9452c4e1b77d46b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906505, "uuid": "a42608d4-6335-4bea-84ab-b38baa64640b", "comment": "Malware payload (Mirai)", "value": "bbbc4aefe0eb534f1805b96853f4334b642351dcf845f3824f4bf91f710949d71d0e9bd0e9abdd4e2416b73fd07aca01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906505, "uuid": "6b6737d1-1c76-4914-93ae-e9ff2076cc4a", "value": "T1A163FA57FC82892AC5C0177EBEAE578D331167E0C2DA33678E114B6772CB50B4A57B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906505, "uuid": "4d5fc793-c116-44c4-bc05-6ff82abd75f3", "value": "1536:UJFEI7WVq1iYAIFKraCzxTcaWOr2PXJ2TGd:UJKI7WV9wiKP52A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906505, "uuid": "79354cb3-3fac-4aa4-94a4-4dc0d0b7186c", "value": 71852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906505, "uuid": "a4f7c460-33f8-4c62-9930-f9b4e5a236f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906505, "uuid": "ccabc639-44e0-4baa-b507-4d4df000aac1", "value": "ub8ehJSePAfc9FYqZIT6.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f55255-ec39-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767839065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839065, "uuid": "5170fbd3-d182-4508-99c0-e1b6a97e7570", "comment": "Malware payload (GCleaner)", "value": "f1f7e69374b3d87c9a4ecef5d7a9fd2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839065, "uuid": "e9efd745-aca1-425a-ba42-608b110bd4ff", "comment": "Malware payload (GCleaner)", "value": "5cd1fc9ee873f1f3d65640f0b67fa8d251d35634a29ce21853e9130d1016e205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839065, "uuid": "9b634ecc-b65a-44f3-bf67-d0e9afd4fe89", "comment": "Malware payload (GCleaner)", "value": "22049b558c11c534e1fa79d0a78de602df12439d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839065, "uuid": "aed4084c-1543-4b27-9014-f0c4ea50e415", "comment": "Malware payload (GCleaner)", "value": "814f7f88564543759f5fa25818adb2f4bfbb15ee0d589128536dc51695d1c64e20dcf43721136e84ce4fa9d7de61a1d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839065, "uuid": "a362af68-8014-4cb9-bb1e-4164e53e6a03", "value": "T15406DF42F1A6183BC017E4FFB43AA93C14A76583846664B9399D7ACCCD28B535DB7B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839065, "uuid": "19b8a057-227e-4a4e-8020-df0b1a4fb7c4", "value": "98615183c8737b803f9ab650a6f91b1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839065, "uuid": "36d04213-beb6-4695-8ce7-55ed064875b3", "value": "49152:a4nCVBthmvLcyJhEorRXAXnu81KU2PtC6FsapBLmbAmSqoSvpwnGMMBrnFB9r:a4nCVBthmVMSzwafLUk0KG9BrnH9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767839065, "uuid": "014fb2c0-d4c6-428a-84f4-189d8454cd1f", "value": 3995920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767839065, "uuid": "e1d91b5e-fbb8-45ef-b0b9-2cf18c7911d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839065, "uuid": "0a9c322f-1566-4bee-a19d-b571b7d1a550", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c7cf54-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906516, "uuid": "6202b36d-b8fd-45b7-8a7f-a220aee09a4e", "comment": "Malware payload (Mirai)", "value": "1af00e0e8abd3af69c9dccffa6f48905", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906516, "uuid": "0a6e5827-9c68-4718-8953-9c0effcf4b69", "comment": "Malware payload (Mirai)", "value": "5e5a3d7467d444772ce413cb0f266fde25951771ba2f1353c5879e38f57d6495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906516, "uuid": "9db3b6f4-91f5-48f8-b475-63072c47097d", "comment": "Malware payload (Mirai)", "value": "1e1d3a341e78697894dee902fc0c79dc754bd329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906516, "uuid": "da55a00b-b602-45b6-abd6-9927b3ab8758", "comment": "Malware payload (Mirai)", "value": "c1e3ead0d7cef4a4b677902b14516b8179d78549832eada6b14a4ac460218c3ce2d0a915fbb7d1299c53b35ff6b45537", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906516, "uuid": "17d46ac3-86f2-46ba-be6b-e7df40fc132a", "value": "T134043B07F8C084FDC499C1745BEEB73AE822F49D1238726B5784AE231E9EE211B5DB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906516, "uuid": "2b137f9d-c487-40a0-a4b0-d479279f045d", "value": "3072:nAyAeUNJTi0v9pUBl75FfUpEoW1j+JqopZ7Ufq5mcTka8B/+C2Jq:nAyAeUNJT5wGK6J5IfXcA/+C2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906516, "uuid": "6ae722f9-41ab-42a1-ab4b-59fca6f9c901", "value": 184248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906516, "uuid": "3a4877a6-ec75-4d43-b78f-03b3a7a85c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906516, "uuid": "e564e0e7-81d3-4022-b6a3-8c19566fed9e", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0862b1d-ecbd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767896017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767896017, "uuid": "0d751019-1076-4cb6-9833-9a51f8ebc2d3", "comment": "Malware payload", "value": "9000869a5599c6796c8b086f427d10a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767896017, "uuid": "1a525f80-ae7e-49c8-9064-88fe5dcd9d81", "comment": "Malware payload", "value": "5f8bb0c18533875b4cc8d144f338b363e464c404af3999559f75ecafe78d2a48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767896017, "uuid": "10c51897-5c74-4b7a-a4db-d6c215e2758b", "comment": "Malware payload", "value": "3b86c3d91c65a95d40ec18361ca52fa62d562b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767896017, "uuid": "9a861b2f-901e-4bdf-803a-0d7728ac0af9", "comment": "Malware payload", "value": "00c89f46794d6ec7458bea2d77755dc93115e30575e5ae2084cb9270c61b073e895d40358a50c38c596084f51df382c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767896017, "uuid": "af66e461-1926-4270-8d97-22a691ec71b7", "value": "T16826EABB8E384C89C2C7F1FA9781D6700DE99E67A4DAE0FA51D109405F43B106F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767896017, "uuid": "0e20a978-c5df-444a-aaf4-873cfb9a80de", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767896017, "uuid": "ea8097f8-bff2-4a4f-8f0f-269279c73594", "value": "24576:FjM3IfePBFbM3QJCMLJmkQbFeRIRXkWPur85VlhYgMXlVpyVFlu9CaXQpOmthZO/:FjYI2PPbEtM4bFeKRXkWbNsunfo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767896017, "uuid": "41233620-1d38-4021-96b4-e6fd2ee61ce0", "value": 4768768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767896017, "uuid": "ee4aabed-0708-4561-aa33-1da750212d74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767896017, "uuid": "64291df8-12a4-46b5-8dbf-b9dd807c4ca3", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b2bebe-ecc5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767899270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899270, "uuid": "d352d3e1-bd67-47ef-82b8-d5ad4bae559e", "comment": "Malware payload", "value": "2d22a4ecd3672d9863f605aeb880cae2", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899270, "uuid": "a8998869-db8b-4816-a804-be9b83e6baa9", "comment": "Malware payload", "value": "6018893747cefde706397cdc7e3509c5e3ac9e32d6a770288a94cd7d86e10238", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899270, "uuid": "4a972b44-b0c3-41c9-afd5-645147dc4e09", "comment": "Malware payload", "value": "ead7ca131c557db00b972bf8ec102cd592de9f01", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899270, "uuid": "99ae971e-7046-418c-9a7f-a3ebc1c7746a", "comment": "Malware payload", "value": "2eb062b8e10048d3a5d7dd23209f11de2fcf9f6d593692a4d289b3714bf8c60b46b10db2ec62503e160f379263aa3b63", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899270, "uuid": "aaf5a6ab-3ac1-49d1-a027-48ebf90da9a0", "value": "T1E9A7339928620B0AC73ED26BA2575CBEF2FD15CDD4ABE17A8490C37318C4DE026BD54D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899270, "uuid": "f33da528-871e-47cc-9415-a59f3c194cd7", "value": "786432:ADNsnpQruwJwZTZ0Eh/Iwtt6Nb9grO5lrYGRHexsyCkdlO4h1FH3ltHfKIdj4CmT:fVB/WJh3vCm74bF19fK82T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767899270, "uuid": "fd40fb26-1289-41b1-8f96-f963297a0732", "value": 44552716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767899270, "uuid": "d4316a5b-3965-400f-aca7-ac243ea482da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899270, "uuid": "86bbaad2-3b93-4b8b-845c-ea3ba949090d", "value": "FxMixersInstallerx64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5174a28c-ecab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767888099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888099, "uuid": "e53215ba-952a-40a4-b928-0235d05b928b", "comment": "Malware payload", "value": "d88ad921d7a06bfbb17349317942b51e", "object_relation": "md5", "Tag": [ { "name": "103-121-93-78:2323", "colour": "#64F6FB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888099, "uuid": "45d65f82-7d2a-4bfc-be80-10db644876d5", "comment": "Malware payload", "value": "603299a8415e30c7df08c337e789cc27fbd6753b37e6a28d8dee6e7a0fcf8590", "object_relation": "sha256", "Tag": [ { "name": "103-121-93-78:2323", "colour": "#64F6FB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888099, "uuid": "6871b0a3-2d61-4787-8c92-3723e308cd94", "comment": "Malware payload", "value": "b36edc8fa72c50f420711fea3ba24b14418d501b", "object_relation": "sha1", "Tag": [ { "name": "103-121-93-78:2323", "colour": "#64F6FB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888099, "uuid": "5a9e45f2-33eb-4a23-8025-3fc0d434ac33", "comment": "Malware payload", "value": "602db457bfbe0b36170d1dbff7965d0b7e201548a5610558d2810bbc782263d9ef2dedc3e543a6bde8bea976fbc5d4e6", "object_relation": "sha3-384", "Tag": [ { "name": "103-121-93-78:2323", "colour": "#64F6FB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888099, "uuid": "53b3973b-5e01-4774-861a-e6ab7397210e", "value": "T17E036B377DD68076DAC695F194B48F2B5F7F8609032558939B80E80A6D326E0E27E3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888099, "uuid": "0e14adc0-34f6-49fc-b437-551ebcc81766", "value": "f4830b54a37d2b87187ae0df15d32cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888099, "uuid": "c7c12017-b411-4776-8a52-7fb51e43d7a3", "value": "384:wzTrbY5fQjslADvN/vab3bfHoGHpxzVjdHpCreyBzZ6S5zd2tFoa:2HbY5fWb5CrrPHQCgZJ552t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767888099, "uuid": "f3f90016-2205-4479-841f-e7e24a5e40ab", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767888099, "uuid": "d9256cc3-275e-4c6c-8ee7-ab41a9987f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888099, "uuid": "02b23373-6e86-4b09-a607-d7bd47e34522", "value": "kernel32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0df83b-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906476, "uuid": "8c1eddde-7379-4c17-989b-4436d0662584", "comment": "Malware payload (Mirai)", "value": "35807168375ff78ae454ca0737689c76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906476, "uuid": "3c65d659-a72a-4be5-8fa9-ea350e22e007", "comment": "Malware payload (Mirai)", "value": "60ef0451ab480dbf632e0b5cad576c25264594120d966e8efcd74318d4037065", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906476, "uuid": "50cd5465-ff14-454a-b52e-7efc753e51be", "comment": "Malware payload (Mirai)", "value": "055f29eab62328d23a55a750a59d3091f515b075", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906476, "uuid": "dedcb94d-1f39-46ae-ab01-df9cfc3cc130", "comment": "Malware payload (Mirai)", "value": "6d1cbe14b799f06c026d25bffbacaf70658bc77eefa7769095b4616ed6c907664a5d56d9ce4cb6bcea17ff158eb3d6fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906476, "uuid": "4a072609-d762-44c3-9be3-21fef1771a8d", "value": "T115342A46EA418A13C4C727B9BADF434533339B6493E773069A14AFB53B8779A4F23601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906476, "uuid": "89bf4f15-60b0-42b3-97c9-c06142540870", "value": "6144:W0VBvUXyTqCqvkAucLr4acfPlm3E7zZrrJsNzeHbDEM/RT7OmMmZ2KSXBin:W0VBvUXylqEcLr4acfPlmUvVreED5/ZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906476, "uuid": "f9c69f56-8727-44e7-950d-3426bd0cc2f1", "value": 251188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906476, "uuid": "87c99a32-cb80-4e2e-ad99-d014091aa5b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906476, "uuid": "da739e65-0300-4572-9ce4-16529515ef02", "value": "ub8ehJSePAfc9FYqZIT6.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4acb698-ec86-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767872374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872374, "uuid": "b8e95edb-833a-4701-90ad-b751516e241e", "comment": "Malware payload", "value": "7fc27356821d0080014e657b91f3d1c2", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872374, "uuid": "9bbe8ed9-4637-472c-b5e2-e72e69b66abe", "comment": "Malware payload", "value": "6285e235e8d6b646bddbc64f7496abc48b13583a3e5c19886d1360f6cdf05df8", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872374, "uuid": "cf2d65b1-8690-4da3-9a5c-81144a382a1f", "comment": "Malware payload", "value": "2b0947d0de0df1ffc84fce07a24d645aaa537929", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872374, "uuid": "b12912ed-b640-437d-8a56-b85cfb86919e", "comment": "Malware payload", "value": "c0b5d78f5a56e907fed1d973a9617d57f9b6a8430dc20a4cb414ab9ff86cd346cd6d471914aa67c03bac4fb9ab227b18", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872374, "uuid": "47767191-588f-46fe-a341-7ac45b9822f7", "value": "T1B51833D2F8BABE275420B22791DFCBCDB9B709D5CB46BD27F3C18813624598C3219619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872374, "uuid": "5520ba72-fc38-4109-89f5-69460e43635c", "value": "1572864:C/JhPuBG4ue4G8V1d+Sa2Ah0mwQYf2f512lUWSjasOVwAUBPZKu:gJhPuBGzvRHba2O0m5bosOCAghJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767872374, "uuid": "20a88a08-c87a-4755-81d5-3201bd8bb39c", "value": 88229307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767872374, "uuid": "00fbda4f-45a9-45d1-95d6-f7027c7ac3be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872374, "uuid": "8f7218c4-d49a-4a65-a1f6-b535ce163b51", "value": "Loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355fa785-ecb9-11f0-a129-42010a9c0007", "comment": "Malware payload (BRAT)", "timestamp": 1767894065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767894065, "uuid": "2498655c-c950-497e-9c2c-105a2374ca2e", "comment": "Malware payload (BRAT)", "value": "ff51edee7abd45b9ba5cc4388595330f", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767894065, "uuid": "084cf524-ed46-45df-8064-1a06930d58d0", "comment": "Malware payload (BRAT)", "value": "650ae099324adb82e3e6716d75fd24d1df7ecb6d7c070f9d2b616c001461c0c8", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767894065, "uuid": "369f7cd6-1180-4761-9e41-14ab4b4e3217", "comment": "Malware payload (BRAT)", "value": "a7a599af83f5565f73196c1ed10d4f55ce17028e", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767894065, "uuid": "d7be3d56-fb34-4e3c-8b46-c29003476946", "comment": "Malware payload (BRAT)", "value": "fe58a0ac81e5d9eddafd381f7c5774b17b6bcdeb9bdb2cefa4feb82445bff01eed0ed0057be174d1964dba9a54fbd7e9", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767894065, "uuid": "27b49c13-8c39-431c-a2fc-38d8d9166aad", "value": "T1713707835E660550FF3F919EC72705ABD4B7F8518A42B4CD30A3BE468F269325E3A781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767894065, "uuid": "3ce6ca9f-f2bd-485c-8ec7-c1bb5718c14e", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767894065, "uuid": "61e135f1-b48a-44bd-b123-c9b7510b5286", "value": "393216:InIEn9ip9TTwPYvjTLYWvD5sRyXgWp5DFT+Nxy67NOB3a+DEqC8WkeINE/n9U8D1:InIEn9ip9/wPYvjTLYWvD5sRyXgWp5D0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767894065, "uuid": "f711c911-1794-47fd-b0ac-9180b02a3fbb", "value": 23838720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767894065, "uuid": "0da7fab9-859f-422e-a70f-00ff0a64b603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767894065, "uuid": "f7af3520-3169-4a0c-b5b0-887845391202", "value": "KIDDIONS MENU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a12107a-ec3c-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767840520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840520, "uuid": "272ab513-9306-4458-b4ae-fcc82f5a253f", "comment": "Malware payload (LummaStealer)", "value": "8cd8b3eb6f81befe914e7ddd14de0470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840520, "uuid": "5e86b34e-d65a-40a3-aee8-b833a8bd9b88", "comment": "Malware payload (LummaStealer)", "value": "66a30ad252dc3bc445c71d2426ca876eed62a44b67d8b241d4a42b8d2d49f337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840520, "uuid": "75e27e49-85ac-4ade-9c1c-90e89c9742cc", "comment": "Malware payload (LummaStealer)", "value": "356e2c938385077f97f9b0618520b80f00f501c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840520, "uuid": "347778c5-1292-4000-92e8-82e92ea54140", "comment": "Malware payload (LummaStealer)", "value": "416459417806cbb011a5e92e392c1d799658d15ebfefa8d56705fc186c3a25c485ee3ab728c4072810250493e65e08e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840520, "uuid": "04a693b7-20f9-4158-9b0e-3168c24487ef", "value": "T1DFE49E22F99311FDF4B31034989DF33ADB3A3A158E159F8BD7C09B74E9702416A2661B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840520, "uuid": "2c307548-79b1-496f-8de4-03d48dcc80ad", "value": "1cb7010fa29c1205e95faaaf21e5a21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840520, "uuid": "e2ccbb29-f34e-41d5-8d99-78e2ff5a94a1", "value": "12288:HWCXhe4mhLKlRUQGJNTXar3lSn65gQLtk:HW2mhOoQUTXars65gQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767840520, "uuid": "23d4e356-0fea-40c4-bb8b-ab1674775569", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767840520, "uuid": "7567a202-c9d0-4bf8-8e8e-718c8e775511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840520, "uuid": "6dbbe781-84b9-459a-b461-3ff0778d43f2", "value": "mCHqUL2Z2PbsJ7zZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2ae99d-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1767856465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856465, "uuid": "5f9615a6-56aa-4a21-90f8-c16c982c8dbc", "comment": "Malware payload (AgentTesla)", "value": "593dea3e76d0a2b5cd9c4697b8c0a91f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856465, "uuid": "1e483ed4-07bc-4686-82b5-c786031abd26", "comment": "Malware payload (AgentTesla)", "value": "6aa1fa928c7215ec44ff6cfaba9ec3581cc3a39ff79d30b258814ddbbec8e8bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856465, "uuid": "be3405e1-9ef6-4215-987f-114387b33522", "comment": "Malware payload (AgentTesla)", "value": "eaad680a828f99d015139886f70f8c0a5ecfcf22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856465, "uuid": "8c61668c-c38a-44df-a018-b3bd08ed3b14", "comment": "Malware payload (AgentTesla)", "value": "d30ef5c4afc0398aa5ee3969332ec893edf51259680bd1aea92bd618a66ac20c59879c31ef5292668031febf0116809a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856465, "uuid": "5758b57c-c35a-48ff-af7a-6917979578c2", "value": "T1CEE40254131AC803D2E28FB6A970E3B03B651EDFE5A1D2575FC97FEFB42A2854981342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856465, "uuid": "2c1dcb08-85ee-464e-a0a4-4b595e249197", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856465, "uuid": "660f0106-cc0c-4011-bacc-c413de12e12f", "value": "12288:1EO4ctN7IBWXWWntD/9X7/pdNTFla9YTvx7D2VnqqfMaqooi59axl7kcdgW:ZTrIGZVXQY+qqfM0oi5wXI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856465, "uuid": "9e9cde72-88ce-4c2d-a73c-07e10ac0bc59", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856465, "uuid": "ebc3be6d-d1f3-4bf8-9882-6a2f91e44fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856465, "uuid": "b3786efe-51fc-47f9-8943-5714e98a60ca", "value": "07012026-DEKONT__________________________________________________PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362040fa-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906522, "uuid": "797542fd-ae44-49ed-be84-8e17e0cdf833", "comment": "Malware payload (Mirai)", "value": "125f840e44e1c45c65710b3e05e9f573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906522, "uuid": "149087b4-4a8f-4658-bde5-0f12a0b6117c", "comment": "Malware payload (Mirai)", "value": "70057cefbc9a8a4fc7fafdfce29610349ea8fc188933560d803ca3a95230368a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906522, "uuid": "0fb8e156-38b5-4fd5-96bf-0dc23b4e5e8d", "comment": "Malware payload (Mirai)", "value": "d4b39d6a24db9dfad40c0e29e671256aa53e4ecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906522, "uuid": "44ad55ab-2e3c-4d09-804f-b202b011dbfe", "comment": "Malware payload (Mirai)", "value": "f06840ccceeed4046a682289a5373aafd7646c93c835ae23566faedba6601e2e0de35365f24e6d8fecc08ce8a5053128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906522, "uuid": "45c83826-b0d1-4b3c-bf78-698969dfd6ba", "value": "T10C34D70AAF610EB7D8ABDE370AE90B4624CC645332A53B797534D424F18F90B5AD3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906522, "uuid": "bed77915-53bd-497d-a0f5-5be325ba22eb", "value": "3072:vfbcklYyIdyHSuRHAINRiw7IzZ/cpjgj/KrJvTlYduEzf0o:vfbcklYyIIySHAINDGmpj1JTlYcEzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906522, "uuid": "566db746-b653-40c5-a780-28c5eb1cd8df", "value": 233464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906522, "uuid": "470adc1d-51b0-4205-bc06-35a0cb4949bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906522, "uuid": "01183d94-6f0f-4527-94d6-7c1ed3dabd9b", "value": "ub8ehJSePAfc9FYqZIT6.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d0553b-ec33-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767836596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836596, "uuid": "04735db1-acb7-4775-aeb2-4bafdd6c88a5", "comment": "Malware payload (Mirai)", "value": "2ba67428063aaa956320f7770bbd0e07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836596, "uuid": "d1191c46-5f2d-42e9-b987-ab59a750b0c5", "comment": "Malware payload (Mirai)", "value": "705be77b14ecd2f8441d4852e67e35e196684034d4f4ee596897ae30c33e0c56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836596, "uuid": "f8fa0d13-e2d2-42dd-89bf-12f42b5f884a", "comment": "Malware payload (Mirai)", "value": "6c922e66b20e581196bd7bfaed8f08ce7ca055b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836596, "uuid": "24f3adad-ebcb-4d18-95cc-51b2302a5ce1", "comment": "Malware payload (Mirai)", "value": "072c3af908293cf8bc6fbb24fd85ef434317fac2b02399fa083ff7667b243c3f7eab401f8cbc125c76cccd0e1b798647", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836596, "uuid": "e484c1db-ad9e-47c1-9d96-c10c221139ed", "value": "T1DFD47E5CFE4E3C42E2D7E278DA4D83E1721771E4D32391A33982421DD5CAAE9CBE1A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836596, "uuid": "0ae4ad8b-57de-41e3-9759-a02cb0428be2", "value": "12288:D6USvSQ4JTNMb4GzYgkw7X3pyn6QneuZJVNG4z38yGsvw5kXFCFB0:D6Hv34JTu0w7X3p06Q60jDjkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767836596, "uuid": "03d9ef5f-f551-43fb-80db-30cb300df6cd", "value": 639968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767836596, "uuid": "c5705fd5-04b3-497a-b874-e9439b1e8f45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836596, "uuid": "9c08933d-adcf-4abd-8297-ffbcd31bbd7e", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b54f7e1-ecc0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767897162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897162, "uuid": "7bd4caab-4466-4b26-be0d-9087da6ae567", "comment": "Malware payload", "value": "23f1bb23cfdb4196fdfd51f37d3499d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897162, "uuid": "8b4216d2-3cc3-4595-8470-fb6f0d6a6f1d", "comment": "Malware payload", "value": "716e8656b4395e1118d5a11255d8c13811436529374ae34fbb79affe22de3620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897162, "uuid": "c7a853d7-5081-40eb-a466-0fc7fe5b081d", "comment": "Malware payload", "value": "75d52f2b890844f5313c95fedc6859dac49fc38c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897162, "uuid": "1ecd04c8-7c36-4e37-8210-f33a0ef0137a", "comment": "Malware payload", "value": "24bf9fd49dc07a8087cbb3ae5f716d16520bd01d2f1e014ea4120455f5a9a9757312f670a33a43e9060482b7c869792e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897162, "uuid": "ab14f653-a7a5-4da7-bdee-3dd1e9e545a8", "value": "T11806BFB876047DE6A66F577BDE96ACDC03B616239ACBA4CC8064B7C30563375FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897162, "uuid": "c2622d5d-98ce-4801-98cf-e817a6552f33", "value": "b0054bd918e7b591ccdca9561e30028b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897162, "uuid": "0cc84cf3-e027-49e0-9c71-2355db1701a3", "value": "24576:f/Vx3be9s6/1AFwH2G5KOGl1J0Lxta9k44kXDpjsRyHW79NHnB70CM1P0pRNW9oi:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767897162, "uuid": "3f940743-976e-44fa-9e5c-6d4c3c3e9bcd", "value": 3844096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767897162, "uuid": "c9085e43-d9de-4e25-bda3-eb186891ed78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897162, "uuid": "87479d10-806c-48f3-9297-10046118d560", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bd8491-ecac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767888694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888694, "uuid": "3ecff3f1-102b-4e5e-be11-2f31c0b88701", "comment": "Malware payload", "value": "f5b44689804b2512596ba5ad25424187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888694, "uuid": "ab7fae99-cea8-476c-ae71-89eb34e82106", "comment": "Malware payload", "value": "7235824ba881093e6cf67bce58acc73b01f0e60378bb0050d62d4a68fcfd0c22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888694, "uuid": "1da2ba1f-ecab-44f3-b327-e5b1b35a4f6b", "comment": "Malware payload", "value": "d91544262083918816470d03e26a39d9624ca992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888694, "uuid": "af6913fa-1168-4e3f-9fd4-68cfffd3ae83", "comment": "Malware payload", "value": "9c3ec077e9fc10793c8d8aa3654bdcfbba9bb7efb3344c9cc13aceb29c66bc2c1e4af0f33a0d33ff3e0b2422c40cb8e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888694, "uuid": "61b1a08d-70ea-4c8b-bb3a-811fb49ed9ad", "value": "T1C4E3C68031C1C4F8E08FE53277776DE6E96294A7826A516E27C25E8E574B46C0CF7AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888694, "uuid": "d6651dfc-16c5-4831-8f92-4e96b20ce7a3", "value": "dceb10bcc797e2a2f948d5ee9049c3b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888694, "uuid": "02b76c8f-3f91-46ab-a91c-b27e2d175146", "value": "3072:s/JzHTkscMe1Kfm9J8D5ilR8OhloQmYxEkrJfsd:EHTncJ1KfclOOh2qvts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767888694, "uuid": "eaa79814-e7c2-44af-aa33-b42c4c1775bf", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767888694, "uuid": "2cc1f34e-f50c-4457-a5c9-d9e76cfb98fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888694, "uuid": "42ed7ecf-9610-4590-a19c-1ce15b294a4e", "value": "oci.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2978ed-ec60-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767855825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855825, "uuid": "449f99b2-4f4a-44bf-b658-96c4f8b092c3", "comment": "Malware payload (Gafgyt)", "value": "d637a9002d762fb61d090b94e381136e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855825, "uuid": "a4ad4308-0138-45c6-8748-907eb5782c50", "comment": "Malware payload (Gafgyt)", "value": "73691c73ab823bdff7a9672eff9532958e870daf4c5fb047750347ec164ccac4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855825, "uuid": "1043f840-ed83-4517-8c36-ef5ac9f38180", "comment": "Malware payload (Gafgyt)", "value": "226a9e3d3acf527278a4180145e35ab946a22cda", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855825, "uuid": "b71396cd-07d3-4aea-87df-1e6afe80137d", "comment": "Malware payload (Gafgyt)", "value": "3a333881d550dd1c59f48b8488c4f3ecfda1c7eb373e1fca5375ae4cbf142e4f7568b51eeff0d498e6320ee03a44479e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855825, "uuid": "4d64159c-6d89-4e66-85a0-2e11027c66b5", "value": "T1332238C83DD213B728ED4852A1D7837C5F84C5F570639DA6F40A8AB6AAB044CF2DDB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855825, "uuid": "1348d72b-9d86-419b-8ee6-c81bc08e61d6", "value": "96:hiOfWVc1dZd4cjzlZ16EMvyK6tTVRei0E3a+nIlIfm1Uvp6Yr+weCOnlxko+yz:hs9W7I1vVYTSPPCQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767855825, "uuid": "dd4240f5-37e7-4610-ae2e-46667d8243bd", "value": 10876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767855825, "uuid": "dd87e2c4-5eec-4c78-af60-bfe7073238b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855825, "uuid": "998c10f6-f377-4c83-bb64-ca8724a3f0a5", "value": "rondo.aqu.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5c2718-ecd7-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1767907150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907150, "uuid": "3ab24106-42ca-4d62-8d3e-09f37a98a046", "comment": "Malware payload (RustyStealer)", "value": "c478e472f6223e7ee92cff8b459e55e2", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907150, "uuid": "c60b9708-3e92-438b-bc8b-309f8fc0f11f", "comment": "Malware payload (RustyStealer)", "value": "7523e53c979692f9eecff6ec760ac3df5b47f172114286e570b6bba3b2133f58", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907150, "uuid": "dd5774e1-a072-498d-a8e4-fa4f8a789fe4", "comment": "Malware payload (RustyStealer)", "value": "326b808f4f933f20e4e8686e9a6e93454c8ed334", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907150, "uuid": "53498340-86b9-4b55-9328-ff0202a1466c", "comment": "Malware payload (RustyStealer)", "value": "4d6288dcdbe06601b3d652434bc244e0ea37ef6793801520ab5289bc5037e2055c90a050b1bd614a8d4b1944088658ff", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907150, "uuid": "4881650d-6c89-4cf0-853d-7ee04e993e50", "value": "T1B3553A03A655C8EAD55EC078C76681BABB337C898730A6EB17D83E243E36B905F1C715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907150, "uuid": "1369b09b-a5c7-45af-88e3-c19b6e2964e7", "value": "0b1825efc962edc0d596ec2950b3daea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907150, "uuid": "6543c9e6-a595-4651-a47e-d14ab414b6cc", "value": "24576:li8CxkFmdNY74p3qy2YMohshnNBj8/A1jYC:li8CxaeNYkRqy2YMoKpzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767907150, "uuid": "1f42c89b-7ec4-4ca2-a656-85d443e9a535", "value": 1288192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767907150, "uuid": "fae5e7b1-ad22-4302-8616-652f231e4791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907150, "uuid": "ec796686-2966-462a-adc3-964c6c34e284", "value": "reddit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b47b96-ec80-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767869885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767869885, "uuid": "8cbf5d99-a758-4fd3-a4c7-1ce8848211d3", "comment": "Malware payload (QuasarRAT)", "value": "30d8b11b57c7fb8df51546ad82ba28cd", "object_relation": "md5", "Tag": [ { "name": "91-151-95-112", "colour": "#09851B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767869885, "uuid": "ad67bbc0-f1dc-445c-829c-0020e93da8cc", "comment": "Malware payload (QuasarRAT)", "value": "77a38135bd04399cf458241384bc83902cebb97bfb5a4eca64b17e221f43d4ff", "object_relation": "sha256", "Tag": [ { "name": "91-151-95-112", "colour": "#09851B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767869885, "uuid": "00cfb69c-a9fd-484a-8d26-2034271f208e", "comment": "Malware payload (QuasarRAT)", "value": "febb05d2cabb907be1912999d0a7bb4a0840fd2a", "object_relation": "sha1", "Tag": [ { "name": "91-151-95-112", "colour": "#09851B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767869885, "uuid": "f1f9fffc-9866-4a10-a9a1-9c9a02457b75", "comment": "Malware payload (QuasarRAT)", "value": "2071b2701f58c8448e39017ec4ca608bd9be75a3d6e7af1f1d3f8170b1dfdc775a9e4964e9d5b84e5cade19a921407bb", "object_relation": "sha3-384", "Tag": [ { "name": "91-151-95-112", "colour": "#09851B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767869885, "uuid": "1759106e-7bbd-4b8c-a2d0-16e02c56e00f", "value": "T118748C13B398EA3BD1FD1B3AF4360B055BB0D487B616E38B5A5855B92D133868D903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767869885, "uuid": "dc7d1f2d-58a7-4d01-9b6e-eb8b7fb4fdfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767869885, "uuid": "54b55d25-0c65-4259-a722-93f6b1855094", "value": "6144:47NHXf500M36/C49Iub2KbkUGzIPdEMwswW:Sd50mCjEkUGz8dEMwZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767869885, "uuid": "4c5e0b80-88d7-4393-b863-50e6d6094b19", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767869885, "uuid": "a5f9346c-526f-457a-8cc2-59b5f89b9ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767869885, "uuid": "42004aa7-0fc1-47ba-8ec2-fc8e44bfe2bc", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7875ac4a-ec7a-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767867119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867119, "uuid": "f92780d8-db08-4e17-818b-113749023d15", "comment": "Malware payload (AsyncRAT)", "value": "aac498b9eb669b3fdeb98974500a4360", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867119, "uuid": "65bf4a99-1276-45b4-a879-83cc62da0634", "comment": "Malware payload (AsyncRAT)", "value": "787067428d9b1627cb65ad6dc2de51ff88e96078e45f3aea1ef00392e05d4c9a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867119, "uuid": "f755ac18-3651-4a88-a609-7df611aee55b", "comment": "Malware payload (AsyncRAT)", "value": "b72aef28191eb922a1b8ecd377ae73aa6db2d621", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867119, "uuid": "a0df78e9-dc41-41e0-a2db-997b3891e5ab", "comment": "Malware payload (AsyncRAT)", "value": "c8c671b65f509a98f6a22df1bfe0a5d378e6ecf844d83ba5253c967cfb02dc9be8464dd3c4c18f6183b06416d27f6652", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867119, "uuid": "cfa8f003-c2ea-4f08-bb88-bc2506c4da61", "value": "T1EB534B002798C925E2AD8AF8BCF2850146B5D9732111DA5E7CC415DF6BAFFC64A133EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867119, "uuid": "58dab941-a19d-4067-a4dc-f6613841d960", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867119, "uuid": "e25a8aca-e63a-4985-a34a-3e6100aeebbe", "value": "768:tdgnM8griPEbJiE9Jc6XUsm4m6wT9PETP1+YSCv7mqb2nvpwH1oYBN70z8G8vVcD:tqgYmqzaTPeGbbYw/lG8vVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767867119, "uuid": "54356f8a-fbd9-43fc-972a-e2f0b7d07a6f", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767867119, "uuid": "f89e0faf-43b6-4d05-87e3-a814646cc753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867119, "uuid": "8afe7232-fdf3-482d-8991-0edbd564eb84", "value": "NexusCloudApex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba97842f-ec94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767878397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767878397, "uuid": "7553c0d9-d3f4-4d89-9d4b-52b3f8e6228f", "comment": "Malware payload (Mirai)", "value": "bd3471de586f00b652401903457cc151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767878397, "uuid": "b514039d-811b-4068-a39a-3f91b994ed4f", "comment": "Malware payload (Mirai)", "value": "7b7d0e8c4ab1196a4648db4639ffc8ea183892465c63326c1e374c85627352b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767878397, "uuid": "771b39fc-ac01-497b-ada9-4496c4ecc59c", "comment": "Malware payload (Mirai)", "value": "4c0d94ad48dc2015dd32d685321d70f033f6f57b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767878397, "uuid": "04c2c986-45a0-4e19-a0bc-d2882ec2d1b7", "comment": "Malware payload (Mirai)", "value": "4a8a5c3667bb6b50a57d7342a7cd3e002e4cfcb8905421d66e2c964b20012e1d40c8da8d6dd96f051ad5b5c971b132a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767878397, "uuid": "216592c5-ff4a-403c-9748-7186aa713f97", "value": "T168C45C59F8409FA1CAC529B6F65D929C33170B79C3EA720799245B343BC78AB0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767878397, "uuid": "ba3d1dd4-6f2e-4217-bd4b-f2b48440263d", "value": "6144:UOuNsRHSZXCnbQyio2z/w1ssVgZqubv1b74o1QZkoY/JZbATTWPgzgpZ6mmPu:UOuqyXCSo8tNQMZbAnvgpZ6mmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767878397, "uuid": "31b52822-9762-422f-93b8-fd0d9f25688d", "value": 554268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767878397, "uuid": "d5c01790-8456-4cac-a999-6edcdd2aa912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767878397, "uuid": "4a3eb915-2f28-4bf8-ae8f-9c7a8cb558a5", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b030f9-ec7a-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767867224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867224, "uuid": "4e8825e5-da5e-4922-b794-e9be3880f517", "comment": "Malware payload (AsyncRAT)", "value": "6cd20ca11cb355884ee4ac6ddf4ec80e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867224, "uuid": "150a4090-31db-486b-aa1f-e4c18b07889e", "comment": "Malware payload (AsyncRAT)", "value": "7c4bc5d26a718931b67c923df033f7d52db11f2921df196acad17a8a363bc818", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867224, "uuid": "81a78608-a8d8-4461-bc0c-5b1d474657d2", "comment": "Malware payload (AsyncRAT)", "value": "8a704418bc373ef41daddc217c8b9bbc7c9eef4c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867224, "uuid": "14f3149e-d1a0-41aa-9e83-394148dc2661", "comment": "Malware payload (AsyncRAT)", "value": "bf8a58c796e85969df2ad1c1b4604c94c99523bcffc609d62c5c8a7ec1ea5ac4ada832b7aae3022d1e0f0fde77a5ca9a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867224, "uuid": "d66ee182-f7ec-4c97-920f-28a2b2bae941", "value": "T15C535900279CC966E2BD4AF8BCF2550006B5D9732106DA5E7CC405DB6BAEFC64A127FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867224, "uuid": "c4f543d0-f3bc-45bb-83d4-530bc2823d8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867224, "uuid": "4fa7bb71-5583-4751-a41d-5e06ccc5efdc", "value": "768:lpu4+aBWiPV5iiw9JW/xtROF246x3Zz8Is1+jVSCv7mqb2nWp5H1o+qp9r8GLJVS:lFBlaSgFWz8IsnGbbx5rqp9IGLJVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767867224, "uuid": "d28df096-c0e5-48e6-8451-604301b735a5", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767867224, "uuid": "929b64c6-d9fa-4c4f-870a-8c95908df510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867224, "uuid": "ee8687f0-1899-4297-ae36-90381241b201", "value": "NexusStrategicImperium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b3d22a-ec89-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767873522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873522, "uuid": "72e0159d-90df-4ffd-8489-89cd1e2901d4", "comment": "Malware payload", "value": "c7b7ae72321c5e3f57dcd2dd54c2de4b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873522, "uuid": "0931d001-06f1-4f75-b93d-6499c1b88030", "comment": "Malware payload", "value": "7e065ff8bf19223ad50310489526dbd5f7edeca139c631f75372aca41025b440", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873522, "uuid": "e9f86472-e1b3-4af7-a8b0-9c2af79e9be2", "comment": "Malware payload", "value": "383b17009f3d0e09f8572421868c2872522193d2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873522, "uuid": "00d19bd4-2c13-4f7a-a2b1-47b0ba899fda", "comment": "Malware payload", "value": "592dbc0bfc56c63ffbdd24a1dc359ae9b7c10ce8765e86785175fa7b42265603598e437a14665755c5c82eb085017afe", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873522, "uuid": "877994bc-4659-435b-8728-2f6946220794", "value": "T172751803E2136E63F16FE33F90648B016631D276C647E6A7BA7C9C167DC72C668C2586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873522, "uuid": "e1f3f0e8-1a9e-4157-b2f4-04319cdc6ec4", "value": "24576:ac2+OPVI3lsdg0XYEnfvYOrqnfy/FkTJfH:32HMlsezEfvYkFsJfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767873522, "uuid": "d81007fa-5285-4957-ae58-20fcbd8d9e79", "value": 1641566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767873522, "uuid": "16c6eb7e-1b9a-4876-ba1f-dca78fcbaa9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873522, "uuid": "89be8d47-dd8a-496d-9467-752b6b4482f1", "value": "Bundle-dupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547aeaab-ec31-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767835706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767835706, "uuid": "e5c98973-627c-4fc8-b1dd-15b57fa20324", "comment": "Malware payload (Mirai)", "value": "efe4ef256e741e0aca9d25ac4e10b027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767835706, "uuid": "149599c7-9ed5-413c-9ced-8c6ca272dff3", "comment": "Malware payload (Mirai)", "value": "7eb3327e740640430b62a0d4345121f11cbc36a5e228ac2528bd0b4329ef7e7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767835706, "uuid": "6498ce16-bbf2-4cad-b32c-d673a13d6d59", "comment": "Malware payload (Mirai)", "value": "546e2c01cdd230a7bda4a7224dedddb07d01ecd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767835706, "uuid": "b5bb4754-f489-4d48-8cd8-374ebb842a32", "comment": "Malware payload (Mirai)", "value": "41ccb5d528cd6d6296e9cb1d2a50f6450ed46a92888cb63aa9e54945fb1e90cd1e5e086f7a2fe5947e1c58d966597438", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767835706, "uuid": "232ab716-4ee3-48a3-a148-3cb5c187a18f", "value": "T175F45B06EF850FDBC87FCD70492E824725ED8AD746D0933550BC898CBA9E66A4BE345C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767835706, "uuid": "e55feddd-2dc4-48b1-8934-0af4717aad17", "value": "12288:IpMTYhxyC1v6I6ObhqzLzdzWz1+lguzMbqJIWcKsGOSQYtIMKawSt/tmxRI+/aQk:aimBGuSVzY5PIzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767835706, "uuid": "d565dfe2-68df-406a-befb-c128ca9caee8", "value": 730456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767835706, "uuid": "de8e5de3-ab8d-4c46-9b15-71939b4131b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767835706, "uuid": "3b914d3a-3009-48e9-8085-690ff1966d76", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527719f1-ec64-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767857607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857607, "uuid": "040c2b38-30e0-4ba8-b05e-f879c2f56601", "comment": "Malware payload (Mirai)", "value": "5f6d26838c625d80a7fb00302df6acce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857607, "uuid": "982f0894-c7c6-4cf8-9582-99c683857ef5", "comment": "Malware payload (Mirai)", "value": "7ef7c6680047d0bad3be92f2aa7ed2b64b293ffefbfaa9d5590835bb2e97499f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857607, "uuid": "43dbc87e-b466-474f-aa89-0f16c7066d1b", "comment": "Malware payload (Mirai)", "value": "ba13b8230a74aedd0ff232a3c69d4d47c77144a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857607, "uuid": "4c32eafd-7a6f-4ba8-a37f-465074a6869e", "comment": "Malware payload (Mirai)", "value": "915e0aee4bc38436236ae795f1202252ff32d7e35825631cd4dafa2f2af7ab70dfe16b8bbed82a494fc86922dba648ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857607, "uuid": "37e839a1-1132-40c2-84ea-a97a062a271a", "value": "T1E9F47C627B218FA4E325D2B009F38B156A9512E30AF784C5937DC6107A50B6E2D5FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857607, "uuid": "b09d3a63-5ada-4f9d-a5f2-a2c512b08d79", "value": "12288:BeYGjSihUH7fUfFGS88tyzagpZlZKN4A/:BJ+SuRfFGSZQTsNv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767857607, "uuid": "3a052feb-170f-42ff-97ac-1dbf1f81e0c3", "value": 730456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767857607, "uuid": "60b913a6-2e61-414e-9ef8-139b80945fbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857607, "uuid": "8a15e9eb-92dd-4ae0-a2fb-8eab3f3803b5", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7be25e-ec97-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1767879719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879719, "uuid": "8d2c396f-8432-460b-9068-de7c93cabc5c", "comment": "Malware payload (MassLogger)", "value": "962a27acb8366efdea121af727fdfb4c", "object_relation": "md5", "Tag": [ { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879719, "uuid": "ece28ece-cfbb-44cf-9904-b7d86b83d9c8", "comment": "Malware payload (MassLogger)", "value": "82710b020989bc478c77ccec052a6af50d93eb0b8cf6a2b72579bff21c8fe3c8", "object_relation": "sha256", "Tag": [ { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879719, "uuid": "2378131a-c08b-40c6-a9a6-3eaefbff05ee", "comment": "Malware payload (MassLogger)", "value": "ca3875de1f7d52d04ec09a57c39db1a88361c6e6", "object_relation": "sha1", "Tag": [ { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879719, "uuid": "bc2a826a-3935-4651-8f2b-c90b39abfc5f", "comment": "Malware payload (MassLogger)", "value": "7405ce755aa1a9a81d046360c656e2c6376b25bec67537a9332bd4374e33c0b9fc42a3d3d780ece1a63a5f808b9b7175", "object_relation": "sha3-384", "Tag": [ { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767879719, "uuid": "cb39736b-2479-4e4d-bf79-d64d391b5041", "value": "T1EDA423F90E48C69838565FA756FD0CD9E30B8E0B221C4AA0F5C563DB4C88A6F5DBE701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767879719, "uuid": "a0e50097-23f6-42c7-ba6b-0cbc7f671740", "value": "12288:ghT2WLGidCDu4r5gmGg0FCoPJ5VSsUezgEPPJM:ghT5dwu4W3FCsJnfUezdHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767879719, "uuid": "50a9f056-90e3-4a06-9718-7b4d266ba880", "value": 491998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767879719, "uuid": "49448c95-f476-41ee-b732-46acdc3796e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767879719, "uuid": "81b93463-8f6d-4d3a-863d-a3586a5ae7a4", "value": "CORALP-YBY BUILDERS FREIGHT INVOICES AS OF 12.31.TAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82fee9b-eca5-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767885748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885748, "uuid": "9240fcdd-99e4-4b2c-b9fd-a6db52973091", "comment": "Malware payload (QuasarRAT)", "value": "998795369e518fcec66254b5a9c70b0d", "object_relation": "md5", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885748, "uuid": "ddbfae8a-7191-497d-b650-866c0c4188da", "comment": "Malware payload (QuasarRAT)", "value": "864423ae9afe9170cbc683a0dff649bbdc059448254066d90f59fa1ec99d9805", "object_relation": "sha256", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885748, "uuid": "bf4463bf-91bc-4c86-ae10-edb9735a8163", "comment": "Malware payload (QuasarRAT)", "value": "d48effff9f3ebd872d6667be4eb551bd27501036", "object_relation": "sha1", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885748, "uuid": "5db1ee88-fb18-4d45-b22d-06a627af403e", "comment": "Malware payload (QuasarRAT)", "value": "1c0f02440b8c1e65acf018c10cd32e5cdae87cc12768ac5fd89230e5db967200e34f37f5fee3a4b3a63f970d9387c243", "object_relation": "sha3-384", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885748, "uuid": "0ecd673f-8bf8-452f-af22-8eac9f0fe64d", "value": "T1B9E55B043BF85E23E1BBE27395B0041667F0FC2AB3A3EB1B6591677D1C53B4059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885748, "uuid": "4dd187c7-12c0-4a2c-8c76-fe6f52ce7f8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885748, "uuid": "63a0bf5e-7dae-42b8-bc50-bdb4c93919ed", "value": "49152:yvkt62XlaSFNWPjljiFa2RoUYIkuDiEQsPkCxSLoG1EyTHHB72eh2NT:yv462XlaSFNWPjljiFXRoUYIkuD1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767885748, "uuid": "96962044-3ca3-4a7f-9aeb-b1fa1b0a4507", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767885748, "uuid": "e5dc52e7-debe-4436-9ea8-136a39c299d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885748, "uuid": "926653c0-6f90-4004-ad06-53b6e00859fe", "value": "Addone_qua.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c3458b-eca5-11f0-a129-42010a9c0007", "comment": "Malware payload (XenoRAT)", "timestamp": 1767885763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885763, "uuid": "6bf1ed31-11cc-4c54-84a8-600b06e8ce4c", "comment": "Malware payload (XenoRAT)", "value": "e619fec3e36a09ff9ea6c03baf6559a3", "object_relation": "md5", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885763, "uuid": "41ab4f4e-5f19-494a-ba92-cfcd5d587485", "comment": "Malware payload (XenoRAT)", "value": "8778ffa3bc07a6c317f71a964dcd3cafd4fe59c5183e348d14d53e5c66deedd4", "object_relation": "sha256", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885763, "uuid": "a5c179a3-6721-4d29-8434-edd60228716a", "comment": "Malware payload (XenoRAT)", "value": "3ef59e702c920df67ba5d8242f9f5c8aeafab34c", "object_relation": "sha1", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885763, "uuid": "a0a7805b-fa7f-47df-8176-abc25409ad11", "comment": "Malware payload (XenoRAT)", "value": "7b87f7e1700fb51aca65d2b3bd2c26f9a55d38bb12f06292072c911f5dce8f894eff2ee48c4ac35d8370bef31465b5ec", "object_relation": "sha3-384", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885763, "uuid": "5657696e-5d58-4f23-aa4a-46153f7a64c3", "value": "T17C23F84C57AC8923E6AF5ABD9832426387B3F3669532E38F08CCD4E9379338554053A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885763, "uuid": "09e0c15e-090b-4828-a504-fe78eef789ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885763, "uuid": "e22f9579-8cc0-4122-bdc7-2d86c6b1958c", "value": "768:VdhO/poiiUcjlJInkwH9Xqk5nWEZ5SbTDa/WI7CPW5E:rw+jjgnFH9XqcnW85SbT+WIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767885763, "uuid": "29c56a08-25ae-4181-bb1e-f1b91895ceff", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767885763, "uuid": "f83f84f0-26d9-4281-8272-01736ed6ef73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885763, "uuid": "e9a41683-a4f8-48e4-97d8-4ff54ff3bea2", "value": "Adone_xen_o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263f8875-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906495, "uuid": "2ce78052-e5b6-41ba-9cbd-655b18c8ce35", "comment": "Malware payload (Mirai)", "value": "d5034bb7b9cff67b11590f0ca36d6ac0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906495, "uuid": "09ae30f3-9582-4995-8b2e-ec71044df4c2", "comment": "Malware payload (Mirai)", "value": "8929031f6c82863ab86150fd2374ca9e585b2db92f0cb5ddf5e9679994a0bfce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906495, "uuid": "4c04bb52-c3ac-47c7-8f2f-190d9b2504b0", "comment": "Malware payload (Mirai)", "value": "6aca42a44c4974b11ae82d980a80eec21b296c61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906495, "uuid": "37884e04-3ff5-48d7-94a5-8b11b9ffb9da", "comment": "Malware payload (Mirai)", "value": "5354df7e01bc47bc5235902b786868882974004eb3fa4f5e3d1236eff39bb3db39d11e30011725c5126883661835763d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906495, "uuid": "e076e66f-99d0-47fe-8e4b-20d227bd1694", "value": "T188043B02B70C0907D2532EB43A3F27D593AFD99121B4B745650F9B8A81B6D33158AFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906495, "uuid": "0a129101-ae40-4bbc-9bdd-d1daa3197267", "value": "1536:lM94c46bqxlPivFxUT/Ug7eaBacFJ9B63RxygL7kthcRJBb7tFgr5t6CnT4vAMg6:lE450v/eU2RNFPsRx7USbHy5RxMnZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906495, "uuid": "c62ddda7-8dec-4359-896d-562985811867", "value": 178872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906495, "uuid": "c83adb3a-5ec8-4991-94ee-9801a47519c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906495, "uuid": "b9325e4f-4620-43f3-b601-8556b24a1d8f", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c4aacc-eccd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767902765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767902765, "uuid": "4f60fa0b-9880-438c-b312-6daa83f2e88e", "comment": "Malware payload", "value": "5eb0f0b85c97b696b66669cf71525658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767902765, "uuid": "e23a5c03-84c5-484b-ab99-54ffc2296e38", "comment": "Malware payload", "value": "897cdf27864f0646d901ca1579abc50cf289c4d912ca20e76f58093b1819f446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767902765, "uuid": "5293654c-4906-4f4b-9b07-1b9399fbcef3", "comment": "Malware payload", "value": "dc2da771c9500069f11ca6c0111dc87d7049137b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767902765, "uuid": "38050d52-8be0-4d6f-a865-63adfa4f8205", "comment": "Malware payload", "value": "609a4b01e1c37c58c9dc477decb1e69da4379acbc600833a6b77949284b0f8c93c14d57766138d5804351edcb6bbb03a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767902765, "uuid": "3bd4edea-33a9-4ceb-8f06-477188cce8fd", "value": "T1000723C75BFA92ECC0870A706D8613D939C4B19EC8EF496E31CE4C06B195D2A45CE6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767902765, "uuid": "cd83a4d9-5d40-4b98-acc4-7e05c6b2c040", "value": "687080897b5f9d8eacdb5b351bf1908d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767902765, "uuid": "09b68c9e-671a-4b82-8551-69b4c331a69a", "value": "393216:hfrlRNEYReJofmdaxiXvZt6kAfXIXIWl3rcs/FQAK0:hj6YcofmRBt6kcXel3rf/FQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767902765, "uuid": "af24074c-f447-41af-9425-a03833507c92", "value": 17920000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767902765, "uuid": "e94f5c56-5ea9-47a9-a418-4cb7015f63ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767902765, "uuid": "4bb48edc-cbaa-421e-a11f-388e2d3d968c", "value": "G\u0430l\u0430xis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbb30ba-ec3c-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767840530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840530, "uuid": "373a3d53-a403-430d-97d3-61a28aa931b4", "comment": "Malware payload (LummaStealer)", "value": "6129497d56ff7b163fee15fad108d2e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840530, "uuid": "150d4d67-8588-488d-b50b-dfcb1d16d78c", "comment": "Malware payload (LummaStealer)", "value": "8a9d2ac903092ecbf334fa3f5ec65af8a94106825c3bfa0df87ff89212f2b240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840530, "uuid": "3825e100-4433-4c81-86da-2bfc5ebda0b4", "comment": "Malware payload (LummaStealer)", "value": "694d987d8f7568d36b5de6e50327c17eaf10a8c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840530, "uuid": "cde06997-a38f-4a7b-9bed-2c6f0d76dc0c", "comment": "Malware payload (LummaStealer)", "value": "09645bac83894a96c84526d569ec8f21f98ba0dbe439b963e01af0abf7edd7e17aa3a1699fa7d859320b413ffe69be14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840530, "uuid": "632391bd-0708-49a9-94e9-50cb1c9b6201", "value": "T1DCE49E22F99311FDF4B31034989DF33ADB3A3A158E159F8BD7C09B74E9702416A2661B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840530, "uuid": "2b697398-8cad-4638-87a1-76dde08bef5d", "value": "1cb7010fa29c1205e95faaaf21e5a21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840530, "uuid": "18f82a08-489d-4273-944b-dfa4b8db5d58", "value": "12288:sWCXhe4mhLKlRUQGJNTXar3lSn65vQLtk:sW2mhOoQUTXars65vQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767840530, "uuid": "ecce957e-8e14-457c-a3d2-7f9ac2c7708b", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767840530, "uuid": "8b4a3014-1619-4451-96bd-715e08cfcc06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840530, "uuid": "532fbe5e-1678-4851-8247-ebe1d1cdcfaf", "value": "2c55vu6dl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70559c8d-ec9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767882138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767882138, "uuid": "88e60dfc-6ba0-482b-bab8-812e81620944", "comment": "Malware payload (Mirai)", "value": "ec1c871857108c5d69ce4a08b80f7c6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767882138, "uuid": "42d2aef3-c57d-48d4-bce1-c421b1488c6f", "comment": "Malware payload (Mirai)", "value": "8c8d825530af6914e958101e499de842e129bd2416d372c23671849dda65ec24", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767882138, "uuid": "ea7903c4-a9d1-4be6-af2a-34ec9a8abef9", "comment": "Malware payload (Mirai)", "value": "ea134fb9255e5a9e427a0f2929c7ebd07ebf5000", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767882138, "uuid": "6886e27a-406c-40c5-b0f2-53fedecb365c", "comment": "Malware payload (Mirai)", "value": "87aa177f9357a3ffbfbda181dbea6739040597fab8c7de1f591d32fc16830cff606066621f5ccc27002d82f5689c6e7b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767882138, "uuid": "0d3ab344-50d0-406a-ac59-8965805876a9", "value": "T19D61A9F7A2D247306EA95972A3A8D504BC85E1F3B9962E345CF924FFE48CE043344957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767882138, "uuid": "6f4d6286-cac2-4260-9709-5c5c6840fca5", "value": "96:ih0hhz+haLh1YhpchORhgphZ6Lh8Phbah32hGb3hOxhDt:a07zWaV1gpkOLgjZ08Jby3uGbROrDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767882138, "uuid": "96a2e1c7-e4af-4e2b-9669-ea729e19b6f8", "value": 3197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767882138, "uuid": "ac18f0cd-8bf9-4839-b9ce-6d7e2e28929c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767882138, "uuid": "57709257-cacf-4c6f-9222-85a178abed74", "value": "newreaxe.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94c7717-ecc6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767899977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899977, "uuid": "deb84966-d59d-49ba-af95-d17c78424c88", "comment": "Malware payload", "value": "802a6570b375f02c99b9de280279687a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899977, "uuid": "62a5efe4-7eb4-48db-b5de-9087016e6308", "comment": "Malware payload", "value": "8f18b98129283cac2255755a0c6a862ecb4abc524ad65953eb5d1234c9dd5c6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899977, "uuid": "6810e220-047f-42d9-99ed-8b4c701f84c5", "comment": "Malware payload", "value": "5f10ea0d1cc1c4723f0441c914df521297160bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899977, "uuid": "b0ba8d77-1f3d-417e-be51-789496baac65", "comment": "Malware payload", "value": "c1c50d063ea85601c639f27a5e887a3e50d7d522731fe6271bc429fbad18d1633515467f01cbfb54f4204b28af7148a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899977, "uuid": "2d172e68-9ff1-449e-8bce-b76b95d9465f", "value": "T137158666A6A665A5C17BC038D502851EFD5034AA833D62FF72C58EC12F907E8EF3D781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899977, "uuid": "ce9bcb24-88f1-4a58-8e3a-1755f889471a", "value": "7601a245b02365c7fc5f89aca10012af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899977, "uuid": "a358ddf3-f3ae-4b4f-90a5-e76425d1fa9a", "value": "6144:qWuuSsxIG/ksVZkxcTReOCrj6+JVcXT0mO2vCtuKL:TuuHIPu/oYOpIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767899977, "uuid": "a9c4528f-c44b-424f-b783-2abfcc9ad1d9", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767899977, "uuid": "95e7460e-dd84-4d2c-81c5-601b8352c026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899977, "uuid": "ffdd90fd-f37e-429a-b0ff-e4d5477b70e8", "value": "bunni-installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad697c39-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1767856471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856471, "uuid": "ddd42bd3-eeb7-4f39-b64b-1b00b129e998", "comment": "Malware payload (VIPKeylogger)", "value": "8f459740fc3f311b1521772202354619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856471, "uuid": "48863389-f300-443d-8932-1f47571fde56", "comment": "Malware payload (VIPKeylogger)", "value": "8f5e251e16e408336f172f1d858ef2d37f73f43fb309c48f1157c071dcf2aa35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856471, "uuid": "62e64847-8422-427f-ab86-b7940f5a239d", "comment": "Malware payload (VIPKeylogger)", "value": "bbadf0865997c81c51439158bd0e806562e0077d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856471, "uuid": "b116bd9b-c40a-469c-83dc-4d10ab461f25", "comment": "Malware payload (VIPKeylogger)", "value": "522beb3edf4cb1b14219f4a8d30cf85d90e6a8ad798db416a108d80d975dcd6b9f42499b04c73ab8b6b587837b2847ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856471, "uuid": "d82ec999-47fb-45ee-95e2-690c53ced041", "value": "T14C35EF4453F89A68F8FF9B385479051B47F5F883DA36DB1E6A4860ED8C35B41CA62323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856471, "uuid": "1a2e7bce-1017-40c6-850b-370456ec508c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856471, "uuid": "84b4b227-e903-4335-a495-0eda4a24fc90", "value": "24576:xAG1OiddVoCLrMfwT/sjF3leKNrL12LU:GG1OKvrMe/CcccU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856471, "uuid": "a8dc21c4-851b-4336-ba84-550fbe95a49a", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856471, "uuid": "a0c9fc1b-15f8-4750-973e-04615384962f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856471, "uuid": "b272d296-1f14-4bb7-834e-661ca3b7881c", "value": "DEES END\u00dcSTR\u0130YEL F\u0130YAT TALEB\u0130 06-01-2026_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5acfd5-ec3d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767840796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840796, "uuid": "64c09add-e526-4c4d-a3e4-a8e874716aac", "comment": "Malware payload (AsyncRAT)", "value": "e21928d18c8d05b0605eeda4f570e921", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840796, "uuid": "1f245438-b340-4cbd-84a8-a26367357e78", "comment": "Malware payload (AsyncRAT)", "value": "910fa8e883de9c7b0830c700c75e35fc9bdb11dca727eb3b7fab1552db2b69b7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840796, "uuid": "b3c1c029-e281-447c-9e68-d46c8546dc2e", "comment": "Malware payload (AsyncRAT)", "value": "162d8f78b9c48dc06713cc55e568b6f6e0ffd7d6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840796, "uuid": "75c9253d-6874-4421-bca3-f0e4998f492b", "comment": "Malware payload (AsyncRAT)", "value": "d25787742ebfb78690c5c7dca3d788490775eecf67d5836ac84efea590ba17555b0ece7f65342f1a30843d284c23e3e7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840796, "uuid": "076dd5de-0511-4d97-9a18-cff2a4ff6f90", "value": "T1E9E23B4877E04312D9FEAFF02DF3710A1675E11B9813EB5E0CD8C9962B67AC146507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840796, "uuid": "fd4fdb21-f21f-4c6a-affd-d4957a4b8891", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840796, "uuid": "eb514b02-04df-4df9-9b84-40d748223bcd", "value": "768:pxC3fOJ5y/vGFbO752aDFo9jlYhOjhHbE:DCPOe/+bO752uFo9jlYhOjxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767840796, "uuid": "271868f7-f1e8-40d6-8555-d1712d0482f4", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767840796, "uuid": "abb62da6-6f24-4e77-85d4-aa7341b190f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840796, "uuid": "727a09f0-3c34-409f-9bf7-6453618b7cb4", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020d8f85-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906435, "uuid": "6c20c8d5-0568-49fd-9313-7655d8cf721c", "comment": "Malware payload (Mirai)", "value": "07397280c7266d5188b150e4b950483d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906435, "uuid": "078b4ebd-4443-4ed0-9ffc-59bc27463d8f", "comment": "Malware payload (Mirai)", "value": "915c263829c8369ee0ee03a70c11e723cdac44491b485042c4a936acdf278c2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906435, "uuid": "3fa72af1-2951-4d92-9b61-28eb8d91d820", "comment": "Malware payload (Mirai)", "value": "a31f2abad2530f1cd32fbb7683c6c6c36818cac6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906435, "uuid": "d6966514-a526-4ff1-924d-6f472723eaa3", "comment": "Malware payload (Mirai)", "value": "6490f3111b79698208d2af13927eaeb14e2ff196d192d790c1a298d06eef032ba394c0aab7185258d06c5f41445cc0c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906435, "uuid": "dc7b76d1-6b35-4cc2-bb70-096284c642a3", "value": "T1D65302B8A023B3BDE1ABF172E11D4E01FB43089AD56F4A1549D721FDB0E23516B1A9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906435, "uuid": "46c42ed1-92d5-457f-92d7-9f31808b249e", "value": "1536:5jQpRuEo993y6tkS2pgLNjMRPk6+Xd1OWH4tZ:qq9xynRpyN4ReOWuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906435, "uuid": "0c149bcf-0f13-4ebe-b3c9-a82deea70aaa", "value": 65908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906435, "uuid": "d1517888-6138-41d1-ab68-d8876553e3b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906435, "uuid": "907357ce-6a2f-4a51-83b5-aee27df66b89", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a687db7-ec7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767867821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867821, "uuid": "99415da6-38a0-4e30-a812-a56d91405bbe", "comment": "Malware payload (Formbook)", "value": "c9b4697a1f1309394d135220b65cb5ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867821, "uuid": "c1de1198-68ec-47da-8f29-5670ca724fc0", "comment": "Malware payload (Formbook)", "value": "91cd3783006c669a986d8c411ba96de610b1f4b63e779742a41f1ade293242c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867821, "uuid": "f6098337-8574-491d-9e2a-8de91a9902bd", "comment": "Malware payload (Formbook)", "value": "cc359f978bae05ed4bd5ccd056fcd9a9b984eb22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867821, "uuid": "b8fb138c-f849-4c1b-bd1f-ce701a173922", "comment": "Malware payload (Formbook)", "value": "87117aff5c9507905b9d82be2b49d61f16449d3030e52b9edbb51baab590fd62d22a14c739089776f706cb0606cf3178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867821, "uuid": "3df89d0a-3b0c-48e5-918a-80895465e769", "value": "T172F422DCB605EA21C3E60BF20262F37253780E8D9504E307CEEDAC87B545616EEB4672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867821, "uuid": "2af5e58a-7214-41cd-818a-528825ee57a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867821, "uuid": "605cc1f2-a8c1-44c4-ac7f-5e65dd113034", "value": "24576:2XwaEbe3odcTVY0OaV1z3+3dR80m7GnC0dOP55M:kYDOOez3+3dR80m7eZdOP55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767867821, "uuid": "4b0e10c3-544e-4a76-a67a-1bfb3042dc5c", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767867821, "uuid": "3598e9b2-a3aa-4338-b0ca-4e0c796ef10f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867821, "uuid": "3b5087c2-823b-4b9f-954f-c1fe5dbb9871", "value": "OGA DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf47306a-ec63-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767857387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857387, "uuid": "60a11ec0-bbb5-4069-8e20-d0d0f377de39", "comment": "Malware payload", "value": "693e1b8d5363679ce69d1574702f10df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857387, "uuid": "39edb49e-c808-4bf5-bd18-a5273d6289c9", "comment": "Malware payload", "value": "927c08f9527724fa33f0e2fef08898f84aad2983ed8a61b1f7667ea683554274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857387, "uuid": "b34dab9f-cc13-4beb-a43d-62dd0d07cb87", "comment": "Malware payload", "value": "717a0440e6d4099cf957dcbc816f22fe2c166a1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857387, "uuid": "80f9b7af-47a2-4980-8e68-0dc568cd0a84", "comment": "Malware payload", "value": "d4f2f1bab721fd8cecf143d66e30aa6d97b9a018d18a991f5d18e1c606a04d1346051e52ecd452fd9c1220d21f5657d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857387, "uuid": "e458c17c-f797-46f4-b9b9-eb80e9a5542e", "value": "T1D4945B637B21CF64E325E5B005F38A65699511A30AFA88C1937DCA107F60B5E2C5FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857387, "uuid": "33b8a8bd-e8a4-4c52-b0d3-9c6b268be53d", "value": "6144:W4eiDHvJ5znW3104ISG2WAaXT797033qDEnVU807IOpURt/oxOLySKFzjTDQY:BeYGjSihUH7fUfFGS81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767857387, "uuid": "4b465cd5-20c3-42a6-be9b-60e6299b69a8", "value": 444118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767857387, "uuid": "2057cdff-f143-4565-91e2-6a0c5d8de1b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857387, "uuid": "e7023a4c-5356-4889-9adb-1433b0dfceb9", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28db22e9-ecb6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767892756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767892756, "uuid": "e05b4459-6dc0-4561-ab63-ff7e09010fa4", "comment": "Malware payload", "value": "963d9bf94d8495bd2b4b5816d763031f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767892756, "uuid": "aa2e5731-f2f2-4ba1-a14c-811426856305", "comment": "Malware payload", "value": "933a5d0fe7955664379d95f22b5e32353f7bbce311879b4a138b951ad5fbc9c1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767892756, "uuid": "6f1c5d4b-c5e9-4df9-b2f0-e279e067362d", "comment": "Malware payload", "value": "217ed0d146809ebd181b396f805239775395f9e5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767892756, "uuid": "90144324-3806-4870-b753-727b37732b92", "comment": "Malware payload", "value": "3cf61c4050dd31a5dcde08303d9cd14a03ec0f08cf9305c3c1793a0b7352575c72a53eb517e28dea62b9e6d15632889d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767892756, "uuid": "5bd3c1a9-9ca2-46d1-be42-3fe8531474f0", "value": "T1706633A396EC5035E5F5B7B099F64B132A393C4105454EFB0958B857AC33C12FB23BA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767892756, "uuid": "50e656b3-4330-4849-a22d-10e14e8494d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767892756, "uuid": "909e5bd6-7b13-41d9-ac1b-6cff06198cd7", "value": "98304:k73Ey73Ln+pRJcJRLfxa7iR3OF5UP5iKptf2d990c9l++K15ksIlmZzI0Nx7NPLf:k73l/+M7a4elKX2d/N++K15ksIkjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767892756, "uuid": "288354ed-36e6-442c-b6b5-11f8d4cae08a", "value": 6939136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767892756, "uuid": "e9ca2522-490f-4f99-95fa-9f380f76611f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767892756, "uuid": "f8b7bd1b-8e4e-44b3-803b-bed69ecd735c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155bbe42-ec99-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767880268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767880268, "uuid": "3b5056d6-6c9c-439f-a392-439410072152", "comment": "Malware payload (AsyncRAT)", "value": "7829557271597335459837921012aae0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767880268, "uuid": "605a1c19-1ab6-4a16-8d1f-1f20a63066da", "comment": "Malware payload (AsyncRAT)", "value": "93456df9f634dc0bb41689ae3f91b4c0005eaddd062dc689e1c66db700188c74", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767880268, "uuid": "e6bb3107-25f9-4da3-83e3-8145a3465409", "comment": "Malware payload (AsyncRAT)", "value": "52dbc307b32c705e5877f885ecf52917433f3fd8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767880268, "uuid": "4d6de2f7-c4ae-40a7-83da-2d1fe4a9f7c5", "comment": "Malware payload (AsyncRAT)", "value": "45aabfbac0ff163d4f0fff00d5ae976d3d12d091ad188110f5667629d0da6f555ba1c6f9cc645a0bc6845a958031592d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767880268, "uuid": "7b1c5fbe-d0ca-49e2-870b-97136ceb9953", "value": "T194536B003798C965E2AE4AB4ADF2550107B5D5732102DB5E7CC414CF6BAEFCA4A133EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767880268, "uuid": "e2b87d97-d081-4e7b-a8ac-e9fee0cd1665", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767880268, "uuid": "1db30759-435d-441f-bcbe-1b62dceb2503", "value": "768:Yam9za8AgiPk6oif9JdKZ/FyxsIonm0b1+LSCv7mqb2nhpgH1omBYtin8GXXVc6c:YlLAHVeh46vNGbbQgpBL8GXXVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767880268, "uuid": "a114b7da-6878-464d-bbb4-83f7b325e83b", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767880268, "uuid": "0a0a1969-a4dc-4906-a046-e33495c9eb56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767880268, "uuid": "27473794-1f20-490f-9ec0-c5189792252e", "value": "PrimeBet Sportsbook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a3fced-ec3c-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767840514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840514, "uuid": "1f8a5d1d-4b3e-40f4-b063-0b8e4e72edca", "comment": "Malware payload (LummaStealer)", "value": "714236154e28b396690d1a54953a7f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840514, "uuid": "f8d8a471-31ff-43ab-9142-f8b74943f98f", "comment": "Malware payload (LummaStealer)", "value": "9494eb0a236203cb89c93219916f7798e07ba43f4bcd75e8ca7e3341b1e7c7d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840514, "uuid": "a6a360b1-e3af-481d-9512-6d9faebb0eb8", "comment": "Malware payload (LummaStealer)", "value": "5626129c2040879e4f9625faa33fbde4e63c1dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840514, "uuid": "255249f5-e9cf-4ecf-9322-074ea97b6045", "comment": "Malware payload (LummaStealer)", "value": "f0f2306f9f544dc24b2dcab7c1f0ba06d4dcc1a7f891bd9c57604a00fda000438a442488379a0420b4ab519ca8fcf286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840514, "uuid": "4e39948f-a38f-483c-b07a-8a70260f82cb", "value": "T145E49E22F99311FDF4B31034989DF33ADB3A3A158E159F8BD7C09B74E9702416A2661B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840514, "uuid": "50680068-a139-455e-abae-0edc92a177e5", "value": "1cb7010fa29c1205e95faaaf21e5a21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840514, "uuid": "fca74ac3-49fe-44f9-9da0-f07a789e1566", "value": "12288:EWCXhe4mhLKlRUQGJNTXar3lSn65gQLtk:EW2mhOoQUTXars65gQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767840514, "uuid": "a668853d-92a9-439d-a82f-e442585c4fad", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767840514, "uuid": "abd5b28f-ecb3-461c-9d0c-69aba57e7cd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840514, "uuid": "4db707a2-a7cc-40ce-b5c9-e81db5128a1e", "value": "uD9m7fiknJvk5Ka8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f245b2-ec5e-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767855120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855120, "uuid": "0ad84f8c-fbc4-4dab-886c-5a63c65d5e89", "comment": "Malware payload (Gafgyt)", "value": "9a2bc9a3c9714a65541b6e3a693ff4dc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855120, "uuid": "210b0265-085a-4793-99eb-ab471ff04dd1", "comment": "Malware payload (Gafgyt)", "value": "96064ea99f3253663c955a497eced195a3ee8f31d1b93dc81d6e8bf7b97059b0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855120, "uuid": "7b827f8b-2586-4880-b0dd-fe3fa2115611", "comment": "Malware payload (Gafgyt)", "value": "84aafb57d203b72a72ddfa9d8c3eea11164a9133", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855120, "uuid": "19a18248-c93c-4e75-860c-78711c4d46d2", "comment": "Malware payload (Gafgyt)", "value": "918bbb1ad64d33b9f966e08c180e1ac776cf7c843660cbff952279e2feb248fae2bed37a0feadb444f78b272da9b9f94", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855120, "uuid": "8f56f430-4c70-4189-b688-748698796791", "value": "T1E522F7D8F9CC11BE24E544427193C3BCB95882F160E6DFA7EC5A48B1D9BE448A1EF781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855120, "uuid": "efd3d5b3-fba2-4df9-a23a-e73fa8f56ec2", "value": "96:hiOfWVc1dZd4cjzlZ16EMvyK6tTVRei0E3aezQBQzWxUXdmwPuceCC7FVAo+mz:hs9W7I1vVYTSPLCET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767855120, "uuid": "84eb43d5-f4d0-4bb9-bbeb-bed727d07eec", "value": 10876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767855120, "uuid": "c6cef5d2-f4e4-45ca-8d48-fa252dbf1196", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855120, "uuid": "9485eff0-6f68-4826-82c1-2c671eebd8ff", "value": "rondo.aqu.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fd7d7a-ecd8-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1767907465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907465, "uuid": "a33eaada-d17b-4f2d-b1ac-ff31b0402a2d", "comment": "Malware payload (RustyStealer)", "value": "80a6c7b861f8f8e386655bb3abdb67a3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907465, "uuid": "15293f44-237e-4724-af87-8be98ea5dc8f", "comment": "Malware payload (RustyStealer)", "value": "97639b6ec55c926f04bec98da5e056df779523fdf974af0b3525bafc94cbdf24", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907465, "uuid": "97072e73-5ef3-4d08-ac02-809df76008e5", "comment": "Malware payload (RustyStealer)", "value": "130e163c3bad9be197e5a5e0b13b4816f0caadc9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907465, "uuid": "33526164-88f6-45a7-81dd-9c8a20086330", "comment": "Malware payload (RustyStealer)", "value": "3ce0837e471f42b2d4964e3a19230a5703b07d22d0906b404e20d2ae005a0b9fa43fc0b030e31cbde5838e3bb4caf07c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907465, "uuid": "9213b71a-6d45-4124-b52c-04fa2d5716b2", "value": "T1B7956D43E69581FCC05EC1B887579736FA32B88D053476EB2BD04B642E26F906F1DB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907465, "uuid": "374cac1d-6e59-4a6c-a451-5a686eeb5927", "value": "a0a005ec11df7327099e98fc94834a6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907465, "uuid": "825f6689-f89b-4ef7-8fde-ebd85fec4072", "value": "49152:W0sheiSraGa7VHri7mitBPQnMiq8BRMLlPHE7MCr3KTZXIU6isx:W0sZiFFQN7BiB86q+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767907465, "uuid": "a00d300f-894b-427d-98b2-46bd5f813be9", "value": 1999360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767907465, "uuid": "4c7890c3-487a-4f12-ba1a-cf295ebfe9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907465, "uuid": "285a488f-0781-46d4-b1bf-631890c8d034", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686b0f01-ecca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767901452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901452, "uuid": "40a1ffea-f82a-4f89-a66f-3f6ebac9b5b3", "comment": "Malware payload", "value": "bddd2a021cd45ccc6f1ba223ad259b60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901452, "uuid": "9cfebdab-0db6-4dd7-a79f-aa784de8fc73", "comment": "Malware payload", "value": "994389565d55558ee4518dd93ae94842f9b6ae2bbe12284747dfbca8a10d3136", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901452, "uuid": "4371d024-d3f6-44d6-b109-2ba83634ae86", "comment": "Malware payload", "value": "b1db89b8ecd27aedf92ae185c012634ae81eea7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767901452, "uuid": "34ddc42d-ce8b-4c35-ba7a-9a3a6e334944", "comment": "Malware payload", "value": "bc9fdc4fe0dfe47004df994b8bb8cdb48bc8e480a3b5cf5f30cec235184a515b7fda53bc2a695fdc1ea459fef11b8e02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767901452, "uuid": "7543937a-55fb-44bd-92f6-eeb9b9315e02", "value": "T1FBF4336037755AB1C3B89D5C0ACCB8DC62398892116B5FC3E55149FF16CAE132E8BE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767901452, "uuid": "75493102-9127-4947-bce4-83011eeac801", "value": "12288:Cq3fzffTItBUXwVdDPOjS1tbozv/pRxKGAQeA+XZAlLSInbt3qHXUm:hzfEtBkjj8t0D/p5fAZ6LNnw3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767901452, "uuid": "f2acc94f-6ae5-4fed-abe2-39e67c8df947", "value": 737020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767901452, "uuid": "ad297f77-388a-470f-889a-f1674780f219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767901452, "uuid": "b44208c1-d26f-48f9-9480-3150fc3d967f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb402dc7-ec3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767841999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841999, "uuid": "f549cd59-25c8-480e-8c9e-68806dafaca5", "comment": "Malware payload (Mirai)", "value": "771f96247e2fc9fc451764a329433f93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841999, "uuid": "24b704af-a69d-430a-845c-7ba97ea41afc", "comment": "Malware payload (Mirai)", "value": "9b38f78fbcbe76aff3edd42d4a3f873a4931c4f57128da06d7599e1923ce25a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841999, "uuid": "e5905c8e-e668-4128-b07e-69fb88fb3fbd", "comment": "Malware payload (Mirai)", "value": "055d6ca80c0506f0bcd28fb21cf06c8a4023bd6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841999, "uuid": "dbe298d6-80f4-4bfd-aebc-3dae3b5e525a", "comment": "Malware payload (Mirai)", "value": "8bfbdc7e508467119aef95e572fca4164f9d3257d0bfbfa20d8fc729aa1448fee2d0f8097bd1ff909fd33b56323c326f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841999, "uuid": "36f3905a-3e41-4430-bdba-52374545d9bf", "value": "T128832AD7F400DD7DF80ED77B44534A0AB631A3A117831B3A6397B967BD722A44862EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841999, "uuid": "3c1528b1-0d2b-495c-b29b-c031e01c4d53", "value": "1536:jTffliLlpI8qsMciss8hII89ytTF2RVQ0aSaDz96NLrEVgpRCHfY0j5Okp:jTfNKl0vz8hIjytTF0USYz9KHRCHfYSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767841999, "uuid": "4fcccf72-e200-4aa0-bc2c-1c22cafb5084", "value": 84456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767841999, "uuid": "1bf54371-7d1f-4dbc-89e1-f92b7c5b519c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841999, "uuid": "24ab11e0-36bf-456e-9a29-44b2f7b0a88c", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfa88ca-ec49-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767845894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767845894, "uuid": "608422dd-39a4-49ac-9ba3-b74e488a724b", "comment": "Malware payload (AsyncRAT)", "value": "ab76760f3b25e3ec549318126e1a4d80", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767845894, "uuid": "bea2d2c1-fbf5-45ee-ae9b-d4164a01d3b8", "comment": "Malware payload (AsyncRAT)", "value": "9b53faf852762f014faf4f57c1aa35bbad9e754dce48973476ab561e710ee5d1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767845894, "uuid": "9a1cd2de-20f8-4208-9b0f-4094558250c5", "comment": "Malware payload (AsyncRAT)", "value": "2554ffde49c5aabcdf3bef06670d727a55451856", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767845894, "uuid": "ebbc6737-6190-4ec4-81b5-fcd173f9afb5", "comment": "Malware payload (AsyncRAT)", "value": "58c5c8b79b4fbf300ad344b09a6970452a8f8d21b98f2292445fcc8c3dcb1c92307860cdfd7491f3ff0bca560c7e1eb6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767845894, "uuid": "285e8861-3035-434b-93db-5b580e0fd041", "value": "T168936C013788C925D1AD4AB4ACB345010AB5DD772105DB8F7CC63ACF6BAFBC656122EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767845894, "uuid": "72c0531c-7a01-4bc9-b28e-087ede5c76b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767845894, "uuid": "acb17189-9a65-4a36-b120-be1b66b0f9af", "value": "1536:zuW40ziUJ6AeGbbnwedTW+VGnrWySWRTyMVclN:zy0uUorGbbn7dmOoTyOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767845894, "uuid": "3988c76d-2ddf-4ddb-ab0b-998c347b514e", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767845894, "uuid": "9e7a4929-92c9-46cb-8195-c363100163e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767845894, "uuid": "ab782eb0-d2f7-4793-af49-73ed5fe630b8", "value": "iesetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5a2982-ec6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767860501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860501, "uuid": "ae1facb2-33f2-4758-8227-e7a3dc499eaf", "comment": "Malware payload", "value": "f33b0f9d963ac490f6e1d08f5d9cbd01", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860501, "uuid": "257a523b-d43e-4b9b-bebc-d393b1b92a0b", "comment": "Malware payload", "value": "9bc2d522e6ff849a5a0e9ed553f4b8a210d2c1999c7f2de666742e077b005059", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860501, "uuid": "c8b7e4f0-3297-44a7-848b-9ad15e66bbd0", "comment": "Malware payload", "value": "d228fed3daba8b1c7ccb323e55a2014be9de4b2c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860501, "uuid": "261dade5-531b-4ee9-af5e-42606b08fc0f", "comment": "Malware payload", "value": "5831621f52e92231a96662c0e8e82dce8510679d2e6902f5fe147a86c05e1c54f7983993cc33a59a956e1af07513f5e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767860501, "uuid": "0bed12e4-6e52-4895-bda9-d1304443529e", "value": "T112E2F822FDA5943602678199F7BBA709F331404BCA04CA10F6FC866A6FD9E42CC579DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767860501, "uuid": "3788de33-be11-4c4c-b0f6-b8f0b8499a00", "value": "768:M5RHm8ia7zHqrqsCUonKOBbK6KftIVUffx/Y:M5RHm8imH1UoPbjctIix/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767860501, "uuid": "df843d28-fbc8-4e1d-9e90-8ad71664e593", "value": 33896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767860501, "uuid": "23b21049-0537-4367-ae42-53172c795c2f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767860501, "uuid": "b7c9914d-f8ef-4bfb-bc2b-40e18aa35fef", "value": "PO_N0_JKPO25040107.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899d0f37-ecd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767907950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907950, "uuid": "9f1d79d0-9c9a-4b29-91ca-883bdb758d21", "comment": "Malware payload", "value": "5b8be4ba513e2820d7db51daf13fee74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907950, "uuid": "697e94be-63e2-4e22-9401-9ea43d2cb15c", "comment": "Malware payload", "value": "9cf784ccfd74e313df672c3e938b82d608f3f0611ff4c3ebe57327a8517f1486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907950, "uuid": "e5d0eb7d-9f7c-41b2-bd9c-ae40010f3f13", "comment": "Malware payload", "value": "a62f6bcf7beec62283d17dc8b9551f3416eceb57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907950, "uuid": "c7b27f6b-534f-4bd6-bf15-50fe4c813f20", "comment": "Malware payload", "value": "540980488e72a2483f130cd207fbce7277239fbed6b8718b74964b68a8c4771df81d434833877ec6e2c92eb40fc14f60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907950, "uuid": "7ba37f70-e5d1-4214-b7e4-e8e46a4f0797", "value": "T18C862892FA440219CA9BE238DDB461697330B444133612D76FA70BB54DDBBD8173BF2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907950, "uuid": "0749d709-68d1-4565-98c2-936c71d6e19c", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907950, "uuid": "16e6967d-7dd0-4e71-b66a-2a235e69a0e9", "value": "49152:NKvFz8uzeDrb/TdvO90dL3BmAFd4A64nsfJVC6rKjb4ejn/8/EOtK1au244lty99:YvF/1AjU0r0/1EzlfEZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767907950, "uuid": "0af43ce3-7d9e-40a7-a8ee-f3868834f394", "value": 8337024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767907950, "uuid": "c39eec3d-a395-4ece-828c-8763eef2912c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907950, "uuid": "cfc6718c-d8d2-4660-a7d2-8625d3202661", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6d68e4-ec60-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767855801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855801, "uuid": "b8feef7d-7bc6-408d-978c-b3f882872da5", "comment": "Malware payload", "value": "78de7107f423c1259e2e3e96e6351028", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855801, "uuid": "dc2b9c9c-3ffc-4109-bf41-9b4272c61fb3", "comment": "Malware payload", "value": "9e98bdf2eee6fb622ac7d0f43097025cd3fbf9ae89e0dea92c18d6058fc6fc08", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855801, "uuid": "d9c478dc-9497-47c9-858b-5b3fe425d1c2", "comment": "Malware payload", "value": "301920ac13fc7d7e1fa305aec245bbdb4b206106", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855801, "uuid": "234b4aaf-b754-42f6-b78a-8d86f8667039", "comment": "Malware payload", "value": "2a650abde7a388456bdb363fed752bc78572dc1e2c13f430f460ea6eb6b93cf38c41344d7804baf8503ec2aeda00c257", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855801, "uuid": "7b7ffe61-4547-49d9-909d-777f482cd358", "value": "T1AFE2F822FDA5903602678199F7BBA709F371404BCA04CA10F6FC866A6FD9E42CC579DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855801, "uuid": "67f89721-16d9-4bf3-b8dc-ae0f36ff8a2f", "value": "768:M5RHm87afzHqrqsC0onKOBbK6KftIVUftx/Y:M5RHm87mH10oPbjctIUx/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767855801, "uuid": "369bda09-f84a-423b-8821-cc910ac1cb62", "value": 33892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767855801, "uuid": "2cfbcca7-e836-4b7e-8ea8-4fbe04f2cd63", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855801, "uuid": "d4f3e61c-eac6-4a08-a00a-5b086cee78b2", "value": "PO_N0_JKPO25040107.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16e934e-ecd1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767904635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904635, "uuid": "1f294fc4-0118-4b56-96da-b78cccb823ec", "comment": "Malware payload", "value": "b0e79f77ed39d1b2bf06750a274da3f5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904635, "uuid": "2f9fcaab-73b8-402b-8bd4-e7ee139b43cb", "comment": "Malware payload", "value": "9ec574a8c39434ad86c19a6869453cdeb2a35a4fa0161806a3193fe4bb7fe31b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904635, "uuid": "c498d253-1500-4f8f-b793-f11f7b8857da", "comment": "Malware payload", "value": "85c24ad2f04f9a1048b1fb0c229320313d841aae", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904635, "uuid": "fbaba44d-727b-47ed-b9df-395b8ceeef22", "comment": "Malware payload", "value": "6c2991031d28d010c2b17809a8d6341c6a44e263b3a61b44f67e28e80e3bf1ca1e18ade0b22ad98f0e83647d489dda32", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904635, "uuid": "a488483c-1aa4-4462-a062-8b9b3377fecd", "value": "T15A0539BB62E810E3E2B6363BA4794D170AB7FCDD25F08549D1DC2B2AC6309A1D5D071E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904635, "uuid": "9c83244b-537b-46e2-9413-fa153f643d24", "value": "b10596a614daeaf025ce254fa50b488b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904635, "uuid": "4a7be24a-bb8f-4cec-b0d1-74b0e454eb18", "value": "12288:XXj2zwUTGb2YJgIrIvJ18TBlnhb8xEyCgTxJDGTapfQq/hU+PNe3kU:n4tqb3JgIyJSPh24EJDMapJhUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767904635, "uuid": "b636c322-a7ec-47ab-ba27-56c5266032b8", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767904635, "uuid": "90381e9c-bb7d-4332-90aa-361ff5708a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904635, "uuid": "8fcede92-d14a-43ea-90a3-99f149051717", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16373a7-ec60-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767856021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856021, "uuid": "01fb8eb8-a842-460b-bce2-14f03061c287", "comment": "Malware payload (Formbook)", "value": "c582a39fcb4c4b3d72b3cdf8635de604", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856021, "uuid": "c3494506-4fac-43e5-af00-ba3994593fb6", "comment": "Malware payload (Formbook)", "value": "9f9a7fd9f0d602ab0170d36da2e78425d9b469c691bf45dbf66e490d39b4790a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856021, "uuid": "770a69df-dacb-420a-bfa7-30504a0a2787", "comment": "Malware payload (Formbook)", "value": "1171b4ace4e415c6c4a456c1eacc798010597f4e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856021, "uuid": "b8e793f4-fd06-4b2f-bc3a-7cb28ec9b8cc", "comment": "Malware payload (Formbook)", "value": "c6056763a81a01bda7b7e250fcd19f6514b426473a39cc80aec1e4c164c189c950786c4425ebfd4daa6e7144e9971d0f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856021, "uuid": "07e8d1d0-ca4e-4480-a424-61e13e4511ab", "value": "T108266217476CAA6345A0D4EC6B21D02CF165078F75A268297D9E8CCDEE281E3C7EDC39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856021, "uuid": "40a321e5-8852-4be8-b871-2fa37892adc7", "value": "192:3M/sybLCGxROYbuGxRu7pGxRtsI59nOZlQYitJOSAFwBjx65oKtGbBK0Iya+7s/f:36f2Ele8jxSn65zMZQtbYYfB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856021, "uuid": "490e822a-478e-4ae7-8b47-c9f9564ed4d1", "value": 4513366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856021, "uuid": "8c592559-7cd2-46b4-a439-a6a20c56d764", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856021, "uuid": "f00659ed-db87-4e44-b4fe-7c4a24e8c94d", "value": "Orden_6532572.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20438001-ec4e-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1767848074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767848074, "uuid": "ba003cb0-7feb-4d71-b7e3-14f339427b15", "comment": "Malware payload (DCRat)", "value": "82a953ae48f1d17c0319f497b0c59c69", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767848074, "uuid": "ede0827d-d8bc-4757-8e56-cf8413a228df", "comment": "Malware payload (DCRat)", "value": "a155b57c980f2e1bdc559b124d49cc75c249ef3f09cecca44cb289aea148ecf3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767848074, "uuid": "4e5cbd1e-b93f-4912-b1eb-be31e1bbdb71", "comment": "Malware payload (DCRat)", "value": "9f337d0de36f42aaea67a4afbc2d4c646bf958bc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767848074, "uuid": "eef11860-cbfc-459b-be9b-2a472ee1ff7a", "comment": "Malware payload (DCRat)", "value": "9bf8868a398e03f5b182c6c17b678bfabb7da1dcf64cf486830ee8bfaa54625bb762441aef33477872ff8549b682f463", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767848074, "uuid": "1a173afa-dbe5-4498-b9c4-d5ac19631697", "value": "T1F324860037A48E0AF9E96B364640E3595D35ECC3AB36BFD9075510CA1F2DE43BA81BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767848074, "uuid": "9bb3c9d4-aa61-4728-8885-b77b7be5f188", "value": "3072:EzEJcVrcXKRknBr1XZhEjxs5ZbtI3MczdlT5mvz:i5R8sja5Zb05Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767848074, "uuid": "a3078b90-5c33-45ac-bb66-c70268d16397", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767848074, "uuid": "508f2373-b099-4c61-801f-36f9a7902c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767848074, "uuid": "553fae4c-88ef-47e8-b341-f9cc53ba77f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93856291-ecd1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767904531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904531, "uuid": "63b3c05d-8185-4955-916e-869116202806", "comment": "Malware payload", "value": "a7209129ff410ef96d304a75b921c3a1", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904531, "uuid": "7e03a197-03a1-4d62-a398-2774c9bcaf2c", "comment": "Malware payload", "value": "a1c6874302f373574d0b4c6bb22396616f23488edf3f30305d81412854698460", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904531, "uuid": "d461c48c-c992-4679-8906-135f9180c457", "comment": "Malware payload", "value": "0266a32e8dd9495960bb02ef9035c59f11dc51f2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767904531, "uuid": "17eba3da-1b28-4d55-9968-abe0c5aa8065", "comment": "Malware payload", "value": "3600126ee442ffab570528e5c3f1f9effa0365cdb9bfb82e208f39ed0256554bf39c3781870adaeb7256504056964441", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904531, "uuid": "a8dadafd-bbc1-4752-8220-ef6a420e6acc", "value": "T1BC27335AE599D9DF3DF55E1ABF8304BE014B306F3B1A434FA376C9A1A637090E1418B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904531, "uuid": "69f9c8f9-4b71-47ef-9c30-ca259d7dbe94", "value": "393216:J6ymzYrSk80i3ZHunmyf9BB2Cg0l3x3l28MkgrzLqk2:J2zYrSk8j3Zf8T3X28ZyzLqk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767904531, "uuid": "584429ba-e4d9-4b33-9e8b-8de724058597", "value": 20704334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767904531, "uuid": "8f972666-d5ca-4509-a2f1-75d2de74f408", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767904531, "uuid": "c80ba928-95fa-4c2e-8db4-eb9b23c8cde5", "value": "AsusDriver.sys.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb57445-eca5-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767885702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885702, "uuid": "3023709e-64dc-4b6e-a045-727f92e5123a", "comment": "Malware payload (AsyncRAT)", "value": "044011bd4f8ff29f900d646d831202b0", "object_relation": "md5", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885702, "uuid": "84ef9957-6858-4dd4-8e03-73f38f8b0a97", "comment": "Malware payload (AsyncRAT)", "value": "a22628f18c66034193ebf0a6d9fd6b50a6b86f700b29549b87dc4d545c111463", "object_relation": "sha256", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885702, "uuid": "3f219251-1706-48b0-93ef-3761640a4668", "comment": "Malware payload (AsyncRAT)", "value": "cf1cce93c256d8c313e2b55f005057256a7fa66c", "object_relation": "sha1", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885702, "uuid": "ea3b772b-5c9d-44ce-b4f5-4994e13a60c7", "comment": "Malware payload (AsyncRAT)", "value": "a168b69e2e34763eb8ee51ea7b9348b58623c04ee0fe70ce013b9e593374f5f37af87ad72af8f8e35da232cdfe539bf2", "object_relation": "sha3-384", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885702, "uuid": "222ccf42-5714-4cb9-9e66-d3d82d425b82", "value": "T1C1233C003BE8422AF6BE5FB958F231494A79F6576503D65E1CC401DA1A23BC6DE01BFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885702, "uuid": "cdf93c99-8aee-4fda-bec1-d13f1459c3cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885702, "uuid": "5de895d5-d486-40ea-a08e-6e444452f882", "value": "768:MIPaTqPRCpGPSwwRq1D5MLXayt/jbdg65XwMYuRXjNTfZGgCqsf+:MIPaTb6m5LbK6ZwMzRXjNThHDsf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767885702, "uuid": "1247483c-50e2-49c6-a7d9-4ead62f42292", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767885702, "uuid": "b0e3bc0f-81cd-455a-a3f5-460841f4c177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885702, "uuid": "94091899-3620-4b1b-8d5c-62830ed11900", "value": "Addone_asyc_pl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0925752-ec5f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767855617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855617, "uuid": "bb7d8b78-8bde-404b-8e93-ecfd80c3b216", "comment": "Malware payload", "value": "7f26369710e1ce5fe99bf41e604cf9ea", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855617, "uuid": "17f09a94-f146-44fd-af05-a9f67f3678ad", "comment": "Malware payload", "value": "a2393bb756761c4f0be0f5be0ac8f6354356bca8f124943e254a72dc18403b89", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855617, "uuid": "9bb42c07-d2b2-4732-8853-d677e66654f2", "comment": "Malware payload", "value": "16fff8feb403b04cab2a04ae29ec087e7f7b9471", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855617, "uuid": "97132c90-3eb4-492c-b5af-2d4c208b613d", "comment": "Malware payload", "value": "f551128103229f34e33038dbb359adf518bba21c87e80bcd506f09063fbef0a4ec145ebec1a46d5e1bcee8053f97acba", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855617, "uuid": "0ce11a23-9994-4da6-a834-93227bb5c2d1", "value": "T1F531D6BC870BC04BDD1E46734F07CA653F39AEE296C402031B01F82958ED293E00EE68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855617, "uuid": "40184ef4-1937-4bf6-bae5-865c5735f0f0", "value": "48:8H9gbUoVkpbSvpKF1HZyUYKsGlZIYrozduYKqVLb8+:8GkF0KPpYKsBYroEbqhb8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767855617, "uuid": "e49629a0-4803-455c-9e61-e0bafccc2942", "value": 1793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767855617, "uuid": "c18a5438-1991-49c1-ac25-94e2e08e2200", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855617, "uuid": "dccebab0-e57d-48ca-8366-13eb85a95fb4", "value": "8311534882737456056321448DOC.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e882b7-ec6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767861044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861044, "uuid": "176743c2-451d-4775-abcb-4f5b378d6c02", "comment": "Malware payload (Formbook)", "value": "9e85094d5adc576149b0b61728eb1b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861044, "uuid": "4dba89f2-34d1-4ec9-a88f-098b9f56fb38", "comment": "Malware payload (Formbook)", "value": "a2872a57bbad4ddbd5a46e2bd32d502b0f8e0682d89869b72613d5bd5f74b580", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861044, "uuid": "3bea8334-fabd-4e23-9b6e-7c0f1412d892", "comment": "Malware payload (Formbook)", "value": "8b9af34bb7e19078f1f05ea4481194791727944d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861044, "uuid": "04d355b5-af0d-4070-921a-24d0c93d104e", "comment": "Malware payload (Formbook)", "value": "38a03e91df924e892ccf26bd0837ee37f5663abb4ff0e639f7f0548c9a2c88ab3605bbe12c862b92993fcad3103f2afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861044, "uuid": "5f438839-245d-4e20-96ce-0352d2ba43cc", "value": "T1FAC4F1223B15D907E29121B05922EBBD5BB0AF6D2D598B03B7F13E6F79393536C1E240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861044, "uuid": "2efda3b3-cbef-4763-9b3d-6dda0e5401f6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861044, "uuid": "ccbd1fae-5b39-49d0-9d55-12d38841a8ef", "value": "12288:WbjSjfsuPH0JjaIsNULtE5oK9PMaYQ9WN09z:WbOjfJPH0Juh6GKK9mQ9ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767861044, "uuid": "786af57c-24d6-460c-9344-3735bb1f5e7a", "value": 585872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767861044, "uuid": "7d97a127-bced-4eca-a516-000e72cd10e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861044, "uuid": "bedb23d8-662e-4501-8278-6d87c4c440dc", "value": "ARRIVAL-NOTICE-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1908a0d2-ec60-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupportRAT)", "timestamp": 1767855792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855792, "uuid": "6f635604-8cad-458e-a29e-15ec1928a18a", "comment": "Malware payload (NetSupportRAT)", "value": "2cafadad75ae41deffcba2210a8671f0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855792, "uuid": "82490dbb-32a8-4da4-b707-1fdea7267e8a", "comment": "Malware payload (NetSupportRAT)", "value": "a2a1607f35251840030e0ddc589a1cffdfc37e71c7ba2a6ab9571b9b5d82903c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855792, "uuid": "a09979ea-2f84-4026-86f0-a0071cf88e35", "comment": "Malware payload (NetSupportRAT)", "value": "9c75752208917f1f5fc7702209180550a05ba4ac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855792, "uuid": "98dd628c-6099-4a2c-87ee-b0f9ee33797f", "comment": "Malware payload (NetSupportRAT)", "value": "6522ad8e2390b53a431a3369cbd2f1f7d440b9c7da1c172acffa07191e56578bc26e28969346370ae79ecac393408f1e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855792, "uuid": "b75b0bfd-ce50-47f0-8a50-9444efcbaeea", "value": "T16CD43BEC31ADB6265EE342F5106F1507B2782823580C8860F121EDBD37B999951BBFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855792, "uuid": "e689cefa-5e88-42e9-9055-b342470080ed", "value": "6144:T69o4f0ENXYo+TwiZ+N30pzozzGql4erLnQEsDFx6FuPuuNp1m8LcgigN2kI/:mZfxNXd930pzoZlzo7IFudN+9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767855792, "uuid": "ce1be58e-a3a7-4764-905c-f2cebb63dd48", "value": 612353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767855792, "uuid": "433d0428-89d8-4a3f-aee1-9e36892b3a12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855792, "uuid": "208a1300-51d6-4055-bced-84b88ab4d633", "value": "profile-asset.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfafa1d6-ec3a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767839778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839778, "uuid": "745658a4-d6f9-487a-923e-cd80e01eefbe", "comment": "Malware payload (Mirai)", "value": "4a60c0b781d0de8b23d63adf57f74774", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839778, "uuid": "da627cf6-fb06-417d-b945-984331bb39c7", "comment": "Malware payload (Mirai)", "value": "a35731cd48227aebbc82e9a9d760fb57525ca3497d15251bfdf0f63b47ab8f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839778, "uuid": "d6c84ed0-6717-461a-a5fa-1c1082423fd4", "comment": "Malware payload (Mirai)", "value": "0e05a4b1d0e20cd18bfeea7a9b43b6910024c532", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839778, "uuid": "02c4c007-3d23-42d2-8359-ce77d14c9148", "comment": "Malware payload (Mirai)", "value": "392856c4d14d0d47ae7d7f819b0bc7431ab48c69bdb0017727de06bec69a8d3f940ae28891cea8f2b22331dc2c15e2c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839778, "uuid": "dc4a459f-9238-4b96-9678-09dc9caeae97", "value": "T16D057DD9EB87E0F1F26300F1025ED7F64534A22A5013F6F6EF452A6278727616F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839778, "uuid": "9521a76d-d589-4fd1-ba3a-5f43c28fea6e", "value": "12288:lVstjGhleh3z/dGZcD6Y2k5td+Eo/qR26ZA6yX92HSWPyMDlZUae5Lu:lVsGhlehDQZaQk5GxSR26ZQ8HhlZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767839778, "uuid": "c3204a80-07e1-44ad-b169-0f8b4be0f799", "value": 861656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767839778, "uuid": "fcb8a065-3702-4c75-8a9a-b4113693de3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839778, "uuid": "79f3111c-5123-4546-8834-dbeeb88425d9", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28ac4c0-ec87-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767872774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872774, "uuid": "cb7bb6fd-b2df-481e-8a46-00bb0fa6b957", "comment": "Malware payload", "value": "db7c19b335987369608efb9f39c3fb28", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872774, "uuid": "bdeeccd6-c303-414d-9c36-3b0c58dcc0cb", "comment": "Malware payload", "value": "a56c77c3b29e0c122e98d9f9c16062bb097a785f74a92c429a3a64442685a5a5", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872774, "uuid": "58237f9c-2ee4-48d1-aaf8-e843483e424b", "comment": "Malware payload", "value": "a16656af8a1dc89519a1f69e78dc066dc00fc75a", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767872774, "uuid": "3b87ee4a-675d-4aee-b2b1-2b6d60ac61de", "comment": "Malware payload", "value": "1b639d71bb766d530e21a762e4f0eb41438e8eae288d2877746eaad60186ae5562f3b34b75125e0de981f652851cf461", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872774, "uuid": "fd300c32-e3f9-423c-8736-b94996bdfbaf", "value": "T145D4F151F87BDA591391D769083E30F1083DBA25E48999DA9A15E6CECAC2D2FF1133C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872774, "uuid": "6b7a20cf-8259-4bdb-abd4-63fa43aa9120", "value": "12288:MQD3N3en9vcKUlRp2X4DAQDQxo67uWg3ro5BtwpNOdekb:MezNPg7Nm3awyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767872774, "uuid": "f6a599eb-f5ef-4242-9863-fabf6ee118b5", "value": 633100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767872774, "uuid": "fc8c33e9-d283-440e-a46f-8b4956d6a36d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767872774, "uuid": "864fa635-f180-4dfb-97d3-6ef9a2ad5b1a", "value": "521ebb63a15b2b5f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d5111b-ec9a-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1767881049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767881049, "uuid": "0b6b8c19-bac8-42a9-b63b-d9ec20788233", "comment": "Malware payload (MaskGramStealer)", "value": "88946ceb1d6a6ee3d354fce96251787b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767881049, "uuid": "b15fd6e8-b39b-4561-97ec-589d24facece", "comment": "Malware payload (MaskGramStealer)", "value": "a8a7c10fd0c56709ea4d0f7b8b950a2921b1e2354f6c3164eb137a663504bd65", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767881049, "uuid": "ed637bea-692d-45a1-bb79-f73b9a851901", "comment": "Malware payload (MaskGramStealer)", "value": "dbcde2687b9f2f5bc3f12057274ded5c778febb0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767881049, "uuid": "48b055ee-073c-4e5d-9297-a7e5b3131d3f", "comment": "Malware payload (MaskGramStealer)", "value": "725fa6905cc84bc93fa5ac56c762993ec5ce7b8015da1aad8a4841dddf20c0afcaaa087c18d80429096d1b69726bd57c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767881049, "uuid": "932c32cb-8015-44e2-99c7-0bc31a5c5518", "value": "T100D5330BC8D47D6DC13999B58DD3ED89EADBB3912607C54ACDCE0ACF921A8EF5C09480", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767881049, "uuid": "9feb99a0-3250-4f79-87ad-4ecdc9d12275", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767881049, "uuid": "129c6124-20b8-4285-ba57-d4bb88561d57", "value": "49152:vs6CJJ9NX1/SuJ2ULNYwpqXb2ZtYIvZOnXcB4ozirknBj0FwH6WJRm5JMBr6r:vnClfplNYwp4i9OnMPzisjE41JRG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767881049, "uuid": "f93a2890-eb16-42fb-902b-3606e97fe7aa", "value": 2748416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767881049, "uuid": "aaf491f4-a186-41ac-a5b1-e5c948af7684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767881049, "uuid": "4cd617ad-0c8a-48e6-bb23-1d7b214d98b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac305cee-ecb7-11f0-a129-42010a9c0007", "comment": "Malware payload (BRAT)", "timestamp": 1767893406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893406, "uuid": "a56eccee-917f-47d0-a35c-b594ddf4254a", "comment": "Malware payload (BRAT)", "value": "1da343b25cc8179fabf4f8faeba453c4", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893406, "uuid": "e4e3d5e5-d78e-4b4c-bc93-4fe4ae397a1b", "comment": "Malware payload (BRAT)", "value": "a94232783734185cf35cf0725c52012b455df9857780c5712dd2aa51956e6599", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893406, "uuid": "4cd3ed37-553b-4977-91b8-e9bc30f47ec2", "comment": "Malware payload (BRAT)", "value": "4705d32f288fc95ddc3908774e7e6818198d005b", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767893406, "uuid": "c588df1e-ec83-4618-9003-7553bee6ef49", "comment": "Malware payload (BRAT)", "value": "159978dd1cee37570aa8b809b132efcd055ddfed762d7c3694b360c8e9f3e8d291d134d5920fac56371291e0f9a74bc2", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893406, "uuid": "2decaf19-82e6-4c1e-993b-ba85fdf7abac", "value": "T189374C52ACE416F6D0E5143CD0C44619D6D6ACA81F36E94F988CC77EAEB38447A23F2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893406, "uuid": "bbd92533-a6f9-417e-a2b2-68816a85eaab", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893406, "uuid": "506ac211-b636-40dc-ad8f-a8a03097c1ef", "value": "196608:KDnfIeyRnOtZSmZFpG8fNYnVyyctNbAwDXdCmzhtoV1PQFsJJXjY+vcX5/vF6XtJ:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767893406, "uuid": "a4429df2-1724-4087-9191-da76305955f3", "value": 22644736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767893406, "uuid": "50618121-c860-4b88-88b1-650caab5adcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767893406, "uuid": "2f3410ac-0f86-4a00-94f6-006885ae916f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b2c64c-ec39-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767839030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839030, "uuid": "54000010-0551-43cf-aa4e-53ef2f945b21", "comment": "Malware payload (GCleaner)", "value": "d2f3515814a17beb7f8ed258b28b7a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839030, "uuid": "5bb28863-c656-4a56-be9d-345c0ede5175", "comment": "Malware payload (GCleaner)", "value": "a95f207caf93b3447cc7d612fffeca504c71ed8945975b939422115cea301fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839030, "uuid": "88005a45-22e1-478e-a7c9-70c1729c073a", "comment": "Malware payload (GCleaner)", "value": "92feca8bf95761e9e5f9edefaefd51dfefe2c74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767839030, "uuid": "f0c157cd-2f35-48b9-a88f-4b08738f4f51", "comment": "Malware payload (GCleaner)", "value": "4b4c662eadb6e0958d257f4915368bb731c9a357513eedf72a335a9b2b7de83b0e652dafa6c81e8fa965c75b7cd82b8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839030, "uuid": "501fbcd5-e728-40b5-a79c-3a29f8a2519d", "value": "T11516E04AB9F16423F89B38B99AB791D63477296338150CE3969838FCC62CCD17907F85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839030, "uuid": "f304ec36-ef62-4fc3-a039-5870c98e6b90", "value": "98615183c8737b803f9ab650a6f91b1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839030, "uuid": "b91631f6-554a-4fa1-ad17-fadd45e3a1fb", "value": "49152:C4nCVTGQ4JWlrdfyp0NerXXnidwWSfxEiFdAScPHBjvc3+ga:C4nCVSloVZyH7idwWaFRcPHBjvcuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767839030, "uuid": "0f5d4e88-03ee-4d42-a452-0e7db7e278c5", "value": 4285712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767839030, "uuid": "76620338-138f-457a-a895-8e3ace487766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767839030, "uuid": "c6774b36-95fb-4c80-a9b7-d8c5f8014817", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ddaabc-ecc8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767900462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767900462, "uuid": "41ec2f73-91b2-42b0-b9d5-9d97d942fdc6", "comment": "Malware payload", "value": "585a5346ba52f6ab0ac50e077ba20def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767900462, "uuid": "196a7a1d-0bf8-4337-9f53-0ce58379fa00", "comment": "Malware payload", "value": "aa5bc469d2668e1adef42f78b3247ed92bdccb241031035116357d05ba4ac028", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767900462, "uuid": "c5f1c895-230d-481a-a3c2-4d7c5c9b1dfe", "comment": "Malware payload", "value": "c70d42bafa9595872ae5b2388b1061dca7ff1691", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767900462, "uuid": "dd6b1fc6-1d8a-49ce-98d5-4a21a6d798ae", "comment": "Malware payload", "value": "668c709aecb36bebda4524e5dc5d09fe9d1b6d6dd447f138fa0be76fa5ab969310418388ad9fa75718ca922934504d7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767900462, "uuid": "0b7aa797-5a2f-44f2-a941-2b9c9e99f1e6", "value": "T1FB7533D315420FB4ABD2FF3881186986E661DEB44B7EB3B8B274D67019437F6A230875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767900462, "uuid": "b01ba2d7-2064-49ad-a579-873387fff87c", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUE8swuW46sJ/gWhHhbVlGttgKAmx/do:EpCKabVQ+9qlNlpjN8H8JZGtucdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767900462, "uuid": "9797705c-3cd7-4945-8260-a3297073b36e", "value": 1621756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767900462, "uuid": "cf63dbd8-bb04-44f3-928b-db1821ab54ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767900462, "uuid": "f73d9b07-c4a7-4d58-87f6-8c2e3b243c3e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5298611f-ec35-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767837421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837421, "uuid": "a3ee66d8-e3a6-44d0-8bc0-e2d1cf945157", "comment": "Malware payload", "value": "a4407ce9b0319bc4fa516c754d13d9ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sabsik.EN.A!ml", "colour": "#CED05C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837421, "uuid": "75c1d4d4-8b9e-4f85-bc4b-62b6b0040ec5", "comment": "Malware payload", "value": "ab6f1cc233c95d3026df95944cbf57e50a57d3f37ffcb65f9ea42c8e7723f0d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sabsik.EN.A!ml", "colour": "#CED05C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837421, "uuid": "e99cc1a5-dd13-4858-9956-af24c1d2d80d", "comment": "Malware payload", "value": "3fc1d43054d80b5dee6f937c118725d6049b6ce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sabsik.EN.A!ml", "colour": "#CED05C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837421, "uuid": "f9f8a5c3-8d6b-4175-9e02-a9b5b8ad9586", "comment": "Malware payload", "value": "0a2b2fbecd6141e240e726fa872290001b32f82c726d766beac023eb7fdd68b760deb6bb4fdbd289e0183a2ab9db520e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sabsik.EN.A!ml", "colour": "#CED05C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837421, "uuid": "31eb08ba-97e8-4308-b513-058218ac2df9", "value": "T1F714EA6570F87E5ACC4C4134DA618920C95DFDAF448231C533F87A2B26F2AAF691E876", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837421, "uuid": "be71ac2d-e3fc-453b-834c-d91fe1133bd8", "value": "2e7006904ea2fb6fb47f7b54b4850f8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837421, "uuid": "c13375e9-12ce-439b-87a6-9d9ef32f9240", "value": "1536:aVXARp1EwkYOxKKOtKKoy7eMNvIvwwVQrWP7+R:aVQRp1EwkYOxKKkKKoZXFPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767837421, "uuid": "2809e2ee-ba0f-4b48-9641-9357a2934bc3", "value": 192152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767837421, "uuid": "50555d92-3c1e-4fe7-acec-f78d899dc117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837421, "uuid": "7f911aa0-6128-4937-a8da-78586cd1e9e0", "value": "\u9644\u4ef6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44e5fba-ecc1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767897741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897741, "uuid": "9bc85a07-2510-4270-8f81-6ac6b728f4a7", "comment": "Malware payload", "value": "9c0582ad3a023d86ef3c7c87311ddf2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897741, "uuid": "19ca437e-df97-42b5-9bfe-c095562f5626", "comment": "Malware payload", "value": "abc3bd9978ea6dfe10269593f7021eca429b966542c92e56a4abd508830dbc94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897741, "uuid": "de4d7157-ec15-4078-80d2-a473d528d273", "comment": "Malware payload", "value": "9a0d81430b33403fd8cb14c9f1ea634b3ef49130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767897741, "uuid": "c31d2368-c91c-4a85-8f4a-187692d1dbdf", "comment": "Malware payload", "value": "207402dbe9c491ba98a240e374c29f7e169a908a1fb068d63dcb279a72b827e2bb3c3bf2492a490e7c23a3b260bfd0b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897741, "uuid": "8af95ddf-5da4-4b7d-940b-e8d1ffed61f1", "value": "T180D31246EF369C1ECF001EB22ADB5B9E9C6D7A6B51CBF0A4F9C1814F13A01D97D12219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897741, "uuid": "c02deb8f-8d4d-4ca5-8e4d-bc5e56ba28b4", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiomA:p3lOYoaja8xzx/0wsxzSizA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767897741, "uuid": "44ec1300-f5e4-46f8-8c67-6f1f90a4c66c", "value": 135784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767897741, "uuid": "cfa06875-fc6d-4f71-a347-670085602b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767897741, "uuid": "a7330ff7-d535-4834-b58f-73499cc037a2", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c4600f-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906436, "uuid": "42c63c80-1b6f-442f-8a02-50e1856c464d", "comment": "Malware payload (Mirai)", "value": "4f952706e82537eff271f55f43ccbef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906436, "uuid": "7e62119d-5615-4279-b1a6-d92dbc5928f0", "comment": "Malware payload (Mirai)", "value": "ae7366f939e90bbaccac6a7fe65a7c3a92a4579ad2eb9347be16a56783230772", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906436, "uuid": "2e2ee18d-5906-4094-801c-0426cfa3b575", "comment": "Malware payload (Mirai)", "value": "f09431888ca5cfb19000916eee06165081a6e8d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906436, "uuid": "f361ad7c-f30f-4042-9df2-164dac02a14a", "comment": "Malware payload (Mirai)", "value": "733d3732abbbe304f7d6392946f14d57826e59492b1993e5d2ed82bbe02e9008890b7285dbd4afda85ea300e0d63c404", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906436, "uuid": "71cf2d5e-40fd-4b86-9539-3f64a9aa28bb", "value": "T1E91439C7FC00EDBDF40BE77648574A0AB530AB9210925B337217796BEC7A0960667F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906436, "uuid": "a68b6b3c-a6a3-423f-a4cd-07e17451b750", "value": "3072:pjjQzzs+CaWKGTb2s73rogu9AHUgVFeLLNV0jbiFLO8Fb0yW3fb9ht:BcP5H7+3rod9+DeLvLxFwyWT9ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906436, "uuid": "76e7fa5b-948d-46ab-adb3-c349968a8dda", "value": 195392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906436, "uuid": "0a50a6a5-e592-48c9-a7de-828d624a77ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906436, "uuid": "3de83ac2-011f-4df9-bdae-925468f32784", "value": "ub8ehJSePAfc9FYqZIT6.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a0d7d8-ec84-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767871440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767871440, "uuid": "11040c11-5215-41e8-be84-6be86a4ab4d0", "comment": "Malware payload (QuasarRAT)", "value": "2b4647bed89713b8e702e88ba74c2751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767871440, "uuid": "585a3cfa-48c1-4a37-98f2-f8a4a5718544", "comment": "Malware payload (QuasarRAT)", "value": "aec4e7a5cc9232cc4f3c3a0f6322d88c023a8b2cb1f3caa28908c2809e84c2b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767871440, "uuid": "2ac7691a-d98b-490c-9e2f-a5150bbfb916", "comment": "Malware payload (QuasarRAT)", "value": "4e2de56c04a5716aa777ff499b6913c30b5e34ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767871440, "uuid": "d16b42d8-d301-4e7b-a342-0b5fee1c2c7e", "comment": "Malware payload (QuasarRAT)", "value": "735eac53b381ed0e1e109d27f16a781d8b57e288c6961b8c55b8052beb179bbe2c8b4c6e745778a971301f3dbff91acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767871440, "uuid": "2a109c06-2e63-4aed-9a34-09d3c3c8c98d", "value": "T16DD6231FDE42B4ED85E5101A029CD86CDEB9377C12D4B819E927C1EC9E7F38246B6632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767871440, "uuid": "1b0ef79e-4488-4183-b587-340347189cbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767871440, "uuid": "d007fb8a-bb0a-411b-a156-6ea61465a63a", "value": "393216:ZmDCJ3sreTw40pBoBkMIbo+IxL6rrSm6BOSc:ZmDssqTw4VByqL2mmUVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767871440, "uuid": "4f09b385-7a95-4b36-9350-9ac54cb6cc64", "value": 13346816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767871440, "uuid": "2764d274-7ee1-47fd-824f-a5747e2a412c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767871440, "uuid": "4312734c-e66d-4b95-9b77-47f41f81e6ca", "value": "SecuriteInfo.com.Win32.MalwareX-gen.24249269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfe45ca-ec60-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767855797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855797, "uuid": "3a983969-7aff-4992-82a7-bcbcec8ea621", "comment": "Malware payload", "value": "da3908d238c9dc779bfa16bf5e12e7b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855797, "uuid": "6bd8316e-d731-43bd-953c-366b22549ce5", "comment": "Malware payload", "value": "af1733e81f297286da88e5487169e4094644dbefec8c254f72edc5b661478f85", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855797, "uuid": "bdff8809-eaed-413e-92bb-6608aedf4422", "comment": "Malware payload", "value": "a5a9206593931c7b01fdb4380501ec1120147c72", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855797, "uuid": "8ff9c78d-93e9-4084-bf05-46ea744cb338", "comment": "Malware payload", "value": "764ea8c6436ff49ad4a6b3c5b9865e5bbefd6057159dabe9423ce206d37473a4c1e40134abe8764f9af3d147aace653f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855797, "uuid": "11581c05-4413-4145-80ae-daab7037fb59", "value": "T1E0E2F822FD65903602678199F7BBA709F371804BCA04CA10F6FC866A6FD9E42CC579DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855797, "uuid": "9fbc08a7-6abf-485a-8ac5-3bb1989f0599", "value": "768:M5RHm87afzHqrqsCaonKOBbK6KftIVUfNx/Y:M5RHm87mH1aoPbjctI4x/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767855797, "uuid": "bdcd8083-7c96-4ec8-8ff1-1fe16cd9a7e0", "value": 33892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767855797, "uuid": "b28d6c87-18e4-46a6-987f-d77e91202f0b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855797, "uuid": "a0f65f54-5351-405d-b3ff-5354f586e1eb", "value": "PO_N0_JKPO25040107.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50ac5bd-ec8a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767874093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874093, "uuid": "852ff313-996f-4e08-b90f-4f9b5eedaa9b", "comment": "Malware payload", "value": "f3ef69ab513ec5cb0f43abe663582972", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874093, "uuid": "c407e738-16c7-42f0-a318-023628134433", "comment": "Malware payload", "value": "b0e971b5ab07594e1132974a4e7ce6abd88248d090b8ca5642370b1b96b2227a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874093, "uuid": "05e2a3f5-2e2a-40ab-bbdc-6e89c4f58834", "comment": "Malware payload", "value": "97ac3a24cfd649cf0c40700980f6ec2fcb33e87f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874093, "uuid": "196b36f8-a729-43e2-912a-6a193c798695", "comment": "Malware payload", "value": "60bbc0394872321193775716b8a9a61c6e0ee74343b1c08d1f7861bbdb5dffb69ad189c2841cddf8223f2fb4c6e23f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874093, "uuid": "26ad3157-f310-4dce-933a-6d4e3f205d83", "value": "T138F733A8D39A54D9CDB9BDBFBEF0177ECE4A5F0A4B2D1A445E121A3620363510C1F362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874093, "uuid": "b74eb6dd-46bd-4143-ad80-21302bf43646", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874093, "uuid": "e84d3988-09f5-45a5-be98-cbf35fd5ccc5", "value": "1572864:eR4gRtGbN3iG3V467PrfI1232eYEunWZyxDuRl018hu7:o48tS3iG3pbr22DunW8xag1yu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767874093, "uuid": "79f18fe8-699b-4f7d-ab16-9c6c74f46f08", "value": 72112645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767874093, "uuid": "61bc1ec4-b934-43ac-902e-1d64f64cc36f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874093, "uuid": "e998c16d-4b6e-4260-a0ad-0798b73ad173", "value": "IEVR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650049b4-ec9f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767882978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767882978, "uuid": "a7cb36ed-979d-4d10-957c-5616cad5e092", "comment": "Malware payload (AsyncRAT)", "value": "917c9199bf469aa836f7000265ba11c6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767882978, "uuid": "2e1a5920-4c88-4df7-9805-4d2434144d6a", "comment": "Malware payload (AsyncRAT)", "value": "b11d93643cc7e3fbb44a141f3ae2251ce428f736e18aebf9e5a5a9b02dbbe2db", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767882978, "uuid": "639fa386-497a-444e-91e7-8ae8003cd872", "comment": "Malware payload (AsyncRAT)", "value": "33937ab26cc0d4736dcaae6149e9e1ee028731d6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767882978, "uuid": "d6a516e5-7e3d-47d0-a8aa-6935444aced5", "comment": "Malware payload (AsyncRAT)", "value": "8a41da2ecc7b7eefbdd7c9783f51873e886ca0447f8cfc09c8651314af57569e6b85ff2f538ea35d5792c1ceb2b90c99", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767882978, "uuid": "7fdd2cda-b42d-4b46-b187-ec3f68eb0c02", "value": "T156535B012788C965E2AD4AB8BDF2950106B5D5772102DB5E7CC404DBAB9FFC64A233FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767882978, "uuid": "0b392b0f-df95-4495-bc7e-ab2962015ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767882978, "uuid": "ac0c46bc-2a29-4956-a016-6ae17a2a3014", "value": "1536:woLuNz7JUMrZYGbb8wSEc9TECBfGagVclN:woAz7JUMr6Gbb8PPYCraY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767882978, "uuid": "9a8a1847-03e9-4792-a433-301c3656037a", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767882978, "uuid": "50edc837-94f3-44c9-a0fc-f16483dfa919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767882978, "uuid": "5dac8f4c-e5df-48f5-9fd0-b22986f1d780", "value": "ApexBet Engine Set Up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b7d6cf-ec72-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767863672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767863672, "uuid": "59583717-de2c-440a-b747-f870fc944d9e", "comment": "Malware payload (QuasarRAT)", "value": "75f9ef9052703251cdf85e276c0d71d8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767863672, "uuid": "e1eb0c15-4746-49ad-9767-80917b3c41cb", "comment": "Malware payload (QuasarRAT)", "value": "b2906b361d72ecbaa868fd0515fe756030684c6d81695a8ba3317ce29d2d9618", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767863672, "uuid": "c04d7338-635c-425d-af49-3a5b9a819bf8", "comment": "Malware payload (QuasarRAT)", "value": "bc31436d8d4b674f68c0832c4523d064fc9eba2d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767863672, "uuid": "847c22e4-dd9e-4265-822a-71c6d07cb473", "comment": "Malware payload (QuasarRAT)", "value": "c2b8b4a89f0e893293f825a39cd4f3b90aa80c8393838b1a0ec1472feee92c9abc980e140d92bcdc60411748bd2c6864", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767863672, "uuid": "d604d8bd-91dc-4dfd-873a-049cd8286139", "value": "T179C11E11E07EA21BCF72F620D8CB5D83FBBA53CB745367606897B05A402B207853E5D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767863672, "uuid": "0e0079b3-9cd3-4ac1-9ac5-50404b6cd5e9", "value": "96:t41nCP8kBiAzceuC+pdzZTjfSf45J74U0iHy4idHEL+T6EPorIL6sr1ynLFV2Vw+:t45tF2QDo91y7qw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767863672, "uuid": "24f92529-3a3b-4728-a983-ceaacd640c75", "value": 6019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767863672, "uuid": "525802df-623a-43db-a7b1-c9d8f122f6e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767863672, "uuid": "28f658e9-567c-4899-8143-cc74b35ffb1c", "value": "HASAN_KURT_CEL\u0130K_\u00d6DEME_GARANT\u0130_BANKAS\u0130_DEKONT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870fac8f-eca1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767883894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883894, "uuid": "b9c1e6ea-ebcd-4dc7-a1c9-5febb8e4593e", "comment": "Malware payload", "value": "5441cdf66eccc7efe0ad8c70d8fe7c23", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883894, "uuid": "9bf0fa66-a34b-455f-9c13-cb92b925f069", "comment": "Malware payload", "value": "b3a02d97e63f779291e0ff1fc67390d37c521517e534866dc7726c122b548902", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883894, "uuid": "cb9b2ae1-9a22-4ea0-8573-29daa32bc780", "comment": "Malware payload", "value": "bcbf46361a738ed8de3625ce52e6d2c9c737ef40", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767883894, "uuid": "637e16ec-c9ea-437c-93c8-bc1909318563", "comment": "Malware payload", "value": "b670f15307e632a531a320984e06f592942ee88bc8332c4117b1e897dbd1d5e97e3b333ce919567fe02cfa9c335a6376", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883894, "uuid": "2c4ebe0b-d567-49ba-8326-620d4e326393", "value": "T1F9C7E04AE90DD925DDEBB17EBD5E1363A0273D180761C146291D720EFFB36E04622FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883894, "uuid": "303408b4-331d-4355-8abc-e127e94537b7", "value": "786432:lL6R5NDdacjrOshd0woXS2dbk5FVZRbb6sm2EvIH4te4hE6AczSCOzV5:R6p9rOshdHri4LVbH2Tu6AczSCo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767883894, "uuid": "ae87d6d6-41d7-45ed-9aff-8f99fbe33051", "value": 56963883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767883894, "uuid": "5d3c1f08-5955-4916-bf5f-5ed7e284873c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767883894, "uuid": "a90fe9c5-2377-47f3-902f-9c857fc889b5", "value": "Group+Messages_1.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e6a829-ecd3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767905344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905344, "uuid": "607ed9e2-e738-4406-a689-c496340fbe8e", "comment": "Malware payload", "value": "f2a0166cca6e70230a7c99023f136634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905344, "uuid": "3b0db180-b8c5-4165-8de1-1a478c3265db", "comment": "Malware payload", "value": "b3b9048619ea3a10a3a6791330723b998c9ab7fa0543107b278f9470f94b85bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905344, "uuid": "35e9db0c-0697-4863-8a6c-d9459ada9124", "comment": "Malware payload", "value": "39c4b3a9962c54ba4c7b83028edf515718919e5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905344, "uuid": "46bae18f-6e18-47ad-9cc4-4e51c95a72d3", "comment": "Malware payload", "value": "0c9127f4062555ebfecf9d1208a0c939e7828e90f429bec7f8245bcbbd8a8634df1e17256bc774343f4294a02d280b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905344, "uuid": "1b562592-1a8f-4f7c-beff-7d0765eb14e6", "value": "T1F0F623D33ED9E2ACC4974A30A5C6175971D2B28DC1EF5A1F37CA5C023290E178E4A9B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905344, "uuid": "d1e462e5-d9d6-4556-8c83-2a7592bb6ca2", "value": "687080897b5f9d8eacdb5b351bf1908d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905344, "uuid": "a3be87af-eb40-4016-bf06-f530530dedbc", "value": "393216:zzTe8ReJofmsUeiXZf/B7nnyWHMcAjHZKjNzDU91T:zP7cofmtvf5jyWHMcAjHZKBzw9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767905344, "uuid": "4d1a2d6a-9cd4-4eac-b0cd-7c805647f89c", "value": 15667712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767905344, "uuid": "5a1de04a-7ed9-40d9-bd94-dd14eab4729d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905344, "uuid": "210d7c6c-4aac-4482-8c06-80d96b86c573", "value": "SyncForge_Utility_v5.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45755d08-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1767856296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856296, "uuid": "554edc9a-ceea-487e-b0e9-9f78d8d957a0", "comment": "Malware payload (AgentTesla)", "value": "bb736d90891a1c2c992ce67289c97fb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856296, "uuid": "a8d5cb0d-336d-4277-908e-243f2757dc7a", "comment": "Malware payload (AgentTesla)", "value": "b620c0d21c380b8c3cce6c822c3ac6d562ffbbbc5cfcb6f5f8095080bc4314eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856296, "uuid": "f03a48ab-9664-4cf9-8811-94d3a13c3418", "comment": "Malware payload (AgentTesla)", "value": "6800ecf8f88606e137bcf17553a04dfefb009660", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856296, "uuid": "958f3d6b-4779-4ecc-9560-8b48634146f1", "comment": "Malware payload (AgentTesla)", "value": "f539a44f46c31e6938fb4c3138c33f504e1e2f8be8d5450a4caff5fffad33a96fcd6f00681439951a114556f885db2e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856296, "uuid": "2f0cc254-3e32-4d11-9aad-cc7cd7395958", "value": "T1F9535BA0DD2001774F87AB9DBC690661CAEDC3258A3744B1F9D9870D910ADECF77D22A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856296, "uuid": "a65a69b5-f904-4ec5-8065-38cacb551bf2", "value": "1536:h55XPahYYX+6ZnYScjRvlULmxGaQkHA2FZZn:LpPahYYXHZYS0R6mxGoHHFZZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856296, "uuid": "fd03ae2d-4f1b-4e88-8a47-7f6142bd37d3", "value": 61169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856296, "uuid": "35962124-859e-44b6-a889-9c3a9f0b1813", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856296, "uuid": "4f1cca12-514a-4bd5-a4a8-35ae3ae83152", "value": "2026 Contract-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd363abf-ec75-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767865195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767865195, "uuid": "014e57a2-b82d-4ee4-ac0d-336c4d87c1ba", "comment": "Malware payload", "value": "87360f8c01171a7adeb83c38169609ea", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767865195, "uuid": "5f107bc7-aadd-461e-b7e1-a5e281a70fdd", "comment": "Malware payload", "value": "b6253d30a19040360d48fc59cddc4340a24c433c9b004280ba4f3303f7f5dad9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767865195, "uuid": "1960e788-14f9-4164-b807-1808e2587b4a", "comment": "Malware payload", "value": "5709ab3bd1f87ee81d7fc8cfb6d81458c623aaf3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767865195, "uuid": "6c0f570c-0522-4749-b898-9a0bd5bd1fcd", "comment": "Malware payload", "value": "56124729b1dd474e7954007c91ea3b8690c012808c57f07b135f703e5f5195865674f628e5f260e9c17edb280483df1a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767865195, "uuid": "9708778f-8df5-4d02-bcba-1b81341cd3fd", "value": "T1083533012F7361CE5BD8B7C3758690BB8D5AC0A4E7648F6CE5C9128D78CDA2D77868C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767865195, "uuid": "39847fac-76cc-4bab-9800-75e6ab1b855d", "value": "24576:5MRrk7ALf5dFFc1SoF5eg04spyjxr5BLLxVMQCSyotgVeC2:5ArkczpFps5eIYIrBLLxHdyoCVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767865195, "uuid": "298b12a2-8962-40aa-b7cc-b1a5ba7ecced", "value": 1154210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767865195, "uuid": "f2b0fd6b-eed3-453d-971a-4177d5664ec4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767865195, "uuid": "9a20054f-0e3b-451a-b911-6ecb41eff650", "value": "solty_futerIL_doxxed_by_Lux.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbeda6c4-ec8a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767874105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874105, "uuid": "61765de7-d2ca-44f3-8245-cd29659bc685", "comment": "Malware payload", "value": "83582a793f5dd4445592e8cfb25b2556", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874105, "uuid": "eac3db64-b725-459a-a046-22d0f82f00e2", "comment": "Malware payload", "value": "bc42a0ff2223245c461f9bcf4aade5827344472e8a5b6607555716375756cd7a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874105, "uuid": "d5c6a657-43cd-4ace-a8fa-508a1f52fa6b", "comment": "Malware payload", "value": "6663c7591ae9aa0aa488e17b5c34fdef6a447acb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874105, "uuid": "707930f9-091c-4810-8436-fd5a81d67a14", "comment": "Malware payload", "value": "d0341278babe473ae0c3c9495f67e6b1b3154ea669056db5e3ede7d04671ad5e856dd489f328908de70ec417515064cf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874105, "uuid": "2f8d3e23-0b5d-4c1c-af0f-6c4e1e03485a", "value": "T102B5773D5C20ED29CC7E01CEB89918F8FCED5BE162B8AA27B4B75366C168BD4B40C545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874105, "uuid": "0706cfad-bf68-4150-9747-2803f107a5ff", "value": "49152:51zAjBPhnU6QkTjpPIlKJIJTE5Z+81wqtNkpJ93mRJi6p1ejQkXoLgLo/OyJ7YL0:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767874105, "uuid": "ea55a624-c48b-4dd0-9f71-ee201713190a", "value": 2271383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767874105, "uuid": "7fe22e58-36d0-485e-b5e2-d912fa8f0bd5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874105, "uuid": "9d26181f-114f-4bfb-b3cc-caaca6a6b71e", "value": "injection.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e804bb-ec6a-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767860211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860211, "uuid": "dfd9a59a-1baa-4c86-8fc5-84f82c06b05b", "comment": "Malware payload (QuasarRAT)", "value": "87a253eb117aaa93bff8eb46366ff185", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860211, "uuid": "6080a5f2-9b04-4228-8fc1-560f1b773ceb", "comment": "Malware payload (QuasarRAT)", "value": "bf62e839259c19fe22cf36689126e60d5d29865d886fc2dd219c14a9ec7268fd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860211, "uuid": "4129ac33-7193-4ad1-8645-5b1235e3b94d", "comment": "Malware payload (QuasarRAT)", "value": "65220a560fdf2ffbeca1b56fb0b006163e99b3e8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767860211, "uuid": "d9448df0-1acd-4afb-9705-55a29f37be4b", "comment": "Malware payload (QuasarRAT)", "value": "ec0f118af25ec86a55ca230279157b37d7c5a6e8ebc9aabe6ce7b6c4834dfd7e3a24893b2493ecbbe677b3f392a6aded", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767860211, "uuid": "4aacb1d8-b9d8-4e26-8a63-d968d442605f", "value": "T120C523853BFC4948F6BFAF702DB626248579B8A25D21EB5E05C5309C1931FD5ACA0F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767860211, "uuid": "23ca23ab-c2b1-4be6-81ab-199026e974cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767860211, "uuid": "7da504c0-405d-457c-9a7d-9e0b530d9494", "value": "49152:0KoL+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcm:4L+2upjBVGVl/lQrCSZ4183Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767860211, "uuid": "36ab00a2-ee5f-4244-ba0b-baedad060ace", "value": 2613248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767860211, "uuid": "b2c1b7e7-cef9-4da4-86de-737630209a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767860211, "uuid": "d7a98b97-5115-4b09-95d3-5f8e9a278417", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6f7f43-eca9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767887422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767887422, "uuid": "d0a764f2-8dcb-4e58-8751-cb8c891b377f", "comment": "Malware payload", "value": "d2466550993630a7f61fd21bfff4a5a0", "object_relation": "md5", "Tag": [ { "name": "pw-1717", "colour": "#9F8072", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767887422, "uuid": "37489675-f98a-4e1e-a50a-5d5433cb16c0", "comment": "Malware payload", "value": "bf75e12494a4c7834cbd1f97fa455969083ac2b75d1c8748ccebd152b84ef913", "object_relation": "sha256", "Tag": [ { "name": "pw-1717", "colour": "#9F8072", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767887422, "uuid": "6404057d-f72a-4aec-849e-41ae6208b442", "comment": "Malware payload", "value": "ef48a2a83745f6b73e4050faf9a58bb08eabab1f", "object_relation": "sha1", "Tag": [ { "name": "pw-1717", "colour": "#9F8072", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767887422, "uuid": "f01d9e1a-1313-485b-9a5d-949765fe882d", "comment": "Malware payload", "value": "3b2e47d0ae7b7aafa17e5d40c8c8d39dd0c078572b4a2a225d76d98cc20331cb8ba909096ea08e814907ea54d759e1f6", "object_relation": "sha3-384", "Tag": [ { "name": "pw-1717", "colour": "#9F8072", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767887422, "uuid": "aeb0701b-ff91-43b9-b269-052e20d0c0f6", "value": "T1FA0833E7CC0D85A8E57DBF80E6BF56836AC225C9CA48D4857381732FC2936BD5D181B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767887422, "uuid": "7a706d14-648a-48dc-bdb1-409fa6bbf447", "value": "1572864:TQWWa0taxiqkdqz1TRxkvg2uCTom+j3gc8GyZV5eaV2pNg+:TQnr+skz9R2Nom+jyf0pNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767887422, "uuid": "6c657c41-22e7-4df0-9098-bddde7bb79c6", "value": 82437650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767887422, "uuid": "1080ff3d-ec8e-48fe-b081-251edf186209", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767887422, "uuid": "6a898546-56ab-4171-b869-55aac525ad0f", "value": "Vegas_Pro_20.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ebbee3-ec8a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767874101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874101, "uuid": "75256312-ff23-4762-b033-d6fcea92bdab", "comment": "Malware payload", "value": "cc9353f326cd57953e8963af9e35f58b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874101, "uuid": "7c0f71e3-63f5-47e3-92af-7ace43214c53", "comment": "Malware payload", "value": "c2bcc2ab9e02d3901c477da410ec41c873046be3ca461bce72141ccdea90e46b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874101, "uuid": "45dd8e12-bb25-4b1d-ae8e-3c300151651d", "comment": "Malware payload", "value": "aff2d9e19c80802d3799519825a4d593f28a91de", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767874101, "uuid": "d4853df5-a8af-4e4c-b5eb-8dd745545579", "comment": "Malware payload", "value": "035cfe00f38165f8a2fc43a44d22ab653b6b35161bd666225d6b8aa9cd120913431d8e5e6f614ec77aaf11816f59e5ff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874101, "uuid": "9e07a7f0-ae15-43a3-a682-4915bb6b0ebc", "value": "T14185563D5C20ED29CC7E01CEB89908F8FCAD5BE262B9A927F4B7536AC1687D4B50C544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874101, "uuid": "45171107-42f6-4a73-af04-bc41c85740ca", "value": "49152:4bFZAikpd029mk/QZRcYHf01HuqSltOeuBswO8zPfZbGdcTZmn/0BQl2eYQ5ph8T:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767874101, "uuid": "bf61de2f-9fa8-4091-be6b-2767f6799b22", "value": 1774623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767874101, "uuid": "fad2bc6c-9056-43bb-be4d-4ee05ff9506b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767874101, "uuid": "5fbff5c3-f3e3-44a2-8f93-3e6d9bded6db", "value": "index.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a970842-eca2-11f0-a129-42010a9c0007", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1767884330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884330, "uuid": "85b35c49-b8ac-4b21-8257-6a3180028d0e", "comment": "Malware payload (AveMariaRAT)", "value": "77cc439ad3bb3e5db8107fc598453a12", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884330, "uuid": "52eed2ac-a4d7-4cbe-9b92-3cef53c9ccb9", "comment": "Malware payload (AveMariaRAT)", "value": "c3105cdaac7f7886aedf30ba4da177472786d9bca22f4a787eff30e18a9c7b3b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884330, "uuid": "2b429fd9-3de8-4eab-84c2-fe6eea2a5e86", "comment": "Malware payload (AveMariaRAT)", "value": "057ae750c8022111e3466189184ea3039f50201d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884330, "uuid": "2b03d619-1ea3-48ca-99b5-25c64895ad7d", "comment": "Malware payload (AveMariaRAT)", "value": "89f26bac6789ff514f0b186772956bd7a46a728c0625219e9cec6ec319b1d298cc39f85d914bbeab767921b509a6f6ac", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884330, "uuid": "6488127d-04de-4414-8109-ca86271f91d1", "value": "T19BA4BE55D9D2CD52DE552FB2C53289704073BD6816F2F78BA8CA38B627F33E1042A85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884330, "uuid": "7cda73a3-6359-4489-92db-16ef8cf309ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884330, "uuid": "9edecece-2cef-4181-9027-80c664a59b05", "value": "6144:r9AejdBEh/drh3EpWxorPKeV7moIzfKmXthcTojHM4h8KHVsDZYzbGBMiEUfIm:BAph/dzCGfKmXjKot8UCebFPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767884330, "uuid": "fe8d9844-ec3d-4232-a7d2-1b80ce9b37ac", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767884330, "uuid": "73a642b4-8de7-49dc-ada0-1d1c321ba129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884330, "uuid": "6352cfb6-f856-4449-b790-e6c54be0dfc5", "value": "Belge_Bilgileri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f37afc7-eca3-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1767884606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884606, "uuid": "a42cc554-fd86-4cc6-b385-9248537897d1", "comment": "Malware payload (Sliver)", "value": "9e3052403c0ffa2756e036a20dce4b52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884606, "uuid": "f85e079b-db88-4a08-8dc9-bf580200aa75", "comment": "Malware payload (Sliver)", "value": "c3fdbb5da70a39d132413d41c844e8f642d0321b7883e10ad9e36a9235112909", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884606, "uuid": "421c3b13-27f4-4cfb-a2db-8c317df33a1e", "comment": "Malware payload (Sliver)", "value": "c59f915c28887c2bdc47c78bf5fe3184b280e337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884606, "uuid": "656872d5-f8f4-4b6e-99b6-f2d8b017c44e", "comment": "Malware payload (Sliver)", "value": "3228b5e57a120fd09dd94245e7568cb49c7bb21dd3ea7bac1755a4655063b1e2e938409b32d2490270fca9d49adea2d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884606, "uuid": "fea72a86-86db-42d6-803f-36cbf54a55ed", "value": "T184B62947F89141E8C1EDD170862A9252BB717C894B3067D33B20F7B82B77BD4AA7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884606, "uuid": "f4859f54-7c40-4d4a-9fa4-0db438be75b1", "value": "98304:tzn/XbUwSj0J/C6IgqJOEGE1EVcBOivr:V/Y0lz1OvjKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767884606, "uuid": "8232391e-1880-4404-be71-4f439b540e0f", "value": 10555392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767884606, "uuid": "7a5933f2-dd47-4798-b43f-1a651e4de3c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884606, "uuid": "3570386b-7270-48a5-ac26-160a7bb99ac4", "value": "e698b4af-d219-474b-ada8-57d89c9cf382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47018fb-ec33-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767836726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836726, "uuid": "78f6bb6e-a023-47c6-b194-205e9f502cb4", "comment": "Malware payload (Mirai)", "value": "ab7c8bf1d4dd4d5bf75f9eaa7754136c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836726, "uuid": "0aa14bbe-c2d3-4444-ba83-afdcdebae274", "comment": "Malware payload (Mirai)", "value": "c566d9436e491f7c018ef84c852d25482b30487e8d295a3c7c6f15f4f545bf69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836726, "uuid": "202a7e52-ead0-499d-86a9-4944bb6f60bb", "comment": "Malware payload (Mirai)", "value": "c08cf7b72750c742cc80be02b50e4b6efcbde8ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836726, "uuid": "94ab2117-a4e6-44cf-a85c-91d854e706f8", "comment": "Malware payload (Mirai)", "value": "0574d9e476733f51cdcbf6f246b57fc9a0fd8927ffe9070ba0c3a5e08fba4d3e2b4d68fa20688da4569ffd74673fb900", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836726, "uuid": "2def6f01-28ee-4409-8420-b3c72ed4e837", "value": "T12EC44B55F8809FA1CAC52576F75E829C33134B79C3EBB20699145B343A9B87B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836726, "uuid": "c7a2181d-2093-4702-890e-42e0cdf5e7cd", "value": "12288:qnflg0X2sStxWrZ9NzFukExnZgIPIgpZ6m5g:iDSrWrDNzF5ExOIPyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767836726, "uuid": "efea8b9d-158f-4260-b1a7-1b03fff748b0", "value": 554164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767836726, "uuid": "1f9a407f-9171-4444-82b9-489a000c3bec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836726, "uuid": "63016208-87de-4a9e-8bc9-6bfd12ab0b2f", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1dcc13c-ecb9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767894381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767894381, "uuid": "9dd5c20d-f8f2-4602-aec5-87f232ac9088", "comment": "Malware payload", "value": "677d26e0e77e30a75aa2bf4c48030a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767894381, "uuid": "a2465bbf-83fd-4eba-bed8-676af355ce76", "comment": "Malware payload", "value": "c5c40ec70f59890d56e7dcb0c18bb240842a3e1d21df79138eefdd02146f99e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767894381, "uuid": "bbb1dca5-c68a-4b97-b556-349f05abbd10", "comment": "Malware payload", "value": "a7058bc5e86db8736a5d8759a0d49e5cba8f0484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767894381, "uuid": "580b0c30-4100-488a-8a0f-1da503b61dfa", "comment": "Malware payload", "value": "fbe3005bf9bbf306fda77c7bb561f1a7846384f92b9c8905c007344af114a12c560b2b098bb02c1be28f7206a65e2757", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767894381, "uuid": "12ede7f5-43de-4817-9285-aa9bd8e09494", "value": "T186C64AA2FE450216CA9BE239DD7561563230B044133212D76FA70BF59CDBBC8573BB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767894381, "uuid": "145b42df-4b53-46f0-bf15-41b7c5c032ed", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767894381, "uuid": "12873885-876e-4fe3-a176-765978ec8632", "value": "49152:szisIstrQrb/TJvO90dL3BmAFd4A64nsfJkKdV7zuqX5UZVZux9lJ2USOwzzVW/a:sziwr6GV7X5oDAAvbCltnYmT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767894381, "uuid": "591eea45-dc9d-4e4a-950d-f876159f663f", "value": 12278400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767894381, "uuid": "488c2a80-a694-4570-b95d-8c8b4f173181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767894381, "uuid": "020b81bb-5c74-4c97-b181-8d5830f46854", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34de1e89-ec60-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupportRAT)", "timestamp": 1767855839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855839, "uuid": "11549f40-a2b4-419d-b1ce-82b04bd11f6c", "comment": "Malware payload (NetSupportRAT)", "value": "279ba65c50f5a45b4ade338aa00372ba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855839, "uuid": "6079fcbe-d13f-4008-a179-72202c4dcd98", "comment": "Malware payload (NetSupportRAT)", "value": "c5f496b0b5155630f6c924e752da1f24274db7f60612bfc3af5f46f5fb4602b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855839, "uuid": "a0ac1a44-bf30-4871-9def-4500f5bf9e41", "comment": "Malware payload (NetSupportRAT)", "value": "f070ab3ea4aaedf94a688c4d0a1927f0c848d237", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855839, "uuid": "6ad6bbe3-3d61-4547-8ce2-fcb4a1ef86f5", "comment": "Malware payload (NetSupportRAT)", "value": "55c861bf16848d799d20fdf89ed929ff6b27b550f321c7c93e6c6b06c5e9ccccb50a72295ea723c394d092d8843f60bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855839, "uuid": "fb3cb47b-e9d2-443d-a492-3cc136eba05d", "value": "T1F091646477D122807B9F8EA73827F895F52068BFFD698CCBA4447C102C44524C9E7B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855839, "uuid": "cb97a167-4dec-465d-af24-4f87c75b7e48", "value": "96:ufNAoQtIxbW4VojAI68AA2si6qhcac2iQ5Kgjfi3+AKiE6xjRelu3K4/vGx9PA:4NAIlW4VojAI68ATr64cRY5Kcq3+AKir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767855839, "uuid": "a5a1af36-2b0d-4a91-9c4c-b01aa58831d2", "value": 4438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767855839, "uuid": "f9c61b4a-40f8-4365-8ab7-11d4a4700f00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855839, "uuid": "c6f9aaba-f07a-427e-88be-d2e102a7dfae", "value": "redirect-state.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5d5e65-ec32-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767836395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836395, "uuid": "435a3b83-f1de-432f-b00b-6a87d0dcbb8d", "comment": "Malware payload (Formbook)", "value": "30084d42787e906e0e9b051ece4d4f8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836395, "uuid": "a0a2bbfd-92bd-4807-9050-de69237ba447", "comment": "Malware payload (Formbook)", "value": "c63f415a1f0f8675da6709908aab254ed267860edbf9fcb2edb29862b493f5c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836395, "uuid": "9a12e100-cd1d-4694-a7cb-8749d7c59720", "comment": "Malware payload (Formbook)", "value": "1b2f3c307fcac900fab74410b5f18b0abf8ed8e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836395, "uuid": "e1381f8c-dff8-4c65-84e7-23abf03c27c4", "comment": "Malware payload (Formbook)", "value": "26c691e545c23cd3275fd8009c09e46f2fc83c2359691cfb0554dd201e1e0f89750a64091be8d3cc1d5c79a001931604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836395, "uuid": "6161a498-0040-4dae-a38d-78e2b7d3a9cd", "value": "T14C0523AC3655EE17D0C30BFB0463D374A3B48E9E891CEB1257DC9CDFB441A25DA44AA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836395, "uuid": "bbdb34c3-117a-40ac-be6b-34c3c3946523", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836395, "uuid": "c583ab6b-2780-4770-9823-b7fd753550f9", "value": "24576:sQXwa73rR4hW9hItRKPtfEkU9AlBw2vYtT:BbrR4n0tfb7lBw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767836395, "uuid": "c13e2c6c-55c6-4e5f-9019-16fba2be1ff5", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767836395, "uuid": "2151eed5-acdd-412d-9812-d6371f3b1e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836395, "uuid": "443190fc-03c9-41b6-a8a6-2b03f1a091c6", "value": "MT Caribbean 1 Vessel Information.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c4e219-ecd4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767905669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905669, "uuid": "21679169-30c6-40c1-9c12-c5f5ec3d9a6e", "comment": "Malware payload", "value": "4e66a09c65e969004f05d15e83295fc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905669, "uuid": "84351956-fb07-4444-851e-7881c8b11e7c", "comment": "Malware payload", "value": "c6b2e14aa8a9f391796777e2a90612ee6b26483ee245b3c1ff591914196289df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905669, "uuid": "6e97169d-5a35-4676-aa01-cf8ee282be47", "comment": "Malware payload", "value": "a1fa4734d57445a6dd74f30e695ef62356f4cdf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767905669, "uuid": "337e1348-9ba7-4ade-a0ad-33147b11c15a", "comment": "Malware payload", "value": "f39761413332e12ad93ee65bbc0741a497354b4bf239864bdda065b876c4b0a68d5eee2184a045d903e06ab597bb6fce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905669, "uuid": "90fa78a2-7b44-463e-a6e5-c0e36ab5c5db", "value": "T100086B42A6EA04D4F9F79A349AF65213C673BC063F3095DF3148172A1F736E0997A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905669, "uuid": "01fc95a3-f65e-4b14-b6cd-65271026631a", "value": "fef754a9bc1487a1989de9d9e9b586bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905669, "uuid": "03041367-0ac1-4c44-8b5b-c784ee548cd0", "value": "393216:219/R+b6MEfkTFN5wqEMoNjJT0qlzduSzP5dFTCJKTpEdN5gsbtFKx2Xinsp0AR3:25C0boYtACkC1uODxO+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767905669, "uuid": "c07d8b63-2e49-435f-8c26-f79a44b7c607", "value": 84504313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767905669, "uuid": "59f32fab-8d42-412e-914d-444546adb206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767905669, "uuid": "60f4c30c-04fe-4c41-9a0b-7bdb4f8ef06b", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aae98ae-ec33-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1767836468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836468, "uuid": "aa53716b-88df-4dca-b0f1-77e0c06a5910", "comment": "Malware payload (Joker)", "value": "919f5b3abba1f0e9e925f5e9a86949ed", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836468, "uuid": "f5765ded-8aab-48a4-a8ec-34626ea0825e", "comment": "Malware payload (Joker)", "value": "c6b886563ff6d59ca53b6f8b4d2463eced0383578edc1a875aaa774202712bb8", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836468, "uuid": "6c2ed622-bdf6-4af8-ab50-729ef722cd8d", "comment": "Malware payload (Joker)", "value": "d40e559499358e46407e21726a95b3df1967a079", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836468, "uuid": "73a41fc5-5196-4737-a319-a688dcbfb78b", "comment": "Malware payload (Joker)", "value": "a291732c07541b00298394aa64f6212d251af9573e0ad1386c1638e98b2569266c3843d4d0a4b17cb55cbeb32de33a0b", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836468, "uuid": "7336e69a-53eb-40fa-a875-b9bcefd7a8dd", "value": "T1B2171209AF5C792FDCBBB0390E5A533134259C66EA00AB83E911725CBEB36E44F117E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836468, "uuid": "855adfef-a15e-42ae-aaba-f8acc2f0c595", "value": "393216:WdjAAEAYPOCKPLgXRj+iJM2v/zjkKN3hrj48YbvD3PkKZYLNLU:WdjAAETOCsLRiJMY/z4rbvD/kKOLNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767836468, "uuid": "a90d16bc-bc76-4d3e-b9b0-141dbeac83b1", "value": 20096387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767836468, "uuid": "a96febf1-425b-4f46-b5d5-13e582ac437f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836468, "uuid": "a462d513-a7f3-401f-9ca1-ae47078ee618", "value": "Space+Pure+Cleaner_1.0.37.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbbcffd-ecbb-11f0-a129-42010a9c0007", "comment": "Malware payload (BRAT)", "timestamp": 1767895076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767895076, "uuid": "452f699f-269d-44cf-b54b-3b2ae9806a99", "comment": "Malware payload (BRAT)", "value": "788dc59cf4e663bb9a72e75feee45fe7", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767895076, "uuid": "e9487e6d-b666-438e-a709-ca4f0207be06", "comment": "Malware payload (BRAT)", "value": "c7bf65d24bdbafd427537309b1cfe8c0f7c7b235a4f7fd6a8fc43ffff14fbfc2", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767895076, "uuid": "cef2d0dd-9496-41c7-a3fe-51411be77ba0", "comment": "Malware payload (BRAT)", "value": "20c504eb3701acc385db6a54fbb3fcb56bc8e52f", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767895076, "uuid": "19c4f00c-9a16-45ee-b34b-ec8af298a1c1", "comment": "Malware payload (BRAT)", "value": "f315017cd4400410ae7d1555574bb4401cbc938bd8f59f1da8f314f583c832dff056aff66d406ee34617e82b776dee74", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767895076, "uuid": "0932454b-21e4-4afc-873e-b8afae5bba18", "value": "T1D327F703D3C1F8E4C405CAB091A9A5B7C763F85D71AEF71899B247891EFAB15DA2B340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767895076, "uuid": "251ade0d-bd4c-49a7-a77a-13782dfbd7df", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767895076, "uuid": "07f03fa0-3685-4705-8d16-a0fb69dcff83", "value": "98304:m6FZDmhmVqVUAE86u9TSanwgHsVhFO2XavsCHXikcW:m6bHVqVUV85TygMRO2Xavzykc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767895076, "uuid": "7c631167-aa6f-410b-a639-edde8846060c", "value": 21944832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767895076, "uuid": "1b48afdd-fb0a-4502-8d9b-9f50750538dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767895076, "uuid": "a7861894-9e06-423c-b684-5fee30313142", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4413131-eca8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767886950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886950, "uuid": "b2c116be-e063-4319-92b9-82401220aa90", "comment": "Malware payload", "value": "75c29a8bd99a3833ce5d0fc117201e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886950, "uuid": "43017539-6dd1-4517-94b9-f9678c5dd173", "comment": "Malware payload", "value": "c8a01ce3d2cf841f7aeaf2ea081b27744bcf2475f1d9aaa8220f6a8ded9a2a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886950, "uuid": "d3748c89-fbd4-4a4c-bd37-681c8ef2507e", "comment": "Malware payload", "value": "ccc9350768d357805d6093049cebc6e908f58ad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886950, "uuid": "61e650cd-6473-44f7-9c5b-a46755ee337a", "comment": "Malware payload", "value": "5a19ed8eadde2f1e06649e934d2ea5e82bbafa20a883a6a51ee7817983fef4f6433f6e6906e5742123738cbbd891f313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886950, "uuid": "e21b472e-ae14-41b3-904e-9ed7e407e95c", "value": "T17606BFB876047DE6A67F577BDA96ACDC03B626239ACBA4CC4064B7C30563375FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886950, "uuid": "07e0a47b-f1ca-478d-bbb7-1a831e0896f5", "value": "b0054bd918e7b591ccdca9561e30028b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886950, "uuid": "4232f555-2eaa-48e4-9b56-332c7d059063", "value": "24576:EZjKnVDFIOYSzHzC+qr+tZT72R19u7ga7DIGPlg5a1nH3o1DLnHZwglURWPQDjNq:EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767886950, "uuid": "26d927d4-462c-4abf-a532-0269a5fff50b", "value": 3783680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767886950, "uuid": "780e00a8-3e6b-496f-a674-c88927a0588c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886950, "uuid": "fde6506f-c3df-40c2-bdd9-6ea4bd2c0fb2", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0558b28f-eca7-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767886254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886254, "uuid": "25c82f7e-e633-4bee-9636-2ba9e85188bf", "comment": "Malware payload (Vidar)", "value": "5fbd6f132153c5144870008e35728745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886254, "uuid": "c172c582-114c-46b4-adf6-325cffdd1361", "comment": "Malware payload (Vidar)", "value": "ca1dd6a8f482d36c52514fb4ebe94ae8375219bbc8c0950874ec05bca5049c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886254, "uuid": "62cea6ee-f91f-40bb-9b2c-f8eecaa620a8", "comment": "Malware payload (Vidar)", "value": "45eb529164e1e0af5109a24d0d2b0f61a5dd3b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886254, "uuid": "8eb08ed5-1e6e-43da-b77d-e00c1fa38e0c", "comment": "Malware payload (Vidar)", "value": "9d42d8dcbccbaeaa37f6b05cea71e3ca86173296b5e03b5c8dda9483cac17fc799c634aca9c8207f07e3d17dc1932b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886254, "uuid": "0011a882-678f-4ffb-9638-2d95063679cb", "value": "T114A63A92FE400215D69BE239DEB561567270B048033612D76FE70BB54DEBAC8173FB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886254, "uuid": "b7d286f5-8780-474e-80f2-615f0351dfce", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886254, "uuid": "fc2c8e48-3cd9-4008-9072-fd3483734ca2", "value": "49152:Q+8VK1YVHAorb/TvvO90dL3BmAFd4A64nsfJAixrl5iPje3OMZL4uYTMcpi59tmJ:B8+EiS7MZJTmgAAKHJf2s47PC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767886254, "uuid": "cd9efe47-1062-47f8-bbe2-f9ca3f9fbc53", "value": 9742464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767886254, "uuid": "5f7803e7-b0b2-4677-a9a1-eea6d9734b83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886254, "uuid": "ec63de2e-f991-4210-922e-32f2ca1f4239", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef668bb3-ecbf-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1767896954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767896954, "uuid": "b7f56343-a6de-47af-9ea0-076ff773354a", "comment": "Malware payload (MaskGramStealer)", "value": "25041e230c55fd46e5ef52ab02b3bc6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767896954, "uuid": "bfbc4473-a92a-420a-af31-09a360010e5c", "comment": "Malware payload (MaskGramStealer)", "value": "ca52167384cd316ce0738c34715112dd00d168e749d06b32a686e052d8e8eb54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767896954, "uuid": "13720667-47d1-464e-927f-a970574019d8", "comment": "Malware payload (MaskGramStealer)", "value": "9f0de32804dc0b19863b59c505f664d7aaa89943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767896954, "uuid": "2171dc11-50c1-4e4e-9abd-41de51a2a563", "comment": "Malware payload (MaskGramStealer)", "value": "e6e420c0287454a38aff189df99a3845c7ec6cb959991ad3a51b580eccfa5b72f1a96b6c205fc947836b18153f04f582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767896954, "uuid": "946522be-2a6d-4f4a-8cbf-c6b0e307debc", "value": "T13504AE289E39E343F36CA0F3BC758FC1BC21B1D557A6A263AEAECBE057515304A15790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767896954, "uuid": "35aacda7-f946-4d17-be17-7c7770cc907c", "value": "889d7d9bd78af47c7881d69d79690e91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767896954, "uuid": "b2f46cd5-4bf1-4d66-be6c-bb26252de8e2", "value": "3072:MrrWlJAv13D5CKhsX9ZxlahoPyxh43r5ZMmVrz31pJTt2DIRuMqRLqO/M:MHW3A93D5iZrPyc33MmVf31IDIR/qhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767896954, "uuid": "6c8aaedd-7dc5-48ba-b34e-94cc775c91fe", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767896954, "uuid": "bc3cc8fd-9450-445a-83a7-00e62c591633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767896954, "uuid": "99e61e79-cf45-4ee4-b327-8fce535616a5", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe527e79-ecc6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767899986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899986, "uuid": "0a3c3380-88ce-4005-9ad0-b96aa6d91fa0", "comment": "Malware payload (Mirai)", "value": "cc9922e3499a04cf74f4f2faa7282324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899986, "uuid": "e8b85525-8d91-4e33-bae9-73f5879a5ad2", "comment": "Malware payload (Mirai)", "value": "cae1087b02f64c41c7871b24164d2690d094d85ce3afe7ee2095ad65072237a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899986, "uuid": "03c4ed00-f6a6-4224-9e71-e00a5c3505d4", "comment": "Malware payload (Mirai)", "value": "ca830179b792bce9e524c712c86256d3cc925181", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899986, "uuid": "61faf575-ce8d-4654-8ab0-6ee4b880cabb", "comment": "Malware payload (Mirai)", "value": "6789f100fa9b5d31af2e05dec265163158af00ebcf50fa3bda0ac6cd175dfd3495d5c0d757414fa7ec8becec97ebda96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899986, "uuid": "d6d0587f-66f1-4464-ab71-622ae6fc73b3", "value": "T1DDD37F86E943D0F5E842067014BEAF769973DD3B502EE742C7785A33A8D6802D71AF6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899986, "uuid": "5036be80-74cb-421f-8ae1-20695ea1b276", "value": "3072:/+roEUX8G5OArAgwpVtQUJ3Lxn2XWXuOcQ:2r5UXv5OArAZt35MmuOcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767899986, "uuid": "51b1802d-24f7-4085-9b5a-a1b50f670685", "value": 141508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767899986, "uuid": "93c5939d-d47f-4583-addd-93173dd4a2f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899986, "uuid": "5695cf42-232c-4deb-872f-d976d619b1ea", "value": "ub8ehJSePAfc9FYqZIT6.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419dfb90-ec35-11f0-a129-42010a9c0007", "comment": "Malware payload (AdaptixC2)", "timestamp": 1767837392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837392, "uuid": "e4c71fcf-50dd-458c-ad13-d8bff2c3d665", "comment": "Malware payload (AdaptixC2)", "value": "8c8437e608ce4df77d023f63c67bf3e0", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837392, "uuid": "244561a6-f20d-41cb-9321-04eb2cfb92cd", "comment": "Malware payload (AdaptixC2)", "value": "cbf76aeffed69f439ea59008b0a1e11901fda7e94371a815a543d1baf4dd7942", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837392, "uuid": "d10cc0f7-3c95-4b59-bf08-20ea9f5bdd49", "comment": "Malware payload (AdaptixC2)", "value": "90e7c6bf578907ecbda813115182e5765dd57091", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837392, "uuid": "3c1d0caa-929d-4408-8fb1-75ea636a3969", "comment": "Malware payload (AdaptixC2)", "value": "7548199c7f99e0e79f700174f6ddb6b1e97e53463dda8ef7814ff7c8ea51c12ac06ae0eabdf47e11fef66ec5a5046f6d", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837392, "uuid": "9e5c5943-a785-493b-8c67-8c42bfa3c20b", "value": "T136946D75F2D82CB9E067813CAE475D45E772F8580350ABDB13909A262FD3AE06E3D6D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837392, "uuid": "ec4be8b5-bb1d-4dec-8391-f2b7feb5b63e", "value": "31900f7fff40a876cd9fb97fade1788d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837392, "uuid": "9de630bd-2c7f-4d71-b64f-a83fce9d5f37", "value": "12288:6mkHZqF6C+0oUZf9Zi6xoZsF60BBaF0c6mDr1:6r5qF6C+0oUZf9DoZ0BBaF9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767837392, "uuid": "d1ea1916-1a08-4f2a-9244-bafad54bddeb", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767837392, "uuid": "0abe0bb9-aaa4-4b86-8ae7-1490572d1406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837392, "uuid": "737c90ef-8948-482b-9439-1b4cd7d3dce2", "value": "update-v2.3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc58174f-eca5-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767885729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885729, "uuid": "307b3134-7efc-4190-8e43-492def436920", "comment": "Malware payload (AsyncRAT)", "value": "54a241def623c0c10361dfa76c70a365", "object_relation": "md5", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885729, "uuid": "81692dc1-84dc-43fe-a64b-74117de14afb", "comment": "Malware payload (AsyncRAT)", "value": "ccc6f088e6a1b9c9bcee3af6e5baa094e868b111ea4f62cb377db909b1398ba8", "object_relation": "sha256", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885729, "uuid": "280b3787-f11d-408a-8f5d-df11a43160ea", "comment": "Malware payload (AsyncRAT)", "value": "52bfdbb902d24598325d0aaa21e33637281a1a2f", "object_relation": "sha1", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885729, "uuid": "ec9a5016-d4b0-4d82-b3b7-782a244fa000", "comment": "Malware payload (AsyncRAT)", "value": "62ba778f51f44ce8c44b2ec1f5a5c7c4d95eacf0705958040fb425438bbea1c1e48a2c9c9596bed4be2350dfa0bb2a1b", "object_relation": "sha3-384", "Tag": [ { "name": "45-150-34-192", "colour": "#0C7E5E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885729, "uuid": "13b5c148-82f0-492b-abec-ddfe1bce6c78", "value": "T1B2535A002798C965E2AD4AF8BCF2850146B1C5772106DB5E7CC814DFAB9FFC64A163EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885729, "uuid": "d0f5b0bb-3b88-4fd1-8152-019502d8429f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885729, "uuid": "b54991b9-866e-4201-b7eb-2e739c942dc5", "value": "1536:PZ2NjfU/cNRPZNg/hDTfPtdctf+fGbb4wcynxKGZZVclN:PZ2NjfU/clChDTf16fMGbb4MBzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767885729, "uuid": "41a056bf-3599-4682-8561-05a3a9cf539a", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767885729, "uuid": "3515ef4d-4428-4859-9f07-f24753fc4f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885729, "uuid": "bc1921a7-d311-4a87-87f9-b37022ad7846", "value": "Addone_plugin_dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300497a3-ecab-11f0-a129-42010a9c0007", "comment": "Malware payload (BRAT)", "timestamp": 1767888043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888043, "uuid": "ccb4b9f2-6c85-4488-b448-15e8ea09954f", "comment": "Malware payload (BRAT)", "value": "f62d4672004a0544054f0773050c0ae0", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888043, "uuid": "0ccbaf33-f2b0-427e-b134-20508d70e913", "comment": "Malware payload (BRAT)", "value": "cd3a8f08e03095d36f83dfb8c96a7f0775d58241bd255fa99fafcdb378248923", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888043, "uuid": "857acb0b-931f-4fb5-84a7-37a51c28e6ff", "comment": "Malware payload (BRAT)", "value": "03b949d39507f76d23d0a23982ffc6c5683f9825", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888043, "uuid": "f9b80a04-53e4-428c-8791-055c688e3614", "comment": "Malware payload (BRAT)", "value": "8f9b77cdb9a59dc82da606f236256f8495ddedaa29e5c83d25ed5793f3529beba24c5e4ab2eb4ba69eb52ef62513a769", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888043, "uuid": "43faf706-78c9-47fc-b144-b3f50dd53510", "value": "T142373B67A1F7D1B1E015B62F12C87D6798727F562A257803B08C2C8E6F48E36187ED1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888043, "uuid": "f4c23162-8c8f-491f-877f-6bd4203d4c0e", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888043, "uuid": "2f4e66e2-dd75-4e27-8fe7-4d184d257052", "value": "98304:g+XqDyijnOyZHYA+MGLizQ+3xm3PG0keRMzByx8Fwezmkuz+/L9ILfd9:g8qOeOboOP6zYIyKSfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767888043, "uuid": "0ec36ec6-7518-481e-9576-eeb5be455e22", "value": 23081984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767888043, "uuid": "3e99c47e-decb-4817-ba69-880b7781ab9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888043, "uuid": "b2ef2fe2-6855-4ca6-9fc7-bf4715f39a49", "value": "NovaUniv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dff7d8f-ecac-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767888550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888550, "uuid": "23036cf9-9772-4cb1-894e-94aa82232400", "comment": "Malware payload (SalatStealer)", "value": "d519fc88aa25266cd5d30b083085a16e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888550, "uuid": "499bbe3d-d89a-4ff6-ac6a-05d2547f5553", "comment": "Malware payload (SalatStealer)", "value": "cd87b06747e03b1e704bff325218743b6952778cc3d38483ff45032e41f8019a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888550, "uuid": "ed8ac073-9b2c-4dd0-adb7-f1a2462f1a9c", "comment": "Malware payload (SalatStealer)", "value": "9395d0b5ca5fbd764f2cea711b154699d99f6a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888550, "uuid": "b6e7b2c6-5a33-4ca3-8461-470525182be8", "comment": "Malware payload (SalatStealer)", "value": "0cefbd0bd370ee087e3ce12dada5da27276f91a1247100dccbe98a5dcc447237374d2aaacf6520d4d709bc14c7a09ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888550, "uuid": "50ad939c-1987-4ba3-9ece-e4d72291d216", "value": "T16E6633553AE548FCFA2BC13C97558252AA3678861B02E7FF126401263FA36E56F3DF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888550, "uuid": "0edd0e63-8d61-4035-b66b-a0d64ed2aaec", "value": "1e696cad5a35c50e98bac6c485662bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888550, "uuid": "0a4fe399-990c-45cc-95f6-6dccad1dcf90", "value": "98304:aiX7zGFu0UZTROzxjxhBGva49ylMGcqHgDZ9RK93kLs8EM0uRKCDCm5tw1jc71tv:aiX76R5xhowMNSOjK93ctKCDjtwe2jHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767888550, "uuid": "d378bc5d-d4a7-4ed5-be3d-dc5a07654001", "value": 6719504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767888550, "uuid": "dde50556-6ad6-42ce-b517-378c42fdd141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888550, "uuid": "b86b0fa3-5304-44fe-955b-c98fbfb07c6c", "value": "DMAcheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9517f2d0-ec88-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767873180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873180, "uuid": "17649662-4ba4-4942-b09b-3ada830811ee", "comment": "Malware payload (QuasarRAT)", "value": "bded9ced2f82bc1fa54d90eba16ba071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873180, "uuid": "efd34e88-ccfd-4fe2-ae6f-8e9f6d7a3e57", "comment": "Malware payload (QuasarRAT)", "value": "cdb7eb4ee5b5590e98ba7e2e90ba5645317cf506489e8b566daf55afd8f84164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873180, "uuid": "8f979b25-1199-41db-8ffc-8f796819006c", "comment": "Malware payload (QuasarRAT)", "value": "da19ce7a36758d939121abdd06ac08b2647db6ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767873180, "uuid": "fa3b616f-c3e0-47fe-b36f-e2cbe599b5e3", "comment": "Malware payload (QuasarRAT)", "value": "908ab9034b504a558cd26670a62cb8decf3262e21cf0dc888dd6adc70593e6c405d55c3041bcdb5f524b40a37beff3d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873180, "uuid": "9b9e280d-5590-4656-bdb1-ea561cc7b539", "value": "T154D34A1533E8CE1BE2FE5EB9E87461110372EA17E572D78D9D8820ED1A72781D1923B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873180, "uuid": "b7c66412-17b4-4f58-826c-fbf272374120", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873180, "uuid": "eb37eca4-53be-49be-bae1-1e21697a26e7", "value": "3072:wUfPXZsa5dNC7J741So+RBCGZpbVPmp6QNTsdfhv4:JxsafI41SpZpbVlfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767873180, "uuid": "7eafc62d-d33a-4813-ab04-b8ca0305676d", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767873180, "uuid": "2c8e1433-34de-446d-b67f-05be68d836c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767873180, "uuid": "37248076-2914-4bac-955a-e85cf241a6ad", "value": "update-unikey.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0b20e3-ec5f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767855531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855531, "uuid": "75d5062a-50f9-4513-898d-218c2ec375d0", "comment": "Malware payload (Mirai)", "value": "be94a03a101bc6b589461de8ea851b08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855531, "uuid": "18c548d3-a815-4d8b-a932-79f4afbddabc", "comment": "Malware payload (Mirai)", "value": "cf8384a5bebf45d17d2eaee48a8bd4ca29c9bfef55afec67c838ea5baca2e9ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855531, "uuid": "f1f78c74-8aaf-4c72-8081-9be687d97ff6", "comment": "Malware payload (Mirai)", "value": "c5b7183be4a923c1f3681a902412db3f01d6f583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767855531, "uuid": "29482a0e-87de-4ca4-8d65-e796a622524c", "comment": "Malware payload (Mirai)", "value": "937e6687e3dffa536fd890418ac18cb91633e7143e06e1c11fff25634b700ab24fd8d53091eb5552a844aa8fac343598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855531, "uuid": "c0904cbc-513b-475a-92e6-65f6e69b216a", "value": "T1E0056C5AB2E3B4BCD017D43443EBDA63A935B43502226E7B65C4D6303E1AE701B1EB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855531, "uuid": "0bb809ed-d7b4-4ad9-bf90-6091982ed976", "value": "12288:8tvcb74S4EFT4sioD/ik7CmSwlvW6vwnvOfDcgtpRQtBtPGXdzuF+b+JywlCe0kc:4EPDJl4sgk7CF8rInGfnctBtuWCHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767855531, "uuid": "4177d8fa-9215-4cde-a54b-aa94e26b12de", "value": 837040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767855531, "uuid": "1d173a4b-8bd1-477f-8d28-fd1f48d21896", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767855531, "uuid": "2ec6c75f-7333-4219-9ec1-f17d4515acff", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf23e73d-ecc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767899021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899021, "uuid": "0db349ca-9ee0-47db-a829-e29049f22999", "comment": "Malware payload", "value": "6d77ec3e4288e80ea926a7b4901ee92b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899021, "uuid": "82cae18d-e292-47eb-a457-63f028055700", "comment": "Malware payload", "value": "d03be21d0c49543ee62eba89a309876106e3794ec3fe15fe84a6d75328f9c4b0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899021, "uuid": "eef09a99-9326-4335-aefb-921e536c843a", "comment": "Malware payload", "value": "83999a642845bc885771e2ab974713ecbee7c233", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767899021, "uuid": "f6e292a9-edbf-4589-b4f4-4dec5bfbfd64", "comment": "Malware payload", "value": "b4d688e953e63f48cda321cdb7bc30c5f7a00e8544904916a4d83eae26c231781da8680b70249b9181738bb0ebfec7c6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899021, "uuid": "de033a34-1bd0-42f7-a4b3-721fbbba8bc0", "value": "T11C263386E7CAC457E4BA9B3545B59EC3843A7CB62D34932F8184E5CE1D32305BE7036A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899021, "uuid": "daff65b2-8914-4b21-be83-56f0269e6eea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899021, "uuid": "2f666c8b-9cce-425f-a609-a2ee9535ab73", "value": "98304:YaZ/wiOxunXnj1tOS1sC/4Ikovae3vtKSTOEuPDbF:r3nXnjHOC/BkYFOEYDbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767899021, "uuid": "85fad07b-eda1-4b14-8dc6-2ce213a364bf", "value": 4532736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767899021, "uuid": "1c392f35-4666-4e17-b4cd-1a3d3d188469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767899021, "uuid": "e4fc4c36-1df7-44d2-9d40-948b9b8be0a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0edd69-ec93-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767877806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767877806, "uuid": "8d7eac36-cd14-4780-89f4-2200213a2bb8", "comment": "Malware payload (SalatStealer)", "value": "fb5edf30714e734aa89b0c3fe621407e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767877806, "uuid": "1f8af60c-c236-415e-a5e9-7b92d1c47d44", "comment": "Malware payload (SalatStealer)", "value": "d123746318104789658ba59cddecffcb4116bf9b9dc1698850aea3a047d95534", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767877806, "uuid": "18c3a9ec-7580-4833-b002-5d02079c553c", "comment": "Malware payload (SalatStealer)", "value": "a22e5918718293db99a3c228af09913b7f98411b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767877806, "uuid": "2d0ec460-f34f-4ab1-8178-9315f79187e8", "comment": "Malware payload (SalatStealer)", "value": "989bd551dd2a3b9cc67db712cc7bddfe99081fb2ff73fd144359eedc5610c1748bc0bb9db2643b40006a9bc36534b73b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767877806, "uuid": "1d43a009-4905-4416-97d0-2b2a0b1f41ae", "value": "T1E1E53329F5A50E02E5E10E776D203CCE7EDCA4BFC413EAE5744A4D1187DB9A4A36B0B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767877806, "uuid": "cbc2afbb-0670-4b3b-a229-c8484ababa9c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767877806, "uuid": "d93e28e0-60a0-4bb9-bf2d-ab0827b051a0", "value": "98304:si2qukotbXmRQ71/0sjf/BBtjyv/lHK2izqXegQYI:J2Htbb71/0MnBBlylK2wqXTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767877806, "uuid": "dc655bcb-d9cf-4d58-bc39-3f3ec41ec524", "value": 3291136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767877806, "uuid": "9bd08308-52e0-414b-a777-fa0e5807c12e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767877806, "uuid": "aa2230c2-8f28-4e30-850c-c478816a3461", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5896fe8f-ec34-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767837001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837001, "uuid": "08973ac8-b997-44ba-896a-6a1eef9ce698", "comment": "Malware payload (Formbook)", "value": "15b4c1d3e762aa98a883878a124ea788", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837001, "uuid": "5b7f65a8-ded7-4e8c-8328-8ffe2af03a0f", "comment": "Malware payload (Formbook)", "value": "d3578f4c321856b05d49735fa9048afe9238410b1245ed6d97893490b9525b32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837001, "uuid": "6af940b6-a441-44e3-b822-0d8ab4c1db65", "comment": "Malware payload (Formbook)", "value": "ec7a1915140b6b1e80baa06d450d0f2a1bee72d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767837001, "uuid": "270a6f5a-0279-48a2-b6c9-903b6dd26efd", "comment": "Malware payload (Formbook)", "value": "3cd3b108fffbe03efe447d619e9a7c7e15093e29d2d96bb00698669b56f7f6468d36dfc60a0826df561c9504ffb8c308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837001, "uuid": "343b466b-b715-4fdb-9b81-211ce38ccb0e", "value": "T1120523AC1A01E733C15707F60892E3B162F55EDFC910F797CAE8ACFB7406A20A9645E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837001, "uuid": "4af3f189-a470-4ed7-bc3a-0237a3462d25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837001, "uuid": "fb3f30d3-0f12-45ec-8b3c-cb92b4b97757", "value": "12288:VXBvVw/C02RtzvEfSb7Ntcs2DIz8P6xFstTnFETsAH3kNGgfDjR9hDk/z:VXwadvEKvNhzEgHab/Rzw/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767837001, "uuid": "2e1d38df-ae53-482a-8b08-347717b8e4e1", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767837001, "uuid": "e2c15451-6454-4e24-8830-57caca3ca637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767837001, "uuid": "55307992-d44a-4436-b21c-99a04785d914", "value": "MVNicosTomasosVesselParticulars.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96f1a83-eca8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767886985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886985, "uuid": "444dee78-c791-4276-81d9-492aeffd3e4b", "comment": "Malware payload", "value": "34e8eb113a204fac6335f47417804239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886985, "uuid": "78b6494e-0d6a-459c-8754-17f7ee26d90d", "comment": "Malware payload", "value": "d4448a0ae39a81ad185ba4349cf9d42be04a98f11b78b7bf487df8eb94030583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886985, "uuid": "b527fb72-9565-4e5d-a155-f02846b8b305", "comment": "Malware payload", "value": "36e81f3f60bc2977ce4404399e5d0cdd796a7233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767886985, "uuid": "e2ce9ce1-3ab2-4b36-b8b7-675b9d1ebec3", "comment": "Malware payload", "value": "2478f24deded527c8ab04c3537252ebbc1047d916d0491a3fc0c05df68811f75c2b1ac0cdd21e033b3c9b8dd0ae7ca00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886985, "uuid": "e84eb41c-0095-46f0-8532-0f6314ba3912", "value": "T1F9086B42A2EA04D5F9F79A349AF65213C673BC063F3095DF3148172A1F736E0997A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886985, "uuid": "72e176a7-b04e-4b23-824b-32855f7743eb", "value": "fef754a9bc1487a1989de9d9e9b586bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886985, "uuid": "c649dc5a-5200-4655-8e1d-be4c7864a858", "value": "393216:a19/R+b6MEfkTFN5wqEMoNjJT0qlzduSzP5dFTCJKTpEdN5gsbtFKx2Xinsp0ARb:a5C0boYtACkC1uODxO+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767886985, "uuid": "26887874-0c7b-49c8-b61d-1e5a3315907c", "value": 84457319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767886985, "uuid": "6dfc0f52-c0c3-4cd3-a87c-06e0ec2104cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767886985, "uuid": "d33ff365-93ec-41f2-ae18-0880eda02d45", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff06f911-ec64-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767857896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857896, "uuid": "69589956-5c79-4ca3-b5be-aa50edecee0f", "comment": "Malware payload (AsyncRAT)", "value": "15d79b10f2c5abe6c4781a3ddfaf7f03", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857896, "uuid": "337338f6-dbd5-44ee-bd51-07f4df27def8", "comment": "Malware payload (AsyncRAT)", "value": "d5c9bf16ea1b1f3143bbe412b17297260bc0581741dd936c02a3f91eb790097d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857896, "uuid": "e3620729-fc76-43d5-8ad8-757ba96d8b73", "comment": "Malware payload (AsyncRAT)", "value": "775d40c3f4fbc2b81d3a017975a5bd91793cfc4c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767857896, "uuid": "b1c7aae7-0c69-446c-b96f-266159074df4", "comment": "Malware payload (AsyncRAT)", "value": "3af4344ca7aed80dafa77548b5ddb943079bf2b85618ab62f43b22e302f84e1a69f7d87defbbffe700d70c501f93fc8e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857896, "uuid": "81ea5c29-f7c4-4fff-a7f5-f7c61c24b46d", "value": "T13AE2F1BCF3F69C8F9D7988336FB26658F53EA16B43512B5526218F13CA427CD8152360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857896, "uuid": "0258b844-0c7e-464c-9dec-f695c2e0e2bc", "value": "768:VyWvWxOrLkKD0bOPbSQ8xfHIRMKAr4J0L1OI2ZwBGnteS0h:QWvhr/YlQ8xfHuS4iJ5a7nteD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767857896, "uuid": "268b5a46-0afc-49f1-8a65-8033025de8a8", "value": 31486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767857896, "uuid": "c6c5e607-32d2-4577-b4e6-1972bee206a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767857896, "uuid": "ff3d3319-9b86-42be-9987-74cce13ee76d", "value": "Malware1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596f8823-ec6c-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1767861054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861054, "uuid": "edeab1fd-2c23-427a-abfb-179a8def1b7c", "comment": "Malware payload (AgentTesla)", "value": "c12434e2f759481bee06cfc1ad3828dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861054, "uuid": "ce5cf282-6a49-40cf-9a97-61ddc583d5b2", "comment": "Malware payload (AgentTesla)", "value": "d94360d0d69a8baba73666578b1e7434e5abf36e09ae283661a7e3a5da9d848d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861054, "uuid": "e84c7c52-89c0-40c4-b0d0-4eee6e6723ad", "comment": "Malware payload (AgentTesla)", "value": "6474ecf73f0be009c5e2ad538fae6bda11da43c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767861054, "uuid": "abe30c16-0aa9-4e0a-b1b5-f42a71bb825e", "comment": "Malware payload (AgentTesla)", "value": "543d919acd7e3f401b0724ad8a68c3dc03231b94865a75eaf2a84ee7ffc798abfd49f79a2827f995178631f642d52ed2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861054, "uuid": "f1452c05-168c-4456-9ab7-367a29dcaeff", "value": "T19328AE027391C062FFAB92734F56F6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861054, "uuid": "5a9f5cd3-bf49-48ec-9770-9c1793b5f5dd", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861054, "uuid": "7af59f58-6671-4026-aaeb-42475dd0a04e", "value": "24576:D5EmXFtKaL4/oFe5T9yyXYfP1ijXdaSwXnu+bnChG0:DPVt/LZeJbInQRaSwXuan0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767861054, "uuid": "c1d17f15-6861-4377-997b-96cb5ac9dc8c", "value": 94371840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767861054, "uuid": "c5cb69a8-9da9-4ea2-b0c8-05ac89a84927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767861054, "uuid": "51a1495b-d0e0-4a4c-a519-57823c1ce7d6", "value": "\u039d\u03ad\u03b1 \u03c0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1 Athens-Greece.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d17693-ec55-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767851247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767851247, "uuid": "88c1be07-b1e2-4387-ae62-517a8d46f083", "comment": "Malware payload (AsyncRAT)", "value": "c39b5d0f9f9c33cc1db98b1246de3601", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767851247, "uuid": "afdc0e48-f893-4bd6-8760-0eb165b989c7", "comment": "Malware payload (AsyncRAT)", "value": "da9b3724d271edb8a9d59f6361210ad495ad89c3bf291fc0157665c32746b196", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767851247, "uuid": "f22de717-de11-435f-881d-0927f5df93f2", "comment": "Malware payload (AsyncRAT)", "value": "4930308a1e8fbe9e3369381e384f3865883e6d93", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767851247, "uuid": "ce47f10d-63aa-43ba-ae06-83e54f4417af", "comment": "Malware payload (AsyncRAT)", "value": "80cad508fda6845405734d0949d011210a23f7ac7d56bb26c7289a4e2849b823c7c336609dda7f5573654787896088ab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767851247, "uuid": "de7498fd-85fb-4fd5-8dab-10f546d234c4", "value": "T1BBC21A0473F48262D1ED4BBE48339600D375E68B5D13DB9F6EC494AD2A23BCD8625BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767851247, "uuid": "6a56ca7e-a3fa-49ae-8688-b6530baf3bc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767851247, "uuid": "1f7c1145-3f2f-433a-8f70-7e71d9b42a58", "value": "384:wQaA9XyfjjzgeRSQkeKwMymrJhxYHqqbuUsJQxnCJf+BWfXWM/Cu+:wQzMjjE9Qke3MyCJhx+FbHBFBlu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767851247, "uuid": "664dee61-b9ed-44c3-a08d-1fbbb6664c09", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767851247, "uuid": "0d395478-a839-4ca0-9fa9-03dea9b9f462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767851247, "uuid": "b494012d-8988-408c-b106-8e21d359b848", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84bd200-eca4-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1767885319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885319, "uuid": "4847324d-9d6f-4017-880c-a9e7d0c3f410", "comment": "Malware payload (ValleyRAT)", "value": "59a41a3636e0344bf2eaa2624921199b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885319, "uuid": "c9540e31-169c-470e-9f82-f1c33fbbf20b", "comment": "Malware payload (ValleyRAT)", "value": "dcf688c42f36072d1ddb1e12835b92a5a4c3d810368aa0b65e6b041ec40ad89b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885319, "uuid": "47e1d0e1-7410-40a2-b7b6-224016a5d0fc", "comment": "Malware payload (ValleyRAT)", "value": "bfc3c62d67bf6aacb42dbec288de892e0b6c417e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885319, "uuid": "afb3241d-f8c4-4178-b10a-20ce318ee421", "comment": "Malware payload (ValleyRAT)", "value": "a933dc169a2fb3b15f8b36276088fdd899859c04f2f965f67badda3fe008f406d16d057b91e102db809097ca7707c213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885319, "uuid": "5640be11-078a-4c6d-8e0e-bbf915841ef3", "value": "T132E48C2A6A983DD4E439A138B73743C1C32EBC550390D6DF09A432529E7F9D67E397A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885319, "uuid": "cdca9475-838c-4771-95d7-1852c8fd664c", "value": "34f4701e4e643cbdbd3765e360ece048", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885319, "uuid": "b6e50341-d59e-4e3d-b29d-fcdd80ef8cc6", "value": "6144:28LENloeObbjsQUZDWiVZ/4AyYrVVU63mnoW6DGAp2st44anejkDSdTJ8UjRI10a:28LUsjfUZsAbVZsoW3i4teIDEY0iePC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767885319, "uuid": "f2fa7147-b7a5-4375-9880-03fe89ddd557", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767885319, "uuid": "17fb358f-f4bc-4ca5-ba5e-50e79e6c6878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885319, "uuid": "ba1e3ed7-daf1-498b-a9e6-2c1ed1f3c5c3", "value": "xdcf688c42f36072d1ddb1e12835b92a5a4c3d810368a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61118ae8-ecd8-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1767907453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907453, "uuid": "ba994567-7aa2-4cd6-b5a0-86295d8b86ed", "comment": "Malware payload (RustyStealer)", "value": "d276b8c1660f264d64eff3474718509b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907453, "uuid": "1baccf13-9e34-42c6-a027-425d788c27e8", "comment": "Malware payload (RustyStealer)", "value": "ddc6e6c76ac325d89799a50dffd11ec69ed3b5341740619b8e595b8068220914", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907453, "uuid": "77055a81-4259-4fbf-8643-79ad20de5afa", "comment": "Malware payload (RustyStealer)", "value": "17235aff5838668e5adbfb6eb431d2a5e0da13f4", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907453, "uuid": "0b908d5f-9a49-455f-82aa-e4d397727990", "comment": "Malware payload (RustyStealer)", "value": "22db48fb9753a798f2564a650ba776bcdcdbb92fb7d8e91eac4c4d13e4beb954cd5f241c06af0bb0739f604c72f99cea", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907453, "uuid": "45c6d305-65a4-466e-96cd-2bb9566a7949", "value": "T1F5554B43A794A4EEC97EC078C6578632B672BC894B30BEEB17D85A353E27B90171C315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907453, "uuid": "153777be-1208-42ad-9514-a3e434d60232", "value": "8fe78c659294f31e410d890d95d1bdaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907453, "uuid": "2ca89fab-d509-4701-9b16-1d88b155a7c9", "value": "24576:rJYJIIB8OGMpbFpYbe652G5ADVuUvS6cm:r+IICOGiF8pUuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767907453, "uuid": "1a714859-164c-4db2-9428-202356243c3a", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767907453, "uuid": "a3fe6e0f-5d19-4f7a-b403-ba46a3194e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907453, "uuid": "c6fa26d8-846c-4986-ad87-f7b2d0f8c8f4", "value": "nginx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24df39ee-ec40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767842068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767842068, "uuid": "ab4fe2cd-0a2e-4dfb-bedd-38566d4f7370", "comment": "Malware payload (Mirai)", "value": "20d81b1e6d88f9d97d8610b3f0497194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767842068, "uuid": "ca377bf6-4499-4de3-badd-8bebe4c3fde6", "comment": "Malware payload (Mirai)", "value": "df496b5de4420824caf8d38f1d16980f0490b64c2c54b8938348a6c17d1ea91f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767842068, "uuid": "0042af37-5a4f-4891-a921-ff2d8c32d924", "comment": "Malware payload (Mirai)", "value": "0ea3e5fe74c1dc26ca29b4a974b4b467b93d2425", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767842068, "uuid": "8412e236-76f2-44f5-81be-da1e2ff7f207", "comment": "Malware payload (Mirai)", "value": "3856ed83c451aacd26766dc6191b739a63abeced681a8ede06f8ee28732e550226752a67c3c20479ab4bd7fe1317f566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767842068, "uuid": "5a37e42f-6e89-4aad-8001-721325d40db7", "value": "T135534AC4AA43D4F5EE2605711177F7335B33F43A4029EE97C769DA22AD53A00D94B29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767842068, "uuid": "bf2b72bb-6b9c-4282-bf71-65518ec8848b", "value": "1536:GVkddjApO4f8u6Pswv1CylBpjgLvpYpwoRnSt0xToJAhtC0xqqF87wjGV08vKSwa:2kddjApO4f8u6Pswv1CmrjgLvpYpm+VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767842068, "uuid": "0914cf47-e9aa-47e7-893b-7376353a32f9", "value": 63792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767842068, "uuid": "322edb57-2ba0-463b-83ca-752af458270e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767842068, "uuid": "fcd3294b-f638-4a97-b525-898024a558fa", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edc302d-ecd8-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1767907315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907315, "uuid": "d5fe5d65-12f8-44f1-b644-1689f4392186", "comment": "Malware payload (RustyStealer)", "value": "08d8ab5dd375847ce909297e59e7df00", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907315, "uuid": "babd3546-1956-4f3a-9a61-5584e60902e5", "comment": "Malware payload (RustyStealer)", "value": "e081bc408f73158c7338823f01455e4f5185a4365c8aad1d60d777e29166abbd", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907315, "uuid": "ade5d68d-67d6-47bf-baf0-c1be7cea0816", "comment": "Malware payload (RustyStealer)", "value": "b4e787c74dd6ba8067ce69eaea00c19866f3b138", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907315, "uuid": "2c31b38e-804f-472b-add8-b0700bb79c92", "comment": "Malware payload (RustyStealer)", "value": "d74f993a2cc06c26062779e86aa74b6b2094873ee31d635ec2b86fb3bb2c0ee0cf77c1010f63948f3bfc1ee2f0e7ea0d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907315, "uuid": "6f9b6bf7-dbbb-49c0-bd31-99fb9ed5b1a3", "value": "T1C7553803A695D4EAD45AC078C67682B2B772BCC9CB31A5FB17883E343E76F805A1D714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907315, "uuid": "5c78f9b8-9067-4e2a-bc3b-ad7f41b7ed9a", "value": "f826317580105e128b6823f7980f1213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907315, "uuid": "7c875f06-bab4-4ac4-8e89-4275a13749ce", "value": "24576:/iJcz366cGXUEUQMTK8toGE30APWkPXN6:/iJSK6cGpUQHFEcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767907315, "uuid": "b2d928b3-e438-474f-9fe8-eb1873482ceb", "value": 1318908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767907315, "uuid": "26f80396-3d81-4999-a08f-4772cb731441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907315, "uuid": "283df589-f385-4606-86cb-6f437f0c3320", "value": "cloud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036a81ac-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906437, "uuid": "80e209fa-b830-4d36-904f-71e53d7aca13", "comment": "Malware payload (Mirai)", "value": "97c3b56043c3bcb143d8d81cf93d3b70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906437, "uuid": "68c4e0b6-c97a-4a21-907b-06986a07ee16", "comment": "Malware payload (Mirai)", "value": "e0c008a272d0c71efd06652ab780d854d6d9a34d1935a8f9cb4a79a0c9e0edf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906437, "uuid": "eaedded4-038b-442a-a2da-d66e8d13e9df", "comment": "Malware payload (Mirai)", "value": "000259881eb0a1ec32bb106e70b9de42fc18632b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906437, "uuid": "e25c82ad-8152-4b03-a703-8500b7fff713", "comment": "Malware payload (Mirai)", "value": "1fe57dc5706aa47bd219295cc0694cea3b00c9a022324ac73abbc961a17958af4af1efa3dc0e6e426dd0f6c2f836376a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906437, "uuid": "b74e0724-85be-451b-aaa2-11fffb5b4bb1", "value": "T13C6302AFE6E33DA3CD7D4C7C519927889FA9F0405A8BF31043904CD2163A6DA279C46C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906437, "uuid": "6a80e65b-9560-4b4a-9f89-3e20e439abd7", "value": "1536:HdcTNKGWgQEQomFOMMMsiZfFQsHZXQ3cEX57muaNUnU1YLRefiA8zc7Lf:Xo8OZPiZfFN9Q7L81YAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906437, "uuid": "e972c5a9-914d-481d-927d-0cd66d1c477b", "value": 70368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906437, "uuid": "f2df5cf5-741a-4e0d-8fff-b7d338dda8f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906437, "uuid": "353bc1b6-802a-4ece-a586-3833af6f531e", "value": "ub8ehJSePAfc9FYqZIT6.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c71fa2-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1767856193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856193, "uuid": "4e089974-90c0-43a6-9dda-9e4432fada43", "comment": "Malware payload (RemcosRAT)", "value": "01f2ffef127ee4f062dbcc3dfd53a8a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856193, "uuid": "bd9acbb1-a522-4f6c-bf0a-22cb56399484", "comment": "Malware payload (RemcosRAT)", "value": "e0eed0a8992e53e0ae07f8d1fa8b730e01ce854abb58869406e130b9452f8cb3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856193, "uuid": "d9b2f105-2a8e-4478-ba2a-6f061a0b97e0", "comment": "Malware payload (RemcosRAT)", "value": "845ff301d4d4d69c0add267c38d41cb5796901b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856193, "uuid": "39af78dc-b23c-48f2-ac2e-a7c081701741", "comment": "Malware payload (RemcosRAT)", "value": "1ada1115eff744705eb5d53007730d7fbc2e0ffc9525399f78b620a4d640452c0923be525eaae593ed87ec76609c4ecd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856193, "uuid": "fd51d50f-e37a-4dab-a994-756b20b76614", "value": "T161B375883FCAB471935525237D2B60AEF23E4C48B14C44A2D2A76ED5FB6C314E77A52C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856193, "uuid": "b76e11fe-a246-4481-ac44-cdfc48222250", "value": "1536:LOWuvNp8orfu8Yczel6Qx1Cp/wFLSGWLosEnxY+ruJRtE2LbPOTIdHyH:LO7r8o7zwW/wFuGfsEni+ruGpmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856193, "uuid": "8b030c9d-ab93-42db-a1a1-dd9950e9d712", "value": 113902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856193, "uuid": "508166b2-1e43-47f3-a114-85bfdb8fc4ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856193, "uuid": "a7398259-9646-485e-bd90-1acfd265420d", "value": "RFQ-788682026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6765fea7-eca4-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1767885130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885130, "uuid": "86d3407d-3789-4023-a881-2c4679019a95", "comment": "Malware payload (RemcosRAT)", "value": "61914e6eb4705ef807d940655f2c551a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885130, "uuid": "8bc38dc0-e6e2-4d87-80e8-395a6d90fb62", "comment": "Malware payload (RemcosRAT)", "value": "e16260b52507d586cd078c4180f98d59d6eabbf81ed9d97446c6ef63ca802e25", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885130, "uuid": "a37b6b6a-8fca-45e5-9e1f-8905f21fb7b9", "comment": "Malware payload (RemcosRAT)", "value": "bc84ac4910eb989ee4651d1f4a9c7657ada5e73b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767885130, "uuid": "6ecbd5bf-c6a1-450b-ac17-38a86318a105", "comment": "Malware payload (RemcosRAT)", "value": "c60549c38e2d811b369974ab884c269398c3f751c37efb85543e487b23fa29fde98eec2cf75e1f173d5d37a4ab79c325", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885130, "uuid": "a995b71e-4bd5-4dfe-aa78-157c0c4ffa29", "value": "T1D046950A74D40097C622BEFE1D2D77624C0A7E175FC21C9A3926BB9B342CC9DD621E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885130, "uuid": "a82d199c-c708-4320-af88-cf6929fcd461", "value": "49152:y2pnTZV+u6LgiexsSP+K5lI3kCgtpruwgRb3bUURRcGc9uZu9dv:y2dZV+u6Lgv+qlImUk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767885130, "uuid": "2dd2c3c5-5a2f-41bf-8823-8886b5f1e548", "value": 5828814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767885130, "uuid": "b415536a-a494-47a9-a2e2-d27b23183063", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767885130, "uuid": "dbf7a5d8-1980-4313-b803-78121db7a3db", "value": "loc2.caixabank.es_GPeticiones;WebLogicSession=7NW9lgB5gwftuBJQZZiejGPdABovXxI6XpBGAcNEVE6YgUvx3wIU!1113514470!-293253623_PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74784168-ec3f-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767841772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841772, "uuid": "8cb5bb97-477d-42dd-8247-cfbd8de58311", "comment": "Malware payload (QuasarRAT)", "value": "48108599b537d30e956b58a0d0bcb748", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841772, "uuid": "d9b5afd0-79c9-4053-84c0-1eee15be0909", "comment": "Malware payload (QuasarRAT)", "value": "e582a6b95ad02b028a3cef7c8b0989cb9add3bba91008f43d80bde34e2dd22df", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841772, "uuid": "fa69066e-198d-4cf9-bca1-034124bfc659", "comment": "Malware payload (QuasarRAT)", "value": "803c412331f00427856d98fbc65ea74b299da4cc", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841772, "uuid": "8ac71315-5a0f-4bbd-bc7d-fa2e01984a02", "comment": "Malware payload (QuasarRAT)", "value": "06ab676df3d2f6b77bffd12d35caa28de8b8a34803af3871fdeb962b256461e8c7841ecf40671da5331e5c28df6ef0ea", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841772, "uuid": "846711c8-5c0c-4c97-aec4-bc1e7beaf95e", "value": "T131E56B143BF85E27E1BBE677E5B0041267F0FC1AB363EB0B2581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841772, "uuid": "5e36ba02-2f0b-4d82-8d4c-72c2e674d9d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841772, "uuid": "9ec4d1bf-8948-4ef1-bcce-2865470c7ad5", "value": "49152:ZvcrdR2AMaI8aIP+ld7fB2ZL/IUUnRJ6hbR3LoGd9zTHHB72eh2NT:ZvWdR2AMaI8aIP+ld7f4ZL/IUUnRJ6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767841772, "uuid": "292d67bf-bea4-4af5-b951-535f95c2b357", "value": 3271680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767841772, "uuid": "fcbeb129-b51b-487e-8d0d-d734bcc634c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841772, "uuid": "48937de6-7366-46a8-98ce-40f0b6695418", "value": "UrbanVPN Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd24d174-ecd7-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1767907232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907232, "uuid": "faa22b85-d876-4a1d-a1d2-05f4d39f1046", "comment": "Malware payload (RustyStealer)", "value": "47e312ecca7af098bb1c6c69188f54cf", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907232, "uuid": "e74fa203-0dac-4068-9f35-f730f0250058", "comment": "Malware payload (RustyStealer)", "value": "e61b2ed360052a256b3c8761f09d185dad15c67595599da3e587c2c553e83108", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907232, "uuid": "22fc847c-dc82-46c0-933d-0afed15d0bea", "comment": "Malware payload (RustyStealer)", "value": "ab4edcc5f568c03f7912f363259d4c105c5970e1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907232, "uuid": "52d6774a-02de-4a91-b33e-f0e713c3c7d0", "comment": "Malware payload (RustyStealer)", "value": "caa2d524d71db64a40546ed537530bb82d1c7c9f72260e2e9f660a61c0a1871ba963f89e3d89d9e33560d2c187a715e4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907232, "uuid": "e7604167-74b1-42e2-a7b6-e9075f5fe050", "value": "T1F4554B43A69488EAC55DC078D756823AB636BC8D4B34B6EB17D83F343E26B941F2C714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907232, "uuid": "fd558bf3-08fc-45f5-a2c0-de514f42c041", "value": "aa8d62eb1c7f83b955dc6efcb989ac3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907232, "uuid": "2d8e7d85-7dcb-42cc-9b53-949ac0b65b07", "value": "24576:bNfoT3/QPvpFAEkgRk+5gQTAjQFUNu1eLrDSr+AtU5KJLh:bNfor/QP3EAB5H8jZusLrDSr+AtU5KJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767907232, "uuid": "b9df8814-5915-4b75-ac59-4da21f78c72b", "value": 1319084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767907232, "uuid": "83f846a3-2ac3-4455-9416-35dac29ff25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907232, "uuid": "ef013779-1b2c-4943-a193-520a170f697b", "value": "art.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79812fb-eca2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767884513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884513, "uuid": "8254bc91-f71d-4e9b-87ec-fffdb30dc175", "comment": "Malware payload", "value": "0afd30577bcfe0000a382ddb01b7337b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884513, "uuid": "92cf2b71-3ce2-41ec-baca-450fb8adef02", "comment": "Malware payload", "value": "e8c1278d06b3c8966607b6049175f9ff5b96ace423408c812b013f65eb41edd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884513, "uuid": "3cf1c69c-e509-4f11-ba82-d1d5531cccf3", "comment": "Malware payload", "value": "84827812a601355a21450baf306bce13d62523ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767884513, "uuid": "072a96b5-1f38-44be-ac2d-2c67488f3a46", "comment": "Malware payload", "value": "95a6a8c6ffd75ff6894d192e24b309ce86c389686afa356b5aca2161040ec145da941bf7c9c252921a690d1ab177806a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884513, "uuid": "84b1119f-1cb4-4d66-a186-aee21c38dfd0", "value": "T1F434F63BE7A24C78C1D7D2B4A396CAF1A570FC151321E85F0695E7237A5BC201FA98D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884513, "uuid": "ad852353-ec84-425a-985e-f2014067fec2", "value": "11a7e07209a9b1ae6e4e9dfa35acd896", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884513, "uuid": "a8cf3be0-79d3-468e-93f4-e18e0e096e64", "value": "3072:Xz9VN5g6IaDnHkbgHyWDEZSpHU3zKNJJjFTFuq:XzjN5g6JE4pDEYJU38J5pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767884513, "uuid": "7d8b78c1-fd0f-420f-aad5-26c9cf989952", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767884513, "uuid": "a69dc38f-7536-4216-afd7-b086f17150c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767884513, "uuid": "37d15767-a61b-4a67-9f7a-ae2079485fc1", "value": "system.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0f8a48-ecd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906424, "uuid": "1c629194-8c43-4d40-91c9-e91d07c475f1", "comment": "Malware payload (Mirai)", "value": "e9ec794678a05064d3a1aa54ac87a312", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906424, "uuid": "0511f757-b8d9-4500-9ce8-4027dc63815b", "comment": "Malware payload (Mirai)", "value": "e98d99a94c45ce0c68fb7ac890b7e16d2ebefa87aeb5e45a82024c33e40b90ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906424, "uuid": "55a7c9a3-00cc-4bc6-bff3-65f3343d89b4", "comment": "Malware payload (Mirai)", "value": "d20290b7ba2a9badb3c9abd2ff07e9e3ba8503e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906424, "uuid": "0bf2b540-932e-4286-bc0a-8b56bd08be2e", "comment": "Malware payload (Mirai)", "value": "83dd0de28b9e3f83d750b01957b11cd24f8df8d4b472102cc1efa6dacf95d547be2cc7bbf9f389411b140f38a4f17c4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906424, "uuid": "3bb0124b-dd33-40e6-9aeb-a7b7c931d2cc", "value": "T169530234828EA84CC125E9F89B3B40190AAB8B7CD079F5389D53479D666A94608FD39F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906424, "uuid": "607c59fc-6e63-48e6-8324-42ad02c1860e", "value": "1536:tvtLqp6og8KAUTrwW98GA5M7NUTdVmbMqrzVUM:tk6orVZGP7kqrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906424, "uuid": "a69da291-c76c-4242-9e47-6c86cd3c209f", "value": 64104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906424, "uuid": "ce7f3482-0072-4c33-9437-14416d937a6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906424, "uuid": "cb31e2bb-a279-4da5-9d5f-6411e6956310", "value": "ub8ehJSePAfc9FYqZIT6.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8f67ba-ec3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767841997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841997, "uuid": "0b26ae18-31e1-4540-84a4-77ecc28dd55f", "comment": "Malware payload (Mirai)", "value": "221b01c325b07132f4eaa8d32e29c87e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841997, "uuid": "309bb9bc-5e9d-45f9-8c23-182ee4fecdf3", "comment": "Malware payload (Mirai)", "value": "eaaa4e4281e8545827cd515e68aa3902e89b9668a5f559c4aa5cd483f3b0eaea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841997, "uuid": "e2340950-58bd-4239-b035-43244d292886", "comment": "Malware payload (Mirai)", "value": "9f4400a2a2f34d78464544082b075c421f5a51b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841997, "uuid": "be319224-b2d0-47e3-8617-82118a3f8b65", "comment": "Malware payload (Mirai)", "value": "98c6e13651a752d95363f38614f24d9f8761f412b480b1ba8b887f173d32f99492ad3a6d3a11de9beb1562b34bb84e4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841997, "uuid": "b9de6f4f-f530-4fd6-a5ee-64409cfeb2bb", "value": "T1BB63AE77C43AEA98C14595F0B4B08EF42BA3B44082671EFF16D5C2669083EACF5863F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841997, "uuid": "8912e6d6-b493-48bb-ad41-4421d02e769e", "value": "1536:WTwtZ3Psl1DtMqrjeuKkAlYfTAWjCgE0t/ILDo:WT4Psl1D1jeBkPTAWjgyCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767841997, "uuid": "9f77e78d-e167-4d0d-acfe-229eb06cd266", "value": 67220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767841997, "uuid": "46ec6169-1423-4e19-a658-8f7e2fdc563d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841997, "uuid": "5a45a240-289d-47e8-af24-bb63c34cfb97", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd324a77-ec7b-11f0-a129-42010a9c0007", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1767867772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867772, "uuid": "ca9754e9-12f2-4772-9c66-f6df3595db69", "comment": "Malware payload (AveMariaRAT)", "value": "8e225ab39b109774e81c348f22b487be", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867772, "uuid": "96de7db3-6858-4987-b0d4-daca6652de51", "comment": "Malware payload (AveMariaRAT)", "value": "ebe3a3b29bac94e70fca9456c8607a0b004cc36361c52e24b5c1981cf8f8dbf3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867772, "uuid": "260bcad8-8628-463a-8af0-36ff1cdc8ffb", "comment": "Malware payload (AveMariaRAT)", "value": "ab8615ac6b7b1becfcd04c7395e6beef09c63f77", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767867772, "uuid": "30c58a07-7424-440a-98b2-c22c60948eb0", "comment": "Malware payload (AveMariaRAT)", "value": "9a7441466747993d698c030d032a2351b943a2308c9d34663c790042e785e98e28676c5d05c51e98cdf05eccb3ba7da1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867772, "uuid": "9958b922-b0cd-4d90-b20e-24c26d7f94ea", "value": "T146A4BE56D992CD52DE552FB5C23289341073BD7826F2E24FE8C979B627F33E1041A88B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867772, "uuid": "87c74ad7-7050-4f5d-9fae-81b220c19ca2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867772, "uuid": "b7bce4cd-0257-4975-a79c-f3db9c0789e3", "value": "12288:RnFbTuFaK4OSj/ar1JVO+t31U8hs5RDbSQFEh:hqSj/arBO+EQsrbSdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767867772, "uuid": "830a63da-3f58-4669-ae43-9306b714e315", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767867772, "uuid": "6130fc91-0769-4d60-b289-480db70e0835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767867772, "uuid": "53cf204d-5427-4828-bae5-93297dd3a3bc", "value": "Belge_Bilgileri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802ec88b-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (PXRECVOWEIWOEI)", "timestamp": 1767856395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856395, "uuid": "3a692a55-6e76-4878-bf78-ad172a5a5dae", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "2450aedcde296e78dac05082d2d21ce4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856395, "uuid": "b1b37794-e886-4325-993b-f44f3622fc9b", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "ec75f284102e3827f09cf9d4c646620f707657a977581064a0cea7a67d3e4896", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856395, "uuid": "7eb82d75-c38a-485f-ba11-c620d1cf2007", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "27eff304b260bd7fa0df1d28390ea333188fc3e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856395, "uuid": "2101329b-44e7-431d-8177-f2c477329702", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "cd410788463c6641bea4c857ee3bf64cb33609a02096a407f809a191e8305e9a8a253c5e59e1b786079c851f589c8ca2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856395, "uuid": "8abac7e4-e80d-4a76-9b1c-7fba0b7f11b9", "value": "T1D326128C99AFCB32F92E799C4D22EE54A9085F7F0A864C3D790D81DCDB38574493AD24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856395, "uuid": "e9f04d23-5e84-4677-9101-d405cec70f0e", "value": "96:Oaab2annAPy2Lap5gKBU+KyPwJehuj/X+d7P1cDtZ3PcyepPpuUzTUfRIk2wu2Sv:HcFrEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856395, "uuid": "30f3860f-f5d3-4f66-8abc-294c063cd30d", "value": 4687911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856395, "uuid": "6665b313-6d08-40ac-b77e-c7db1d6b97e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856395, "uuid": "7fa6853d-8301-4a3b-9192-330f12239497", "value": "Tour_Group.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afeb511-ec3d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1767840871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840871, "uuid": "40897795-fdd3-4844-8309-342972b8d69f", "comment": "Malware payload (XWorm)", "value": "df0bac8f40d22d079d2b3a8f93fbd4a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840871, "uuid": "389da028-8a61-42ac-9a4c-1451442a2bbe", "comment": "Malware payload (XWorm)", "value": "ee14d4bac5dfda479a81d91b682ecc42794163b233685741e0be0df5fe29e57d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840871, "uuid": "def1f06a-7040-4c9d-bfc7-8a4eb1ab7150", "comment": "Malware payload (XWorm)", "value": "c7e5e2f71a4ec3f79ed6fa841c4971bbf8ddfef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767840871, "uuid": "f4c724df-ab72-444a-ad90-632dd15fb693", "comment": "Malware payload (XWorm)", "value": "fbb04c40dd76665b194763e485e8cfc96ff8bbbe8dc24a08aff8b27a6bd3fdf77614e7f96e717644a6db3ff580cc68f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840871, "uuid": "39b0ae70-13e7-4fa3-a0e3-3ec408e8fe6b", "value": "T182848D16F74408F9D493C2B4CA964646DA39BC9E0B71EEDF17C8462A2F227F05E39B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840871, "uuid": "bb9f5240-7010-41a6-9e1a-a850c781b139", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840871, "uuid": "f072c777-9655-4089-b07f-286c4991261b", "value": "6144:p+GYnA0zeWiDi5eJwQ8kV3f+RysMFZzN/0JK2P71ctW8sNrwC:pYkDi5eiQ7uysMFZzN/0JK2z4k1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767840871, "uuid": "d9dcc413-ef4f-4188-8ee0-e6a388170480", "value": 386248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767840871, "uuid": "192541c1-96c5-4b1f-a6bd-b234b97a2191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767840871, "uuid": "e04a132c-23d3-4395-a337-114d9d2247cc", "value": "7vmibgs9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b9793e-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906432, "uuid": "7a9e683d-89e0-4147-9d17-d74a092a8ce7", "comment": "Malware payload (Mirai)", "value": "6931d9b2b65269a99d6c50659c65b210", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906432, "uuid": "b68d981c-aea5-4a85-b0fd-87e9336cef1e", "comment": "Malware payload (Mirai)", "value": "ef9f0ff7f2ced5b55ee45b20413752af07c33b835e322511cff8c2391da1b278", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906432, "uuid": "2a2d9810-a352-44ab-923c-c077c4ba0956", "comment": "Malware payload (Mirai)", "value": "8d966d7bfff9b5f6b044853446549983fc5fc3f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906432, "uuid": "3afaea22-4064-4c51-96bd-846006c3e96b", "comment": "Malware payload (Mirai)", "value": "e78597638041129f98c22a788cd3d662e1bfbe1d7f2e6479081c930e4e12b5aa3c2727ccb65134994fa5ea52c24198e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906432, "uuid": "41c5c028-5034-4bbe-9599-550a52d5c401", "value": "T15F048C63FA0E1491C86606FC1FCF5B9D392315425D6793E76C5A363B2AB78CB0A123E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906432, "uuid": "a0a06526-a1bb-4d3d-946b-d2746edcd9ac", "value": "3072:s9+VfDMcgYfDhR/hnqStx47NisyJqhGskgOCkkd+1sVKRq:sQfzH/wyx609g9sCNo15Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906432, "uuid": "8e008392-d825-4cd9-9a01-278940b3bd0a", "value": 173536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906432, "uuid": "152ee71b-cc14-4a33-bb5b-b193f673d570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906432, "uuid": "3ff0c63a-14eb-4c8d-8e24-739042bbf6e1", "value": "ub8ehJSePAfc9FYqZIT6.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0ae83d-ecd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906242, "uuid": "ed261572-f77f-49e4-9231-934448bf2fac", "comment": "Malware payload (Mirai)", "value": "74049f9687adec96322c9f1420043fa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906242, "uuid": "869356a7-f412-4982-9324-0b27a8a6696e", "comment": "Malware payload (Mirai)", "value": "f03b3ff51bf4dbff6ab637cc9aaf340b71b788f874d5a1d511dbba2d5cc56b94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906242, "uuid": "fc8749c8-eec1-4419-b3fc-e6e085382f54", "comment": "Malware payload (Mirai)", "value": "82700722a37195e723ffe8c1c43e36306520b056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906242, "uuid": "3d81f034-89f6-47fd-b963-c3628376cf13", "comment": "Malware payload (Mirai)", "value": "878becf040197e935fdd588381e45f6b9e833215810dfa7cdd4d53dbb80c95b3d6d95238bb18e027c7c80ca5e14603d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906242, "uuid": "15d191da-7d3e-4ff6-920f-32a2d2e52763", "value": "T1DF24961E6E328F7DF268C73447B74A34975D33DA23E1D684E1ACC1152E6029E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906242, "uuid": "b9a61cfc-efd9-49f4-959a-00fe8898ac48", "value": "6144:/PWg34cNBy9dEcqIIqIj5q1E+rTqj05KY9Mc:LmE+F9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906242, "uuid": "ae23f0f9-1af5-4447-a9d5-04ea76022dea", "value": 211628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906242, "uuid": "d1839fcc-d771-40af-a5c5-5926575eb2f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906242, "uuid": "08c5e16e-89f9-4455-8751-a8d8803a17bd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ebd0da-ec36-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767838091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767838091, "uuid": "a9a7970e-bda4-4eea-9c22-87b10bdb4618", "comment": "Malware payload (Formbook)", "value": "843ea059163b2e5b5472ab50845deb7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767838091, "uuid": "cb583875-20bd-4257-867a-a2278e2d6148", "comment": "Malware payload (Formbook)", "value": "f1480ae593b10cb4e34ca69aad57cbc14ca94b3aed963c870affd9dba7bb2356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767838091, "uuid": "831bb0a3-f929-4eff-a7d6-7a80e74ad423", "comment": "Malware payload (Formbook)", "value": "cebc3a488c66b1766b5c02b642c178b8bc0494eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767838091, "uuid": "1229b95b-c74a-4e0b-9740-cb9c116502a4", "comment": "Malware payload (Formbook)", "value": "dc60cb8be87c402e57a70447b8a1f6e48b8779e8883ec7c0823b5d51cc8446ed78292d21cb85dd9fcfb44b58a1dd48f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767838091, "uuid": "779670fc-34a4-446a-9daf-118e3c666f20", "value": "T12205135C240AFE37C39717B10512F37253B11E9ED80AEB0ACBFD9DE77816A12C989295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767838091, "uuid": "f64a2b3b-d523-4fc6-a7f4-560d89485475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767838091, "uuid": "31e7e3e1-597b-4de6-aa4c-280b0a61a5ba", "value": "12288:xXBvVw/C02RLbRHytsuDGHCRp8ugeHuZ3CkdMUjjH3vaSA6ZE:xXwa4+uDGiRpethjzvc6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767838091, "uuid": "9bd05821-6c42-45bb-9e08-ee21f894af5b", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767838091, "uuid": "f57e3278-53f5-4e77-a494-ffb977237cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767838091, "uuid": "19a9887d-6392-4459-9dc8-4724575c197e", "value": "PurchaseOder00047T792198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92a0eaa-ecbb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767895226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767895226, "uuid": "241f864e-1398-4379-9f72-fb9b9193c7d8", "comment": "Malware payload", "value": "8549e86f165a7d4112acac48c55195b2", "object_relation": "md5", "Tag": [ { "name": "47-92-124-240:8000", "colour": "#C9199A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767895226, "uuid": "c254ccf2-33e5-444e-8d6e-dfc41f467ecc", "comment": "Malware payload", "value": "f1a21228baba05d95723b509e5c7ba2e761a4a362b35644b654e823dcf69b923", "object_relation": "sha256", "Tag": [ { "name": "47-92-124-240:8000", "colour": "#C9199A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767895226, "uuid": "cc3d0a10-1d84-45b3-8ec1-f3a95f4e2dfe", "comment": "Malware payload", "value": "f9fc0009b766355cd563424d0c831e235e9907d1", "object_relation": "sha1", "Tag": [ { "name": "47-92-124-240:8000", "colour": "#C9199A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767895226, "uuid": "75ebadd2-7738-4ac4-99ae-555f85f01e60", "comment": "Malware payload", "value": "00721db91461c9fcae79e06853c28e21309b3d7c51199c7bedf384e3f57111ab1e9ff8401d78623ae0f75177a61618d4", "object_relation": "sha3-384", "Tag": [ { "name": "47-92-124-240:8000", "colour": "#C9199A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767895226, "uuid": "4da1a2d0-c305-4d3b-971c-f64136d58637", "value": "T12E565BC3D56D8188C039F07A82E7A677A5F13C6D8931B7BBDBE047121B91B549A2C31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767895226, "uuid": "2c9d4c90-6ff6-4941-ae9b-f92712a936db", "value": "e0cf5dd7d16d69a673b985914dca0819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767895226, "uuid": "6c8ce307-185d-420b-a5c1-fc0fde9272bc", "value": "49152:Mjyc+3mOMBSsNz2HFNlkJ0JXvV6twTyLF7HCQfffCfyqFYaaCZ9y2wp3/1JYBxwq:c+W4Q2HldDmqO/1rNs299gkwbvn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767895226, "uuid": "156b5821-3efb-4516-97b1-0b39e0fececf", "value": 6001152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767895226, "uuid": "cce64083-a415-437a-8ad9-501be322adf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767895226, "uuid": "0852ccda-b63d-4b7c-862c-1d3b2b0dde64", "value": "agent 8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb198b06-ec97-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1767879714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879714, "uuid": "d0dcd40c-50dc-4954-84e0-8ebdfd31c44c", "comment": "Malware payload (MassLogger)", "value": "0aab6df92ad26c47acf649d48da4c464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879714, "uuid": "649bbed0-32ad-4f41-9fdb-918977d22dcc", "comment": "Malware payload (MassLogger)", "value": "f1d8e427f3a3d10ea5ac9f28cbb930bf61e42672af641335d417b57bd2860005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879714, "uuid": "bd4ba4e2-9f07-47c4-aaf9-22007a5a7860", "comment": "Malware payload (MassLogger)", "value": "68d27bb651f0aeb77d5c0eb757b498cce689e3fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767879714, "uuid": "2606d0ee-9650-40d4-b84f-405a02cf6970", "comment": "Malware payload (MassLogger)", "value": "738491fe63e23d3b688b082142b468c8310f9275a3766577d625c3eb4d1b8ee39cca37599418083fb8e0d36561853ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kingnovasend-mcnzxz-com", "colour": "#8E4249", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767879714, "uuid": "69b46385-2da1-4f13-a011-146b01ba068a", "value": "T117C4D05027A9DB06D0A69FF41670D7745BB87E99E820D3078DEAADEF7439B042E10393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767879714, "uuid": "52f07b2a-503c-4464-b7a5-75e1cc3ad1cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767879714, "uuid": "32bf8569-1059-4f97-90bb-bb26a00c4284", "value": "12288:wlAT2WLOihoQ/FCtOJCYLXO5IQ36Adk4YuN2kxnkR:LTFn/FC0NXBcbPYrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767879714, "uuid": "5a4d8cbf-2ddd-4990-807f-fb00e92ea63d", "value": 590856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767879714, "uuid": "44c578db-d0d8-456b-90d8-e01f64bb04ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767879714, "uuid": "dfa8ce31-1cbf-41af-acf4-eb5cc88315a8", "value": "Request for Quotation - 171595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9334ed-ecd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906127, "uuid": "1e684f46-2b8e-43de-b705-f381ec4dc830", "comment": "Malware payload (Mirai)", "value": "aec913c6e840f7b725a952dd1e4bfd90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906127, "uuid": "edfc0b06-967d-46f2-84a5-be693acb593b", "comment": "Malware payload (Mirai)", "value": "f20f09c58dec6bf8bd875306d8e1e6594b2e1912de3a8dfc5b7640e084bc5de0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906127, "uuid": "42c1709e-d2f8-4bb3-b63f-42b09c21b715", "comment": "Malware payload (Mirai)", "value": "26fc0816bc14010bc6af38e3fb71919cb55af38b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906127, "uuid": "4065a545-7664-43d3-9001-5346a38d41ac", "comment": "Malware payload (Mirai)", "value": "f99c616a7c2e230378e8cd95c3443b465c98402aab6d905677c739ce5e66d54ac88839c913e9dcddb8e9010c6180a5bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906127, "uuid": "94941e4f-1d6c-4e72-9ea8-ebec80bc8ea7", "value": "T14C24B50AAF510EBBD8AFDD3706E90B0635CC650722A83B367674D924F64A94F49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906127, "uuid": "9713c531-07da-4031-b4fa-bbb5532519f7", "value": "3072:wSsTF8vUoIi5eigDuOPzQRTQzejlZUrmZjAX/iI1S:wUvvNIuOPzQRTQzEZbZj2/iI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906127, "uuid": "0cef676f-b3c0-4060-8c84-9df524c8c4ad", "value": 215084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906127, "uuid": "0176d26f-5200-4256-9623-5a1b7c872903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906127, "uuid": "11c3d6c9-8a6f-4b82-86e8-1f90644bb8c2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e285e1-ec33-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1767836618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836618, "uuid": "e5946d84-126f-4f6b-94a0-88a3eb5131cd", "comment": "Malware payload (Joker)", "value": "41d71c08d5e0282e3a6f283b099ad36b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836618, "uuid": "024c57d7-2399-425b-8de6-a14c52df93a9", "comment": "Malware payload (Joker)", "value": "f2eeee218056e8cbdc239b1a8ee60580667e1aaf4515987980722a35f6e2dd4d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836618, "uuid": "13c8ea8d-a2b4-4ea9-94e7-a2cf29871ee7", "comment": "Malware payload (Joker)", "value": "face866774004630a3134c65b5178c5404154116", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767836618, "uuid": "e54181c2-9556-4f4d-972e-1417b6a1c546", "comment": "Malware payload (Joker)", "value": "29ed37e00094cd4fde56e972e565f9becebc4814c93fd7268c0aab9a5f9174a718a5ac8ef29bdec20ee9730a8fae30dd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836618, "uuid": "384eb74f-3aa1-4762-8ef0-7c4d95efaaaf", "value": "T149862296F728A43FC8B714724DBAA32546575C478093AB536D18730C18BB6C85FAEFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836618, "uuid": "14a2a28e-1dfc-44ea-b17f-d6b50f7af992", "value": "196608:EFVUXcsQLz1fxzF1kVLA/etoUeGCDzIaVNf3DqlN9:EkXGdnORoUrCDz5/Tq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767836618, "uuid": "60662504-ca19-4121-a9e9-767539dda354", "value": 8072735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767836618, "uuid": "f2a4870e-780b-4d9e-a04a-ce1a4e02554d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767836618, "uuid": "c7aac29a-9177-46ba-9ddd-f2fe9931dfe7", "value": "Open+Camera_1.4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc93f34c-ecac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767888762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888762, "uuid": "d122a9d3-a129-47b3-8a90-8c15c2fb0f17", "comment": "Malware payload", "value": "96f7512c4d7b7bdb14e893549774c6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888762, "uuid": "a80b47c6-fcc0-440a-9812-b992f8356895", "comment": "Malware payload", "value": "f388bdf766861f191fedc892b59267523b5d2e2fd2b43f70e9d0ef74c660fc61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888762, "uuid": "4a096808-bc8d-442b-b3c4-ca4a3a70ba1b", "comment": "Malware payload", "value": "b154bdd44ea7a847bbb36d296916f0ea7a3127ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767888762, "uuid": "9fcb1bd2-0e4f-405e-9a99-c1ddbe635f1d", "comment": "Malware payload", "value": "77c560b92ef0812b3312072ea20941a294c6f601ba16886a79e9e5a2a491b5348d91855dfa9856a2e4a2d5b49cc94609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888762, "uuid": "182ef144-14c7-4d57-b663-79d20b1baec9", "value": "T144246D5673A408F8E5B78279CC514609E6B2BC564760EBCF03A0476BDF232E19D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888762, "uuid": "4fab9dd2-8e2a-4356-a2b3-3447c93188a0", "value": "e3477015650bcfd88094f3f2380a2604", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888762, "uuid": "7f029139-9e68-4573-84a2-83ac3ba044e3", "value": "3072:NIM6x9z4jhVhcHjy/9MQwenr9klGxUx9Wgoe5w0SOuqJE6PtUsH5NNYO:jhjcHjy/9MCnr9kAx/kTSiRYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767888762, "uuid": "2868c011-2b6b-4cd6-aa51-99a002f59059", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767888762, "uuid": "fd4dd1d8-dbe2-4ee4-886f-d5e606103301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767888762, "uuid": "92581527-e011-4e32-90e2-2f6577062b9e", "value": "buildshellcode.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f26256-ecd7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767907030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907030, "uuid": "c4d8ee58-71d3-4b56-940e-bf3c40cd72d2", "comment": "Malware payload", "value": "3a95186019af1943a0ea0f8eb07a288f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907030, "uuid": "a6518f22-9aec-4df4-9c94-7cb0385348a8", "comment": "Malware payload", "value": "f38a56b8dc0e8a581999621eef65ef497f0ac0d35e953bd94335926f00e9464f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907030, "uuid": "9146246d-ceae-444c-9bbe-3e9ca655ef57", "comment": "Malware payload", "value": "b7e56f4b31f4fdbe844c3d4a4156f1d0e3b3ea97", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767907030, "uuid": "1e837450-938f-40c0-97a6-2b413e95c3d2", "comment": "Malware payload", "value": "f5fc6a312a9dbaae16210b6eb2af022bbf28993ddc0f91eb9adf0e7a749333408ac623361e9be3761f607837d0ed636f", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907030, "uuid": "f1ec5310-2e24-4789-8776-ea7f6ec0e7c3", "value": "T16BD5C6D05AC54A81F157D844B494FFE2093A7A67FADC0CF2D37A2A09CF6E9221647E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907030, "uuid": "cc159b29-2a83-4866-a494-f65284b2bc08", "value": "24576:J97DkXCl6mchTj6QZ0sedNOX7Prm4M3fbVaVHqkP3O55+D1K:b76CQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767907030, "uuid": "b60349c1-ce67-49bc-85ab-7c5a0e1861e1", "value": 2923520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767907030, "uuid": "ed4a4c84-5207-4fda-8f0e-53457291d777", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767907030, "uuid": "e880dd14-dba6-4079-8c77-29c5e555401d", "value": "Cybersecurity.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca3690f-ec3f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767841920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841920, "uuid": "d65308eb-78f7-4e27-b128-e18491ce51a7", "comment": "Malware payload (AsyncRAT)", "value": "6858a83678c2e5be6fd9d993efe45653", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841920, "uuid": "8f346803-d110-40cd-b357-bf94a82fe3e4", "comment": "Malware payload (AsyncRAT)", "value": "f41c17f9bba9c25464b3055ba41f032a93384306dc1c555f62ef4b83f44fe751", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841920, "uuid": "91c9ba1b-247e-498e-90a9-d7fae2efffbe", "comment": "Malware payload (AsyncRAT)", "value": "a7205cf9bb37a1a398ab5297fad18d51f6b3bc0d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767841920, "uuid": "ad241612-a73a-4c7d-8201-bb41178b8568", "comment": "Malware payload (AsyncRAT)", "value": "45e49f2579b902dbfe348908d1b877442a70528b31ad9427e49ae334d0d0075c437fda6423409f9a019b3c0820e09094", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841920, "uuid": "8285c48e-341a-4bfb-845f-c29aa4cb5b81", "value": "T1B193AD003798C965E1FE4AB8ACE255010AB6D5772102DB5E7CC811DB6B8FFC64A126FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841920, "uuid": "2e9f761d-9494-4e5b-ac67-7495d1901351", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841920, "uuid": "a9bd724f-0118-4381-a79a-c397c88b02fd", "value": "1536:Buy2DbXcqhcbbswdv6GVuQpPCCAf3/7VclN:BwDbMucbbsy59CCo3/xY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767841920, "uuid": "6f580668-d33a-4cc6-8c55-628b05c336c7", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767841920, "uuid": "b80fe5f4-86f9-4617-92d3-3a1ec9c1dc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767841920, "uuid": "c3a13994-0552-4d50-83ed-df0bf8511283", "value": "UrBanVPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01606ea0-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906433, "uuid": "b202be91-6ce1-4a5a-a5ec-7b363bbd6e61", "comment": "Malware payload (Mirai)", "value": "cecead4be1cdd1f60e9430321ca0be74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906433, "uuid": "28be3e28-4048-4e05-b334-974cb7715f39", "comment": "Malware payload (Mirai)", "value": "f52f6ec77dfef9681896e23e3ef21c77573832d81940e42c397acc7d3e20c620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906433, "uuid": "38f1ffb9-8ee0-44e4-8975-714139e000ae", "comment": "Malware payload (Mirai)", "value": "0684fbb7f6d5bc91e2bb1b09335edaed3b61483f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906433, "uuid": "0345f98a-b654-41a8-a34a-d3c3b95fb78d", "comment": "Malware payload (Mirai)", "value": "74ef8bab19612221fde1529c9f23f2730d7dd679fc3b0c2a59bcbdb1b5e1053a56ad652bb57138ea6bac6f377ac9cd2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906433, "uuid": "538718c7-1431-484d-b50b-3e64dfe82d48", "value": "T1414302669270E789E89F057CEF9A76CD4E2CCD80B56318AA0D9071432CD83DB267C7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906433, "uuid": "db24b32b-0b3a-494b-ad3d-505c716e68e8", "value": "1536:K8zEbIkIhbjLbGZ+j/pA1/71t6KaR2NqBpsb/I/Fw4nouy8Gye:bYK/66pAhmP2k7e/IawoutK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906433, "uuid": "e011a87d-f9c5-4ee9-bff0-954bdcfbe5ad", "value": 57844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906433, "uuid": "8f75d5df-3866-413a-b65b-34dfc51c7bd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906433, "uuid": "27687482-2fc7-46bd-842b-0a2005cff35e", "value": "ub8ehJSePAfc9FYqZIT6.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c58302c-ec93-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767877863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767877863, "uuid": "a93b22a5-9ca2-4b02-ad14-e3486b60c313", "comment": "Malware payload (SalatStealer)", "value": "490099632cb4b04cda139298addbc285", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767877863, "uuid": "25632725-8c05-4ab4-9014-517c98e9b5da", "comment": "Malware payload (SalatStealer)", "value": "f601912293932f26df842d0d636ce6b50f74c98c6d6c538118b9850fd395af29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767877863, "uuid": "ce3e4063-0919-403f-910e-6640a9f9955f", "comment": "Malware payload (SalatStealer)", "value": "f9156fd6746adb53b67634a51bc1bf306cf4bd0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767877863, "uuid": "89279b40-48e3-40ad-a7c7-ca0b467bd9e0", "comment": "Malware payload (SalatStealer)", "value": "37722b3450301510f35e0e15ad1851a57fec2d5c3f5a7d0ebdc7554ff5a1fc482c7431d24413e766c2c5f5c7c65e433f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767877863, "uuid": "e4c01cfa-bb1d-4a89-a445-76e6ec4a3306", "value": "T113C66B11FA8B54F5E9031835809BB23F67315E048B28DBDBFB543B6AFC776921927209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767877863, "uuid": "317562ff-40af-4f97-93bf-6e4600d559b2", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767877863, "uuid": "26086e1e-a4a8-493f-8b3b-2a0d43ca9879", "value": "49152:tPV5vpc5Eb4GslouBdb3Mk0PwQoDpK4vv1CaP4yQVSNiBVPQIhg4E9lgszE+0ifK:BXvpuEwoOY/CmM9vfyN7JU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767877863, "uuid": "dc9a97c0-5869-4df0-99e5-142ddbe62eff", "value": 11657728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767877863, "uuid": "06957d4d-6e4d-45fe-bf32-312cf5f54948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767877863, "uuid": "ef44c648-21b1-4108-905a-826dd05771f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3ccc37-ecaf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767890022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767890022, "uuid": "51506247-de2a-4583-a325-83413d800560", "comment": "Malware payload", "value": "64a3e2eae3e676ee8ce449e8f48945d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767890022, "uuid": "b91e9fe2-451d-424e-b20f-e567a8c4bd48", "comment": "Malware payload", "value": "f8c7f00941b0da07ae3090620a9c87a720a34eb11a3aa925d77da42813c7e80f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767890022, "uuid": "856f6f50-6dcf-44e1-ac5a-20f53090f55e", "comment": "Malware payload", "value": "635e3f851184b8e39467703ba76fd4325e8470e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767890022, "uuid": "68fd005e-ca78-438e-8d32-b5f7f324d263", "comment": "Malware payload", "value": "d22c8c31362421290dbb1f0a33fb45b2395c4382dcde33cb23a60eaaab4b5f1b846668fecdb22fe509d4427244ce21d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767890022, "uuid": "944dd23d-3911-47ba-befe-23dee310f62c", "value": "T19F963A92FE400A15C69BE239DD7861557230B088133626D76B670BB94DDBEC8173FB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767890022, "uuid": "07e06c36-15df-419e-a05e-f94f5bbd3f2f", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767890022, "uuid": "9b69db4a-398f-493a-9de7-5dbfc5e70ed1", "value": "49152:3Sw5aSaurb/TDvO90dL3BmAFd4A64nsfJ+b+K0FELLfBdh/yWWUeUwAsiPk535qs:3SCPbph/+itSOQsHJWsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767890022, "uuid": "6bb07c26-9587-404d-8c53-9d6ad359af5a", "value": 8950400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767890022, "uuid": "a93515c8-85d5-4686-b59b-962f30ecf158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767890022, "uuid": "f95018d8-9d2a-482d-85bc-edccbb859a68", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c54cd80-ecd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906479, "uuid": "0d656b5b-6dfe-46e0-b935-dd8f67f731ab", "comment": "Malware payload (Mirai)", "value": "0049cc8caf900e06b27cd37141c48139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906479, "uuid": "a4066561-4e3c-42da-8319-328d7f3a58b8", "comment": "Malware payload (Mirai)", "value": "f8d24e67516850da71b446bcc90496a65e78fd81ab5b9d63f53706673eac7d85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906479, "uuid": "ed5a4b32-700a-45dc-9919-7dc32004a3f8", "comment": "Malware payload (Mirai)", "value": "ece2c0f002f75cb34bdc83b77d5ab5e066247a86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906479, "uuid": "0656f09e-601d-4f38-9b3d-5afc7c6ab28d", "comment": "Malware payload (Mirai)", "value": "12df5ff2115557b841b852496b2a31333fadd8b814d1f79c5f96e9e5ed46a288a7223138660917fda00bfe43234e1fe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906479, "uuid": "05aa4d9d-e7dd-48ab-b8cc-bd74b6709809", "value": "T14804F846FC518A22C6C612BBFF9E438D371617A8D3EA32039E155F2136CB95B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906479, "uuid": "2129c5c2-fb75-4a96-8ff8-1271b0e5a25c", "value": "3072:0FeZUYrkbK1E0/8/A46ssEs9lhvc3QVZDl:0AZU2kei00/A46hEs9l2QVZDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906479, "uuid": "477732c4-1f77-4fa0-b711-b02a5b9cab2e", "value": 175712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906479, "uuid": "debe428a-6f99-495a-a5f0-583f400751c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906479, "uuid": "70594252-da3c-4f8f-a547-a0fc3ee24ef4", "value": "ub8ehJSePAfc9FYqZIT6.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576e71f2-ec49-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767846019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767846019, "uuid": "13c79722-020e-4ae4-86e2-08dc0b0a2a91", "comment": "Malware payload (QuasarRAT)", "value": "6d0861c1d8ae5985227fdab20f1f0dfa", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "genericrxlx", "colour": "#9A30D9", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767846019, "uuid": "6d0005d7-ed19-4c0d-9609-b147bc8a5b05", "comment": "Malware payload (QuasarRAT)", "value": "fa47a3c4fe941625130f04f3486b3f03dd95b53086af9840cf72a136c95c3979", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "genericrxlx", "colour": "#9A30D9", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767846019, "uuid": "55b137ea-0df1-4ab2-83c4-c43dd8347f5a", "comment": "Malware payload (QuasarRAT)", "value": "9f9e080fff57acb9bc76f62881fc0e15e92b59e2", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "genericrxlx", "colour": "#9A30D9", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767846019, "uuid": "4fa61c5e-efea-4794-9067-704ebc9be716", "comment": "Malware payload (QuasarRAT)", "value": "1417ec3ae0d01e3cafade258339344c74d54d5c3f1b5bbab5419c5edeb22d4383c82196f1b641b03da3d36ecd2fcbcd6", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "genericrxlx", "colour": "#9A30D9", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767846019, "uuid": "6495e450-1e82-4fb3-aa98-b830dface676", "value": "T112F529103BF85E22E1BBE3B3D6B0041667F1EC2AB363EB0B619177795C53B5049426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767846019, "uuid": "e25a5b94-1a10-43d4-acdb-f41cc9e686f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767846019, "uuid": "70e1c21e-8032-44c9-8aa8-b7437fa1e66f", "value": "49152:ivDkl2luaWIuuPjl/4dPDEF8SjAq+3ZarPLoGdATHHB72eh2NT:ivYl2luaWIuuPjl/4d7EF8Sjo3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767846019, "uuid": "a8b0f4a3-aa36-48dc-b6fc-7c882ab208cd", "value": 3333632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767846019, "uuid": "920fbfc6-a7a8-473a-91ba-64690be8e239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767846019, "uuid": "c9b909ae-66c5-4fa9-971d-65b3c3ad2dfc", "value": "internet-explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed5b161-ec9c-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767881679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767881679, "uuid": "b616df5e-5080-4d8d-a049-6a60755cd73d", "comment": "Malware payload (AsyncRAT)", "value": "af2d21905fbdae22a22b6516aad670c0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767881679, "uuid": "9752e8d1-3ce5-432a-8383-d879ad88562d", "comment": "Malware payload (AsyncRAT)", "value": "fac0ea914e72f08856d3c2c68a4d3f447269d002d8488f8a60aef9d7e989f0c4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767881679, "uuid": "1ef0182a-fb72-47f7-8a3f-8840af20d1c9", "comment": "Malware payload (AsyncRAT)", "value": "abd32dc5b10ae9794e43b1fc92ff2d21b12029cc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767881679, "uuid": "5fc5947b-a2c9-4086-96a3-a6a8459625c6", "comment": "Malware payload (AsyncRAT)", "value": "2464c09ae4dacb62602560f31aa623b79ccfdb0f3bbc7e4b9c139230ff44957a9bac38dd88b3c8ddc8f96d444f06b43a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767881679, "uuid": "7d0843cd-e186-49d8-8bf8-e01519a2a83a", "value": "T17D6633299530D57AE307A2B82DE23EC1EEB6757636C9079B7021D8B85F473F05F68118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767881679, "uuid": "85d680fd-d924-4565-9612-92e3fb0d7ec4", "value": "25a0d623c5baf84bae4d5ec6f243e150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767881679, "uuid": "f5a21cb3-5053-4f80-90db-5af99af9d781", "value": "196608:bWMP5EFEYCFhecxts5NkIfITv8uFHnMKkHX67pTbcN:qMPCFAFhpbs5NkIfm/pMKiXcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767881679, "uuid": "918c175b-ba94-49b1-b971-8de940bc8737", "value": 6644224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767881679, "uuid": "9fe5235f-e5e3-442c-a493-2abdd6ebec9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767881679, "uuid": "29e0a143-3c60-4194-abf0-662ef6450459", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feaf7224-ecd5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767906429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906429, "uuid": "910b8606-51b0-4fd8-b295-8832323d7ed3", "comment": "Malware payload (Mirai)", "value": "67c449563672ec1495b9284fad7cc5cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906429, "uuid": "ae21b125-4427-4345-a879-4abc241d6527", "comment": "Malware payload (Mirai)", "value": "fc72d38d915bb71a73bc468cbbebc695c31dc98552eaa3c5f26194616555312a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906429, "uuid": "4f5e34f7-0d61-4c23-bc30-a7a48a02be63", "comment": "Malware payload (Mirai)", "value": "e3c13764ead16f4c2c9bc44a4a3574167b109363", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767906429, "uuid": "02a4f2c7-f483-41f2-8f14-36fe60e7834b", "comment": "Malware payload (Mirai)", "value": "f339791f70bb1b01369c32e58621327c763910189920de5e4b09847634efb634af2494aeceafc968731271e732215b9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906429, "uuid": "225ab6da-567e-49f4-9e01-f4bbef741795", "value": "T17A53026AFA707E9BD98BC2B65994C478227F74D6F77AC98608F1DB00143ED2357C8884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906429, "uuid": "adc7b78b-07a3-4775-b37b-2eec722ffa5b", "value": "1536:ialWR/uYgYSsJEBTbNdJmakLMNqoCAwpMHlvSQ3gwPaM6N84u+qgw09R:iaUp9R/JEDdJm4dCVs8wiM6+4u+qgw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767906429, "uuid": "a5d80e23-5333-456f-8359-1c44690f5827", "value": 63380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767906429, "uuid": "b1490d97-b41a-41d0-a9ae-6ae93a23bac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767906429, "uuid": "b3da1820-a45c-494d-929f-025379be22a8", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51189c3b-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767856316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856316, "uuid": "7e3c121b-4737-433f-9fd8-9dbf6921df75", "comment": "Malware payload (Formbook)", "value": "c4ec948dd48bb8b1d7dfbfb03b935208", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856316, "uuid": "309e53db-9233-4008-a043-e0cbe63fdfe3", "comment": "Malware payload (Formbook)", "value": "fc78f07ab33fee5017cadfb32ca7db946a37422091d4f547a81feac1ba87b4ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856316, "uuid": "9a30ee62-ed24-46dd-9ae3-a3a2e51e2e13", "comment": "Malware payload (Formbook)", "value": "4bda67fc0e612bcfc0b55cb55ca78aa0452cbe21", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856316, "uuid": "16cdca7c-31f8-4d9d-bf2c-39916fed1541", "comment": "Malware payload (Formbook)", "value": "d19b7ddc80ede0a7f165a180d6a79db662cc42f5996ff32f69b57d3f7f12bdbd105bb55a34f7eac531487959f2fbffea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856316, "uuid": "cab90141-3782-4caa-b826-c4ef5597961b", "value": "T1AD728717D61827714C73737A9B3A400AE530462B70269775BB6CE241BFB27888B53EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856316, "uuid": "629b713e-6a25-482e-a46a-9fd9e1e8a4a7", "value": "384:5tiq6M0RaOkNtEuKonVAxcim88F0eSls/V:Ll7imZ0eSls9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856316, "uuid": "20e16002-b34e-4b94-8c8f-d8c34a26d216", "value": 16219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856316, "uuid": "d99ceddb-074c-43a3-aeee-45488f342aeb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856316, "uuid": "f7000255-399e-4a3a-9c86-45109b99a9e8", "value": "IMG-003-01072026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611da52f-ece4-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1767912607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767912607, "uuid": "d4eb7c6c-a87e-499a-a732-a2dc5d4096a1", "comment": "Malware payload (njrat)", "value": "1f3b6a8fc1b926693b0199d5ff7655f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767912607, "uuid": "4e05e3fe-7d98-4cfc-aac1-3ea687c6a02e", "comment": "Malware payload (njrat)", "value": "ff171aa9a800be9ded4693b72082224b23ac3b8045ddded595b5091438b73f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767912607, "uuid": "f1e7dc9a-c217-4fad-a82d-0d4f6c06b344", "comment": "Malware payload (njrat)", "value": "509b36b9e120355af9c8ffcfbde7721a3e1d409e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767912607, "uuid": "edf32925-a15c-4574-9f4d-29f3307c0d83", "comment": "Malware payload (njrat)", "value": "e8bc0ffb0b1a07dca661c97db7a98646fe474d9a9dbebbc5dacbc033dea87a3da6127cd5a91e117a6e8b42680ceca4ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767912607, "uuid": "7e6502f9-cae4-4d56-bae5-6a5c3b4609f4", "value": "T146661223B2CB633FF0BE4A3A4977D266543B666168138C6697F4085CCF2A0D51E3F646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767912607, "uuid": "9729ce4a-d9d3-4ba1-9d50-2592e5f2bacc", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767912607, "uuid": "fd4e2ffa-e083-45b8-87a9-d45c1c0f2ecd", "value": "196608:RSW7LSZB+betznR8PX42mqo0PV5auKHUpj3aHB5:RtHSZ8KO4/oVsuOkjaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767912607, "uuid": "3b93b39b-e615-4a06-a958-ce93f6d437cb", "value": 6753752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767912607, "uuid": "6534536c-f6fc-47e6-ba7d-22eb17c0f1be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767912607, "uuid": "1a097d0c-4d03-49f1-9022-d760bbda2e8f", "value": "1f3b6a8fc1b926693b0199d5ff7655f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd2c04b-ec61-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767856311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856311, "uuid": "769dd5f9-76cb-40da-965a-d9424d8ac04b", "comment": "Malware payload", "value": "403e1b4b1cf7938928bef7d942b6790f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856311, "uuid": "93655c38-5649-4e1c-8f23-33d0acfe28ca", "comment": "Malware payload", "value": "ffada2670bd6c3424eaf19b6ae80dc69cb43ad34e4504d1465e06ced613066dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856311, "uuid": "036b7946-cfc8-45d8-8620-995fd3a4ee30", "comment": "Malware payload", "value": "5f1f3b139b6aa736707370bc3586472cdf4db172", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767856311, "uuid": "c60a1ccd-7008-4a13-baff-e0ea90a3855f", "comment": "Malware payload", "value": "2d88c079e57870d57341381468c80a5cc259f68b9f434454b722be5f2cbbb71df93c005147d3707ab24d597acbed1d47", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856311, "uuid": "c4278be8-773b-4dee-836a-cc83b8a19362", "value": "T11F266558F60E2215813E3F116F81D7FDF21583AF3E15482D392A02CD9EA5768B2BE4B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856311, "uuid": "3d791cf8-0292-4620-80fa-7e38722fa81c", "value": "192:8RyUoPg4Wxf1ymY8Oo7tYNru+fRyOc3SYoxjIMQp8TIMA0aiZtAQEqYj2anwf9Fo:uQcCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767856311, "uuid": "fcce313b-ab06-4c29-9ae9-e0adf9cdc972", "value": 4507222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767856311, "uuid": "7e7157e3-e736-44ac-9b60-f1af71ea5085", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767856311, "uuid": "9d635fa8-7eac-415a-b8a7-d9da8ce5a024", "value": "Quotation List_049475.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }